{ "Event": { "published": true, "date": "2025-05-16", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2025-05-16", "timestamp": 1747440182, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "e465749e-ddcd-433a-a281-3113bede5e63", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42ae8779-3233-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747385619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747385619, "uuid": "93378426-934b-4de4-9d6e-bcb5d6900fe8", "comment": "Malware payload (Mirai)", "value": "77be1776641296def5ba0b42600adf5f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747385619, "uuid": "eb36dc74-9991-4b2b-bedc-a1f570e910fb", "comment": "Malware payload (Mirai)", "value": "003a63dc08edfb0be612278bde17f1fc4522485aa4ca289f86b9c05d9b354161", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747385619, "uuid": "9dbe8b0d-b062-43c5-afcd-78dadca10528", "comment": "Malware payload (Mirai)", "value": "22f31f579d47bda9d12332186ac5e18843530c36", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747385619, "uuid": "94aca003-b4ec-4973-aae8-030e3f887f8b", "comment": "Malware payload (Mirai)", "value": "39dd75ddd6c6036854a3f2a5612bc2f52527e4d04d8e26d3207fc74d438bc68cab93db0ecf9652adc221d577a65dc342", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747385619, "uuid": "5412b454-da32-400f-aa1d-e723800ae63c", "value": "T1A4F2E12582FD3E34DD3561BBC0A4C8135B1A57B999EE70382B5086BCF586A0E657068F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747385619, "uuid": "399ff2e9-d313-4687-af45-0b7754a8d63c", "value": "768:wrXEz6zLHOXr0Us4N9lomVZOYPk/FRF9TlEihEHs3Uoz3:wroXr0n09Wm3OlRF9JEOE6z3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747385619, "uuid": "b267571f-b408-4019-8622-2832b5aa0291", "value": 34820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747385619, "uuid": "7490271e-f369-46a1-965f-c0862663895f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747385619, "uuid": "97897775-6326-4082-bbdc-1d6866b47a40", "value": "neon.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a06e4d36-31fa-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747361295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747361295, "uuid": "3248cb27-88af-4350-a696-34e7adce3102", "comment": "Malware payload (Mirai)", "value": "0c088c97164a274f79b24c14275699c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747361295, "uuid": "c4996576-c19a-4756-8788-22ac696ae0c7", "comment": "Malware payload (Mirai)", "value": "0055bd3ea7b48c82d2eb81bf39c5ff5ed1ee112acc8cbcdf60668fb8c533a342", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747361295, "uuid": "5068aedf-a2a4-4761-acf5-c78e9a281081", "comment": "Malware payload (Mirai)", "value": "b6df1c7b99c88ff0185dd8482064fc48a6b9ea6b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747361295, "uuid": "0814ba10-b485-43c0-b2a8-0b4a036429b4", "comment": "Malware payload (Mirai)", "value": "e75f82ed404882aa12956a402f51502aa393e841eb5f55cb6bb20ef98577db910cf158f181c53954122da07fe02223eb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747361295, "uuid": "f1ecb3a1-ee97-4ece-8c68-37814cc78d66", "value": "T102E31A56E7408B13C0D61779B6DF424633239B9493EB73069A28BFF43F8269E0E67905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747361295, "uuid": "37a406f2-f6f5-4567-8a55-8c1a9605d19d", "value": "3072:WWF3OaOdpe/XTxWJoK27oKdv7nNbUM/9HjTNy+:x9OaOdpe/XdWZ2MKJ7nNYM/9/Ny+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747361295, "uuid": "492b6119-55b0-43e8-aa74-2c1249a245a1", "value": 151483, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747361295, "uuid": "6662847f-75dc-4f43-b1fa-590155950ee3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747361295, "uuid": "65f5edd7-291c-4f7d-8118-168cd5cc41f1", "value": "neon.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba8e277b-3228-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747381095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381095, "uuid": "003401d1-3ec2-44b3-bd3e-3ec00d73e17a", "comment": "Malware payload (Mirai)", "value": "60c6856245dc3eb7f8fbc2f9f1257829", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381095, "uuid": "2301365d-c59b-4d84-998c-105262cdffd6", "comment": "Malware payload (Mirai)", "value": "0073ffb48e25a564edc9013b0b0191d10862a61ecb4d1e0e32a6750bdd6915aa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381095, "uuid": "9bde2da5-a670-4eee-a067-85d4fab2a1b1", "comment": "Malware payload (Mirai)", "value": "7549810484162e2a45d8e4ab999b2852d204a4c3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381095, "uuid": "8c619556-50cd-46c9-9d11-e2a12b1aee72", "comment": "Malware payload (Mirai)", "value": "23da24513e22e26080dab54371cd0afdab6ed7d2dfb61d8673314e716ecb3031ea5a14777162f03c9909b50c70242361", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381095, "uuid": "f292c441-9585-40c3-a68a-d127e7dcf01a", "value": "T14B14E75127294EB4CEC343B983E26ECB09AB40DA8F73D4D49F9B18A05978745BC3C66D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381095, "uuid": "a835903a-ee6b-4b48-a10e-e38785e3cd29", "value": "3072:QL1gLFHAIFPADP81PAtJngx5BmYTPha/B5I2q:GSPFP1FXPd0B5I2q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747381095, "uuid": "bf18721e-adac-4859-9573-bc072f2ba0af", "value": 206104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747381095, "uuid": "155289b9-357a-4784-9f75-b3f5fdbb6cf6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381095, "uuid": "7ca77554-2a3a-4c34-b7e5-0f84f7a0122a", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecec3688-3287-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1747421982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747421982, "uuid": "f326ff79-d142-41c9-9a91-7e335b85920b", "comment": "Malware payload (Gafgyt)", "value": "d8fd1996f3fddef38b830004899aa263", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747421982, "uuid": "87ddd3af-5628-4136-b4bf-2eacca773ec6", "comment": "Malware payload (Gafgyt)", "value": "009103f202a3c932a6d49e6f626d99b3f5ff6b1f436551dfd9bd133db64f830e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747421982, "uuid": "4c0dfe1c-ed55-4031-a4b7-32c1c558f8b6", "comment": "Malware payload (Gafgyt)", "value": "cec73f8d8331b71d8a609a4b2acd6a96efb45202", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747421982, "uuid": "f3c003a8-1c92-4567-b29c-c7499c8f9901", "comment": "Malware payload (Gafgyt)", "value": "c1a17cc78e2d49e85afe77eea089c621e5efab7deaa9dc8121c609ab0c9684eeef258b1896a5fe8b1750607038dc1602", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747421982, "uuid": "a6627119-2c33-43fc-8523-0337916078c3", "value": "T108D34A5B6A1C0793C45B89B12DB733E097AAEFB304D621C5E41EBE805B729752236FD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747421982, "uuid": "62ebb88c-a5a2-4f0c-bdb9-1c094246811f", "value": "3072:Y1wF/l/SoDQ2vLTGetJ8add9QzhsnWWF62Z6bqKQibhgBik:Y12/l/SwQ2zTGetJ8addQ+bnZ6bqKQia", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747421982, "uuid": "5e061589-9c7b-4b9d-bce6-1e1d6f1c6178", "value": 137936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747421982, "uuid": "40e62a4b-b8af-4686-a1a6-5d5d55edc668", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747421982, "uuid": "c87dcbfd-c347-4423-bb5b-ed7d8dd564e3", "value": "cron", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "646a170f-3264-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747406721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747406721, "uuid": "4fd694ac-320b-4bff-b968-b565c248b3fc", "comment": "Malware payload (Mirai)", "value": "8775e64eb52e28d5f66e144a3f172483", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747406721, "uuid": "6ab78397-d5d4-4c7c-9f7d-c2a70346faf7", "comment": "Malware payload (Mirai)", "value": "01307a9b656530a9adecdfe7effe8289eacfa54289f9f0d59b389059eed2bebe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747406721, "uuid": "8d843ec9-5c49-41ee-8d58-11059c1b2e8c", "comment": "Malware payload (Mirai)", "value": "bb321e51430a445aa5c569449019004ddc7ceb6f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747406721, "uuid": "8e111878-dac4-4bb9-96a7-0de0cb5e7a4c", "comment": "Malware payload (Mirai)", "value": "a69ced35d93c4d0cd1f8c6caed53c41e56c40d07605b634c8605cea2ae38002ef49fb43e106f993c39f4e522d8389b23", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747406721, "uuid": "64cdb0c4-7072-42cd-a46c-05f54fdb9b23", "value": "T17D93E909FF511EBBC89FCC3706AD1B0228CC599B26A53B767570C429B64B24F1AE3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747406721, "uuid": "7857179b-5fed-47ce-8668-a8c8be4aed86", "value": "1536:Hhmps/Xa16fZb6CTtNLuHG9r35/DqiuZxATvJtRJ8lN4xg7ma:HhmyXa16fZ+8x3xDvuqtayOma", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747406721, "uuid": "ec7b16a6-09e3-4c2c-b5fa-aa4c577afab3", "value": 92972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747406721, "uuid": "e07fa89c-56f1-4cd9-af36-032f5b162673", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747406721, "uuid": "cc181c2f-fa90-4f76-a67c-c0105b06c375", "value": "neon.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4455a11-3228-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747381112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381112, "uuid": "57701b28-b9ea-43dd-bffc-647350e3c5eb", "comment": "Malware payload (Mirai)", "value": "0a0665e5a19d252c75de57b55e88d154", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381112, "uuid": "ece213f3-41b9-428f-9eb8-6e38a926097c", "comment": "Malware payload (Mirai)", "value": "01a9d0e667587081eb99aff6d7f516ba0ca2f1c836305ecc62ca553c2613a6aa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381112, "uuid": "093bd5f0-60b2-43e5-b4d0-0a4c2ce1fcf6", "comment": "Malware payload (Mirai)", "value": "25b991b54c47e829d97294ad1c7bdff03f20792f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381112, "uuid": "c135ff2b-0290-4132-b831-dff1c4096f01", "comment": "Malware payload (Mirai)", "value": "c9fd3166a5a0c792a3bda4494a93c765e49099f2905f309c4367519a551a0984c97f8d410bf94357f54879942f554035", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381112, "uuid": "f7e08f67-450b-435a-8128-4fa967438d5b", "value": "T104534A25697A2F06D0D0E57A12F7472472F1629D3AF8CA2E7D330E4EFF2464425932B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381112, "uuid": "c5cea809-b7e7-4f63-a98f-5fba25a58e1e", "value": "1536:RnOkiHp1OkFRFdSZTk9+2kl+ySFUx+D9qcB+:NNxEZqBAD9N0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747381112, "uuid": "7cd2a705-4e89-47db-a44a-90b61ee6df0f", "value": 66388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747381112, "uuid": "9eda965c-c78b-45d9-9b0d-7d58fa1346e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381112, "uuid": "d5b63545-bee0-49bd-914b-95b6ae489122", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da5fda46-325a-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747402624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747402624, "uuid": "5f178582-c23c-4112-96d8-3a5c217dc61b", "comment": "Malware payload", "value": "20a18b2ef3dea6fed67d29e02b46328c", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747402624, "uuid": "2d9504a7-8249-4938-ac7b-7a2ec14fe1be", "comment": "Malware payload", "value": "01c76495d19200f788bf96a3c637e28c78a8afccc80815238428640d3b1acde6", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747402624, "uuid": "00cab9a8-c2c8-4fc7-b6b6-9361f22a0630", "comment": "Malware payload", "value": "20dd7817f761cde5e4793adccd1febb9710e56f7", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747402624, "uuid": "80321fef-4e6c-4681-acb1-e792b79c6f40", "comment": "Malware payload", "value": "675e081bea969e0315e4a4a0782fced8eb9d492b86bbbb857bf67e0adac8c0beac7dc4767d9e294fc72227e6fedaa6b1", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747402624, "uuid": "d070702a-a9c7-4646-abde-ba8b3d1d44ba", "value": "T17A51C0117AD60335D3B18B316CF68A51FBFB3846FA01E62E5156015B0833E044A6CFAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747402624, "uuid": "a4e2af4d-a4e1-4245-88df-1a54f0fa62bd", "value": "24:8iieLlZF8W9ddSBmEXuHY9nvE583ybaCj+7StvMNP5RoSwE/LyKqybHWlSw:8iiylZqMdQBlXuHwvgba7JR7webHXw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747402624, "uuid": "6e52ee64-5427-477c-87c7-cdb5b86f7524", "value": 2628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747402624, "uuid": "009d1e9f-cad8-4556-b526-cecdce0a2687", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747402624, "uuid": "9b6399d9-0939-4b32-ae9f-13d67f72aefb", "value": "Documents-HUSQVARNA.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9bdc3f9-328a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RemcosRAT)", "timestamp": 1747423185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747423185, "uuid": "eb109a6d-ecb3-4cb8-9335-6526710a557b", "comment": "Malware payload (RemcosRAT)", "value": "303f5375b479522cc300eab24238dfa4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747423185, "uuid": "3ac0fc06-3a05-4412-a07d-9c2c20ca4fec", "comment": "Malware payload (RemcosRAT)", "value": "01ec11624672fe96956951effc56579c4f3f3ddcba4894adf6ad5793a6c040c7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747423185, "uuid": "67038a92-a25d-4985-8716-0c823e4ec901", "comment": "Malware payload (RemcosRAT)", "value": "07a49eb2a1c703924cb1e5bdfd3f9e9adf8cf81f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747423185, "uuid": "d9e1d9fd-4154-474f-bd39-2b69f57435c3", "comment": "Malware payload (RemcosRAT)", "value": "8d08f12920d96884cd87564b781dcea69bde85c6f2c999c2e323e8eddcf9a2240dff882c51050953301aeb25900585e3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747423185, "uuid": "914cacbc-bac3-481a-9ed3-18369ef82f33", "value": "T17084500AAF1160B154F7A35ABE2A8204E53133179452863739FED6446F72CC4D7BAFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747423185, "uuid": "ffe391c4-8e4f-4166-96c6-eeb3d19b5f46", "value": "768:CLxTzoNxbZfHY7bjJ42lpkLxTzoNxbZfHY7bjJ42lpb:rf9PkjL5f9PkjLb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747423185, "uuid": "fcef1f65-6f40-427d-b17a-f905515a38df", "value": 400195, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747423185, "uuid": "03f7c6d2-f926-4b0c-88da-bec41e5db879", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747423185, "uuid": "1a643526-9a90-46d8-b028-14b4b509869b", "value": "REQ 4653 Y 47148.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e958f4bd-31f7-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747360129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747360129, "uuid": "72215b2b-a5d8-4408-9cf0-5da2369d4433", "comment": "Malware payload", "value": "4b51f21d39a339c9dabb9db234d681ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747360129, "uuid": "bbe39c2c-3acc-43c1-9591-a4ea89018e2d", "comment": "Malware payload", "value": "01fb02022d30c7ee78617a0d8616f3c0a46d5f508d38cc75496edbeb29b6cc9c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747360129, "uuid": "d09539ef-ec32-4d6f-b247-0c212f3fe6b7", "comment": "Malware payload", "value": "3cb48e8f393bb7cc6e046f6ddec9daabff199bdb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747360129, "uuid": "502e4aea-16ac-4405-adb5-8548182d6d38", "comment": "Malware payload", "value": "da1e911a51451783e4991a3da36ceb8a2692bf5ed0169595d40c723be4644cb86946bed45a6c722c04da4a2b92fd4f15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747360129, "uuid": "2d435112-7edc-4626-9bbb-3acbfdf589ef", "value": "T1B1C64B47E89104E8C4AEC6348A669213BF71BC485B3067D72B90F7682F7BBD06E79750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747360129, "uuid": "c75a9405-c282-4a66-a88b-ce2b85b920b1", "value": "69ed8fe9971e163f7398f35547368370", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747360129, "uuid": "6426ef58-d69e-4468-b953-f33c2cadaba4", "value": "98304:/hs4mW0fzM9ufINRNyBtYmHP+0IwwhQfTIgiPt3c0Et5MHP0rwWDBFg:8IkfIv4R2hukgy+ng", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747360129, "uuid": "a8e68edf-506c-438a-a7d1-88371cc12c03", "value": 12009984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747360129, "uuid": "89a6d3da-b30d-49d2-a499-effb5f516560", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747360129, "uuid": "7846add4-aaea-487e-8024-6cf462594b25", "value": "CursorX.exe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc34bfa7-3287-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747422008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747422008, "uuid": "3719af96-a073-4808-820a-486c47f27355", "comment": "Malware payload (Mirai)", "value": "a4f06d609a73358d89df0e6e91404fe5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747422008, "uuid": "a3d66e13-099d-499f-96ae-6b51691d517a", "comment": "Malware payload (Mirai)", "value": "028f81a57e585f15a818eb2154f1b9f29f989ba070f9916d3946eaad6e03b8be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747422008, "uuid": "f90d45d3-8030-45e6-ae36-ba0595ac2e06", "comment": "Malware payload (Mirai)", "value": "9ab2ef760768b7e6b495008ab3a5b290fa891ba0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747422008, "uuid": "b377cfb9-304a-4fea-94dd-a63aa569d762", "comment": "Malware payload (Mirai)", "value": "d598a83c896f42729fbda95b8f080688c7ccc204393aebfd4a7d6c7b26d8ab9bcfce3c2281bfc34a4283b07513ca6d97", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747422008, "uuid": "135366c8-3bdd-4a37-a874-e3f59c6d0f95", "value": "T1E5F2E18DF1E07DD9ECCC05BCD09623201944FBC5300EABD253A59D85C6FB84F69AE16A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747422008, "uuid": "7bbbef63-059e-48f7-b46c-d3c8fc119904", "value": "768:RSobbgeGxz020PmTaOoDLgiwOrxPVhOFoIdVWMc:coPPGE+TrtiwOFPuk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747422008, "uuid": "8045112f-185e-4510-b495-d93a5d7b99dd", "value": 36328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747422008, "uuid": "45fb5041-8b1a-487b-8e32-79a99e27b77f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747422008, "uuid": "288406b9-6f0d-4358-888d-0488a25a24fa", "value": "db0fa4b8db0333367e9bda3ab68b8042.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a027956e-3228-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747381051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381051, "uuid": "f6d762bf-63e2-46fd-ae5d-95177e04003b", "comment": "Malware payload (Mirai)", "value": "662880228359bde15041e633dd774aad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381051, "uuid": "7ed7d0c5-c1ff-4c3a-879d-00512661b708", "comment": "Malware payload (Mirai)", "value": "02d1b1dce3fd7f4748ddc391d5bb17c22ec40ef07019cfff168047acad13d43d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381051, "uuid": "e3cbadc1-9d45-4a2d-9b60-e1c2564371d2", "comment": "Malware payload (Mirai)", "value": "3dc9bc0792b952823a2ad221ca6e081f331fc998", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381051, "uuid": "ad74cb81-e8f5-4581-a71e-ed4c3c245a95", "comment": "Malware payload (Mirai)", "value": "78d624fbc71259ec6f7112508cdde18deabe979348e398ec9eb097b3ac90afff06af56adab3da52c20b9d4871b379f79", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381051, "uuid": "31d39ac1-b995-45c8-9f28-ec3a40b5807b", "value": "T125B2E19B02DC0256DC4962FDEF6F2FB7B30198581FAB5EF06B90894927A363C57C0808", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381051, "uuid": "8e0025c3-5137-4bf6-bef9-924ff1160a4d", "value": "384:MU7LalTr/lS3rOVT6rJoA/0np7NYLPr/oIZeySzi4uY1XiBNpld/pciu5uwYunik:T7m2bOVWNj/0njYLzPSzWH38uwYugIq8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747381051, "uuid": "56816496-2800-4f5a-a851-8b6e51c43ea4", "value": 24484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747381051, "uuid": "8712c172-2732-495b-8ec9-7acdf72f535f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381051, "uuid": "2be7a66e-4d26-476d-8a83-6bf5d7b4c4b8", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8364b7f-325d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1747403962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403962, "uuid": "fc771d9b-8fab-426a-b3dd-f0a1388f605d", "comment": "Malware payload (LummaStealer)", "value": "c3cabdb189cb72b2cb9858b613839a99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403962, "uuid": "40da5e4b-3ef1-426c-9c7e-60f47247c578", "comment": "Malware payload (LummaStealer)", "value": "03043905043872fe9ceed12ff0dff88ad54e896cdf829c869af1af5d54e23d41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403962, "uuid": "91d308d7-fbff-4e3d-a774-a7d9b297ea14", "comment": "Malware payload (LummaStealer)", "value": "a82acb2623cc7bfbd0eeb257540d63cfddfb8e50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403962, "uuid": "8785099d-55bd-4e2b-b6e2-5c1e0b0e4db2", "comment": "Malware payload (LummaStealer)", "value": "c1ef4d3db9688f6e1988e25b1157fe6abda42ec9634530b5d031c214aa2efea30772757c416f39365d563d13f013aa76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403962, "uuid": "9a605548-5bc6-4ffa-a0ee-631d33232cca", "value": "T1D69533F71F8CD477C9380AB161AF6BE138B04147A88AD0DD4936D227251AAA73B1CD77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403962, "uuid": "c126be46-f117-4872-8194-504d0dc0397a", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403962, "uuid": "0235558d-eb67-44e6-83f4-a96c13591bc9", "value": "49152:RSe0cAb58K/IXLTdDLcebbzaHy3vxuEl2l+WeUv8SzTYYi:RSrcI58DySAExqv8SYYi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747403962, "uuid": "239abcae-b241-46ad-9fe8-fab27464d99a", "value": 1915392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747403962, "uuid": "dbc73598-3b40-404b-b6a8-006a6938f6ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403962, "uuid": "e5a0e052-395c-45cd-9dda-ec7599851509", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56e74955-321b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747375345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747375345, "uuid": "3a77e4a4-045e-4c42-b4af-88300746d153", "comment": "Malware payload (Mirai)", "value": "48c1bcedf4b34c8f7f72b46558f8efd1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747375345, "uuid": "0fbf24e4-ba84-487a-a3d2-d99496488d4c", "comment": "Malware payload (Mirai)", "value": "0356a33b864af62e34d0eee87c456caa8969d59fb2f68cfb45d5907443028634", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747375345, "uuid": "88df166c-8ed7-41b0-ab15-9f5a8de100b6", "comment": "Malware payload (Mirai)", "value": "8cba767fb1ddca24e43c73c9eef5d4e642407636", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747375345, "uuid": "efcf62ca-1c9e-4c69-9f93-935470e334b1", "comment": "Malware payload (Mirai)", "value": "7dfadaffce31dce9e5871b6a7d52114fb0aec9f7914667f8da59b7996433cc1a123171214d4b6118552dbd086f3a33f2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747375345, "uuid": "54cc707b-0d44-426a-bfc0-f9b8b34313d1", "value": "T10DE2E15384E28C0FE7AC087E216E6D6A5516C278E005C54B9FDC343ABFE9F51B138E96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747375345, "uuid": "75bc79c3-bc4f-42b0-83ac-43c17ac14783", "value": "768:EgAZ65r0CKy9xKmpixgzERYFKCb8TVrDv6tnbcuyD7UHQRjc:2U5gC1x9p6gaY0CSVrWtnouy8HyQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747375345, "uuid": "ee8a8fe1-a2db-4e8b-b7fb-802245e98f70", "value": 31700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747375345, "uuid": "f407c60d-bf74-4aad-bc1c-55820d90c3eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747375345, "uuid": "3e144b71-afdc-438a-94de-6f2a2a8a619a", "value": "neon.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e27f0f6-3236-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747386873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386873, "uuid": "f7dffe6c-c7ac-427a-8981-fe5d63c1899b", "comment": "Malware payload (Mirai)", "value": "9bfdb45015635ccb9dc21016c38df47d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386873, "uuid": "c9936d1f-d674-46e8-83e8-2aa79f5c6862", "comment": "Malware payload (Mirai)", "value": "036197e01f5552caf8c1f43225d3ba1f9ce30fb61065f09ca95787b6a9acfc2c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386873, "uuid": "907d73dd-81c0-4d4f-8c6b-1c48dfc991ac", "comment": "Malware payload (Mirai)", "value": "d00824d7b6f36f3ce0bbcd99e75f90803320c24a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386873, "uuid": "ac0eb9af-da62-4490-98b9-f5105292a988", "comment": "Malware payload (Mirai)", "value": "2f2fd10c5c773862836e421c4f7e5c31f7bbfcc6010cca4b98e9b809ee8948c718717c02962e91a319bc8e87b85ae0b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386873, "uuid": "91b882c5-9465-41d0-b49a-8d247e21698e", "value": "T11543D5E8BC859922C6C9227AF16E65CD3365B3E593CA3103CEA20B11774716F0E37E95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386873, "uuid": "9379744e-9266-49a8-8628-dc8cc0b599de", "value": "768:oJurVRrzJZJ/mu9Dijs+QAf6KIjcwLMb0lcxV3kRBqO3cDjXcw:zVdz9DAdrirIwLMb0lG3kRBqO3cv9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747386873, "uuid": "91e8b728-2750-4b38-8c47-d4cccc66a860", "value": 55328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747386873, "uuid": "726930e6-822a-4911-830f-f8ef59898ad5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386873, "uuid": "5bb73136-037a-4df7-b4e4-bc9ddb4cab56", "value": "Mozi.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb9aba7d-326e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747411162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747411162, "uuid": "1d9da495-49be-42e1-8807-099c0e39fb81", "comment": "Malware payload (Mirai)", "value": "fc0c8df44fc6b9f17238991661cdc388", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747411162, "uuid": "3c4918dc-1b11-40e3-a5da-61229b5d40b2", "comment": "Malware payload (Mirai)", "value": "03707f51414e845fefe808c728732f80a80e6842256bf02fb1c7ed27c410f36a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747411162, "uuid": "68a651ab-45f6-4aab-8e02-86f03fb9ac30", "comment": "Malware payload (Mirai)", "value": "8e974afdd9045eb97825c3530da59628990bf3ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747411162, "uuid": "3f9dbdd2-d8c7-41be-a45e-df881306bb48", "comment": "Malware payload (Mirai)", "value": "4223ad588c229fb5bc9e3378f02a0c7b250f38a43a186f96cf2eb0f155f4c10733858b6d12484de1640f5115207360e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747411162, "uuid": "adf32b34-4288-4e07-a4d2-d60bc3383ca4", "value": "T1AC539DA5C4B8BD99CF69927CB61488389723900564A33DFAE742C796D00BEECF10D7B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747411162, "uuid": "a9f1d34b-1195-4bbf-a731-457519fae55e", "value": "1536:B/bivQhunGaiwt4gpuFosvXZxwaqUfs3rBktd1UYjC132:BjiBGhGp+XZxtf+d21UYjt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747411162, "uuid": "c4db16ac-b12e-4e81-b381-941211a4d11d", "value": 64360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747411162, "uuid": "d6104564-4021-40a4-a74d-9f3327072ecc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747411162, "uuid": "134dbf8e-3871-4222-9416-26a5caed0ab8", "value": "z3hir.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dbc5b38-3288-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747422091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747422091, "uuid": "75db8d41-5e7d-4907-95d8-fcec67712954", "comment": "Malware payload (Mirai)", "value": "e2196a2de92b3e9f302fc7c97fa3ce80", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747422091, "uuid": "a753ab9a-2060-47a5-b95a-e1e3c525910a", "comment": "Malware payload (Mirai)", "value": "03b6ec557b797fa8aff32468c47261d2e5621273a469dc134eef72222e3980de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747422091, "uuid": "17514431-fb33-4e48-b5fe-eb50088b7d1c", "comment": "Malware payload (Mirai)", "value": "6783bcd1dcf2449b0c3ee4c93a089a0812057463", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747422091, "uuid": "b4074437-922c-4eb3-abfc-1f363cf0732b", "comment": "Malware payload (Mirai)", "value": "2a9ed06cd7fba8fcc578f3e8dc517636fab8cd82d48a806b12efcc1453931dadf535968a93822469cedee8d1a98ea0c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747422091, "uuid": "73987ae6-08b4-4a5e-b9b2-3a430c932911", "value": "T1A6E34C46EA818E13C4D527B6BAAF41893332A764D3DB73069D185FB43FC6B6E0E63501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747422091, "uuid": "0393a791-ea33-445d-8aef-8e369438dbc2", "value": "3072:oNE5LOVcuRgh6DgLEPjx+O/TMaZMpttYE5zD3UvM/9hXl8mX0:oS4Vrg3LELR/TMaZM3tZzD3YM/9h18mk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747422091, "uuid": "f37428f2-0adf-4bf8-82d1-d6f45e590f84", "value": 157014, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747422091, "uuid": "0532497b-fc0c-4dfc-8491-56bc214f80e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747422091, "uuid": "2bc22232-4f7b-4ed6-a83e-7041bc6bd915", "value": "db0fa4b8db0333367e9bda3ab68b8042.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dab2946d-3296-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747428394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747428394, "uuid": "d73a676f-7618-465a-8cdb-066d8aea5012", "comment": "Malware payload", "value": "56f02f5a74f0c8d6416ffca549a32aa1", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747428394, "uuid": "8d7246ae-b531-4621-bfd5-d867b292072e", "comment": "Malware payload", "value": "047c0e23cd0de774443724ef8096c95416deb06ed817fa39953fe71952e64877", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747428394, "uuid": "db323c5b-60c0-442a-9b3a-032d4e8bfb75", "comment": "Malware payload", "value": "1cf4387596c793301ab4ff406130392c6bdd41a1", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747428394, "uuid": "2edbfb45-c990-487f-8caa-0a04820a38a0", "comment": "Malware payload", "value": "156be4003c2237a3a18c10d2a984910ef5b5970d39c97e4e456025c8e46f27ff163e183a5a32d62cfa3021bff507834a", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747428394, "uuid": "9079ea49-3bbe-4ee2-84cd-816d99263e37", "value": "T154F312DF44A3321FD103467C2D0A87CA4B920396127CEA67A311F86BDCC5DA12F539B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747428394, "uuid": "86328c92-f417-4d3a-b15d-06f8ba89e005", "value": "3072:kCLcc87m/wkDok3hUpvo1H1j70HQdvUx7V0zdjNfGF/roEMttPXMejrU1xn:N0ytwe1VjgHQa7cdjJA/bMtFMejA1xn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747428394, "uuid": "f5dd8c0f-f2c1-4ab1-b12f-5d230b3e2a1a", "value": 164187, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747428394, "uuid": "7cf6430e-6033-4a1d-bbb6-ca919296400c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747428394, "uuid": "15abb68a-dfdb-4d5d-97db-267439aa9ca6", "value": "TSF_Activation_ENG.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c21cfe2-3279-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1747415672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747415672, "uuid": "f2d30186-cb36-4d28-a27a-f7c557d915c5", "comment": "Malware payload (Gafgyt)", "value": "f2bf2234e8e5101bb668aa7b53f356ab", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747415672, "uuid": "6d157e5d-4d3d-4ef8-a612-7c7fad0cae21", "comment": "Malware payload (Gafgyt)", "value": "05214760c9dce0552a3ea3e11f131fbd2b6c0de7f2e8810ab15fa2aa41cea436", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747415672, "uuid": "4ff35b4e-219c-47b2-9a2a-631a11c076cb", "comment": "Malware payload (Gafgyt)", "value": "e383552174fcf5057a71fdda5e8de996d01f19d3", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747415672, "uuid": "7c0d0e92-ccc0-4962-8e6a-8892499f63cd", "comment": "Malware payload (Gafgyt)", "value": "be91b999fac046d60eb8248c09ff9f912db4d186b8ddf5d7716da7c154528e553efb5d2925d0f3d79ae71ec69244cef2", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747415672, "uuid": "ebf29a09-8417-479e-9e96-1a9876d92f9f", "value": "T1483184CB21E239786C65D97B32FA4C0475E1E08605D76F986DEC38F9418EE08B844FA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747415672, "uuid": "2d45e955-dbb4-48cb-a89a-73a68c642840", "value": "24:vCHyEChrCyMvPWHsCdrCBHCWUC9CZ/CCWJCRCXmu3CHRTC7m:vnE+rE+Mir0zUccnUQgAP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747415672, "uuid": "fa38da62-969c-4c2d-b9c1-3837f8a9f36a", "value": 1626, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747415672, "uuid": "34348336-30fc-4418-b647-7e12edc7436a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747415672, "uuid": "e98941b0-3f77-4fee-beb4-5ddff1d5ebd5", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "103734af-322f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747383816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747383816, "uuid": "e44bbc6e-7915-4b4d-98fa-a957e88f3ab6", "comment": "Malware payload (Mirai)", "value": "7f8d53f18efbaa4f803a1b7a0de11bf0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747383816, "uuid": "c63bc116-2e5a-4aca-aa74-c2a7824456d3", "comment": "Malware payload (Mirai)", "value": "0523fdf945b3e0ddebfaacd9221c5819df274cfa98c85e0f9f9d15aba11ec134", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747383816, "uuid": "46df48da-12f7-45e9-8df9-12fb729e3c6c", "comment": "Malware payload (Mirai)", "value": "70049d7833ccb5ba9749dbf5439b2c284e2cdfdc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747383816, "uuid": "5a3a044c-fc5d-4f36-8a0c-6db6e44a1b7b", "comment": "Malware payload (Mirai)", "value": "72ab55dc1462be3f9e1e14f367b2ea878919d60158304ff88277f8bc36417dca95a2389859d14bbcfebbb71c9ddd6569", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747383816, "uuid": "0b760b8d-5fcb-4cce-b710-61bd4d7c88e8", "value": "T1CC635B07B580D0FCC499C2740B6BB63BD833B4BD2238B6A977D4FA326E99D111E2D640", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747383816, "uuid": "cf6cb4d6-efd9-445e-bf2e-3880dd12627d", "value": "1536:mnSDNUnzPsSm9OE2Ql5arsYQNj+1y+PWXZRgpF3sHfk2c:mSDgUSm955aoYQM1y+PW3gppsMV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747383816, "uuid": "8e7cf7df-8efc-466f-a613-cdfd1ecb5329", "value": 71472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747383816, "uuid": "2d99081f-92be-43ac-8f3d-63965a4ba555", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747383816, "uuid": "0fcd80fb-9f65-4060-a83b-f7ca78fcbece", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "752a2cdc-3276-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747414480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747414480, "uuid": "6113b855-2844-4c32-9a58-f1aa8a07abae", "comment": "Malware payload (Mirai)", "value": "98edf98567c937d619a748f529f5a6ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747414480, "uuid": "540b240c-1f84-43ec-a3be-9c5de0534ffe", "comment": "Malware payload (Mirai)", "value": "0532afa1bbf17a798e9a2f01e6a837e21c6440402751228bd83a82d25d2b7ca7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747414480, "uuid": "2f5b191c-3d2d-4418-8a34-8a0b49e20ded", "comment": "Malware payload (Mirai)", "value": "05dbf16c96ed0227cb3fa37055505f24401aac38", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747414480, "uuid": "41f83df7-152c-4a84-a7c0-d32d92870722", "comment": "Malware payload (Mirai)", "value": "b9e489d78b7ccaf946cc5eb6e3e5c18e655e65b835049aac75111d8491ec071e516c92153431f28f7af99c32d3f6b868", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747414480, "uuid": "29b091f7-ea96-461d-9bfc-d5a532315803", "value": "T1F56302B352453039E09AB83B8D9A679074113D5ADB144DFF28E7D3FE6EF8F900A50662", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747414480, "uuid": "982318df-c7e4-4396-a1b9-cc3c6e817652", "value": "1536:lA88Z3PGs/mK1mMchzOLzLt/uXXT3dN+e4Gdpu2n:MZ/GsuTzitSD3dNxbtn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747414480, "uuid": "4cd91615-bb66-41c4-b09e-400c2f451eff", "value": 67316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747414480, "uuid": "e95d9b81-318c-45de-b341-a79a991c8acc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747414480, "uuid": "99590834-5c34-4db5-9096-9582b71adece", "value": "neon.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9168b0e-31fe-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747363027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747363027, "uuid": "ee5d19f1-9a92-42c1-96df-f0aa64aa8ac0", "comment": "Malware payload (Mirai)", "value": "c51320a267b80eac819adfa0dbb04f6c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747363027, "uuid": "9374a39d-e417-4546-885d-c0c102194a8e", "comment": "Malware payload (Mirai)", "value": "057e64901616b4e49965643c9037693603bdd5b0aba607910784d8f1dca4f5e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747363027, "uuid": "7829d0cb-f4fb-4914-9495-a7f323302aa8", "comment": "Malware payload (Mirai)", "value": "8a37a090841f866780a66c11f34a7bcd79f6e8d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747363027, "uuid": "47fb8e82-e951-4226-a966-28320f71275e", "comment": "Malware payload (Mirai)", "value": "496b01326ea993aac43d1bb597780591350b40be0ad22b77c2e5c005085d1337454ab8af7e527c7d23b98fc0d64f75da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747363027, "uuid": "a5c30294-e4b8-445c-b848-cb0ee2ed8010", "value": "T17CF2D0DD6591BA9CDF0C1B7E10BC12F6ADCAB0D0227A5B9C572C04A67AA38563C0C575", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747363027, "uuid": "75b24aa4-2b8d-41ac-beea-b9bf5a6a2118", "value": "768:eNmsowF96FL4iBRqiT+yi7QQTZ7/jqAUPC8gngl6WxWWvO:+NlFALXBRbTli7bTZf/py6WM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747363027, "uuid": "50c80e97-6f1d-46c3-b6e7-5b56eff379f8", "value": 35612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747363027, "uuid": "eba09416-ef3b-4232-a134-1b1e2903efed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747363027, "uuid": "28b2edf4-f549-4e42-a8ff-bdca9b5f38ee", "value": "neon.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93227399-31fc-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747362131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747362131, "uuid": "97d9ce0a-82d5-4d62-a684-df3ae9883685", "comment": "Malware payload (Mirai)", "value": "0f1a28fc3bcc7dbcbbf8e48683c09091", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747362131, "uuid": "e2793dd1-5c4e-4929-b893-588ab387e1eb", "comment": "Malware payload (Mirai)", "value": "05a41801f9583db51c33fffb177245603115eedd462e6ff6aa7b1cbe14a6c56d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747362131, "uuid": "a9f4c170-b739-4968-8058-bbc0ea89a517", "comment": "Malware payload (Mirai)", "value": "bde0853bd959da5bad1c870aa5cc28dbe2d920c8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747362131, "uuid": "6b8f6f39-badd-4119-86cf-132cc312d5db", "comment": "Malware payload (Mirai)", "value": "c797d4b2d9ce48a905e1be532f430adde5d52c42783f4c036516a48613852147c26167500a6c45d1feec23f7e3722461", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747362131, "uuid": "82347754-17d3-4d0b-a6d8-65bf8b48e084", "value": "T199F2E03E921249ACEC1E417957F08FE22EB61F33540FD10E3689AA23EE639D48C947C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747362131, "uuid": "121a3333-c0a1-44f8-b12f-56eba8422f6f", "value": "768:xRdm6NXAkUq4iib4A9jV12MY7Vug7Nz3uSa1JgGlzDpbuR1JK:xvNpDUqMXjVkVZeSavVJuE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747362131, "uuid": "3a3e6af7-b8f1-4b1d-9a75-46f4fe1b2b89", "value": 34864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747362131, "uuid": "3a32b357-02be-4357-a318-240df2dade20", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747362131, "uuid": "e9e5ecef-8013-49f6-8c6d-4a8af47f34f2", "value": "neon.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "498bcd70-3226-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747380047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747380047, "uuid": "b6b1367f-aa1a-4a58-95e0-f4207c981de0", "comment": "Malware payload", "value": "5aa593ac49e932b86df93b7c03e9d914", "object_relation": "md5", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747380047, "uuid": "6249caa6-bf31-4062-9bad-e9b3410661d5", "comment": "Malware payload", "value": "05cda79cf11759dd07c4dde149451e4ed2a43b0566bba55016e9a02ddb7e9295", "object_relation": "sha256", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747380047, "uuid": "3f5a8813-721d-4235-9f18-8d39ef9d977c", "comment": "Malware payload", "value": "57f0d9e823f14a7417d93fa7862d12b26370bc9f", "object_relation": "sha1", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747380047, "uuid": "808d045d-a618-486d-8d3b-7fc83470d734", "comment": "Malware payload", "value": "3b6e84975d9e89123e7df7b6f92cb44473f60570e2edcf95068528ecdce03832bc8bc9adf9cc8fa63635c04670d21b93", "object_relation": "sha3-384", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747380047, "uuid": "00a6b0dd-6d7f-4635-8fd6-3d1285f244af", "value": "T14B5523F8B1A9944CF0C844047B372F8A9E9DB173A1CA1091752BC27B6648DB6F1762F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747380047, "uuid": "cb56e7b9-0916-439b-bccf-15c9124ebeb7", "value": "24576:I3tSKoiKkib69Ofs+0Po1Ump5jOy95LvBh83Th7u2zOvVNiqI35wYgMgSGh0ReGu:cEipOLCmpAyrz8Th7QvVNiLwY/gSGh0Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747380047, "uuid": "96765f10-08f8-40a4-8fda-52732c447989", "value": 1364380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747380047, "uuid": "c9b88583-803f-49a8-9f92-60fe077a5023", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747380047, "uuid": "a3e26367-ec7f-4ca4-a0b5-4fb3224d5670", "value": "\u041a\u041f-2024.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8b82aa9-322a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747381978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381978, "uuid": "155703c7-f3bb-4182-9062-75a9523145e4", "comment": "Malware payload (Mirai)", "value": "bb44ec96479fe3f7c144c2cd6bba1d0f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381978, "uuid": "28f5ffe7-ff36-4cae-a948-128efcf0be8e", "comment": "Malware payload (Mirai)", "value": "05ef6c144ab4249041cb52317365714be4f34bafeb49f02ad4507009d65bc54b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381978, "uuid": "814ebcc2-6b4e-4bfa-b945-bb9e52b10c0d", "comment": "Malware payload (Mirai)", "value": "7ed19cf5eb5878f907027321a544207082ebdf36", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381978, "uuid": "58459ee1-3fec-4b6d-a3ad-7132772ee77a", "comment": "Malware payload (Mirai)", "value": "6bd6916598fd3f74a5d8935a35bcd49199d7084c67eec4fab875c95411cf3be6f233cbf9d0b5368de89a4918ef3db720", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381978, "uuid": "f3d1a57f-0e06-45e1-bf9b-251bbc8c77a5", "value": "T1E2E2E1E2D1B85F96E3ED543D2EDFAAB728108315A404E9F54D807C7E6090E25B42E25A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381978, "uuid": "c6854df5-751a-4e16-b081-33e192808a13", "value": "768:S52QkfPDA/gnd49kqtl7RwseBEVtCoZroAtiOmgjQnbcuyD7UHQRjW0:OkHPnd495l7KKjCoCCH0nouy8Hyy0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747381978, "uuid": "c20d6c15-0b8f-43e8-af0d-9ab6537e2797", "value": 33508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747381978, "uuid": "2fe92026-84a7-4cad-8f05-3b120ed71d8b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381978, "uuid": "7881f6d2-33b6-4974-a0f5-30aadf009979", "value": "neon.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30973ce7-325b-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747402768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747402768, "uuid": "692f0f25-2d1f-4341-9fe5-71cb2faddcd2", "comment": "Malware payload", "value": "ac1ef49f8bad2011c753c7ad9cf5d09a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747402768, "uuid": "b160334a-2e99-4fa7-8bbc-974147895632", "comment": "Malware payload", "value": "063567178b600e789a0a8ab78a6d4904a68897268f03fe2c91187a741d5463f3", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747402768, "uuid": "c9ef438b-ed74-4af6-b76f-184f4981593b", "comment": "Malware payload", "value": "893c8a91f78a994235e6d1f0a0df2c4335fb2caa", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747402768, "uuid": "c99d64c4-ea75-4592-9144-882d962b50bb", "comment": "Malware payload", "value": "93e678dccacd5850be1102fb918677b3dcc070b71bce69e1cec328db1bdc2209dde4bbde6d8b2895fdd699606fe37a2c", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747402768, "uuid": "aac74411-f52b-4c14-9913-e40fa0473ae6", "value": "T16DC42334933770EFDA4E7BFC491E3154D3AA00D556A66692E920D227DDB0F0B2FEA109", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747402768, "uuid": "ace32377-5810-4a6d-ae4d-b8bf69092012", "value": "12288:Iexo6iTNJ/yxRZCyMLb5O6bA+KY/iUotfWqjo:b6JGZCyyOHRYaUotB8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747402768, "uuid": "c7edbd26-1021-4bc1-9f7c-5c7ee92a9e4e", "value": 544573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747402768, "uuid": "32f27298-ddac-4ef9-801b-b59094f3456b", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747402768, "uuid": "3559803e-7021-400a-bca9-093d6fd3e302", "value": "aaaaaa.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28c25050-329c-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1747430672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747430672, "uuid": "40e86711-7481-4148-a922-12fecafd59ec", "comment": "Malware payload (Prometei)", "value": "a042765ac64531d5c083d6732850fc10", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747430672, "uuid": "99fc71af-34cd-4319-a7f0-4e0314d81724", "comment": "Malware payload (Prometei)", "value": "06c14f27eb525d0c7533465fc794cc9c9358601a2477c4950f73612fa99b228b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747430672, "uuid": "565721ba-d920-4035-9b91-67bd50ede6db", "comment": "Malware payload (Prometei)", "value": "cbd29d1281b783e32b1f117d398a3864a6dc06cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747430672, "uuid": "5ad6e72d-2aa4-4abb-817b-e1b0fa37ad48", "comment": "Malware payload (Prometei)", "value": "8d79c900adc7cf97d68ab4f94c98b520b5cf36a4b222e34b48938151ec1028fe5bdbf4ab23200249183f530ca8b70f11", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747430672, "uuid": "bce91e97-f094-4b06-8c4a-c51f90da0bdc", "value": "T1B99423F8C83D2E3098169B3CBB1A8268F0E15772D9562F6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747430672, "uuid": "62eefb48-7fbb-4efb-8d75-0e2b82512586", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitg1:25WOSACZSV6eKRH5EPiamb4DsDwwcF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747430672, "uuid": "bd9bf400-8c98-4e89-807f-f3f849ba4338", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747430672, "uuid": "c9204716-308a-4aac-90f5-fb00760f9b54", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747430672, "uuid": "3791dd1f-961c-4f11-b283-31cc705e4b20", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "303c57fc-3227-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747380434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747380434, "uuid": "bd79f63c-4aa8-4a81-b803-48410341e14a", "comment": "Malware payload (Mirai)", "value": "2cb498a1dbc18ad627e77c1136274076", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747380434, "uuid": "3ab7ceec-5356-40c2-a01c-27793e9ad424", "comment": "Malware payload (Mirai)", "value": "06e2412de89317b5bd12aaced95dd3d2aea7ba508fe05fab6df372e2a76d8308", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747380434, "uuid": "bdd83f64-8617-49e1-b0c3-7e9c8830ae5b", "comment": "Malware payload (Mirai)", "value": "3eef8649193e1021490c7627f41baf54bdff569d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747380434, "uuid": "1c71b110-9980-498c-aea6-14c61de9a4e2", "comment": "Malware payload (Mirai)", "value": "6cd49df84083e99e03b80be45cbed204ededdd2fdbbd220eda26ce2a232ba4c949f5b9d35b485d32e6564c1424fad6e6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747380434, "uuid": "68bcb9cd-14d9-4f8b-b46e-0b6165a2e881", "value": "T1E963026446021662F83EC7F9CF954B800E605F63554BBC8E39FAEFF6DE02118214E85E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747380434, "uuid": "5ef54f2c-9dce-4ef7-b69b-47945352545e", "value": "1536:brD9cstKblkYRoSoyCjZlUFFAxxMtl0w5JEVPD1vL9hzbCiGxWiPWdZVJuP:b9CdR5otoFFAx6taw5JEVbBCfWi+jVQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747380434, "uuid": "3c1c8745-71ac-464c-b734-d06b88b4b879", "value": 69912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747380434, "uuid": "55c0a8c9-2ebc-4793-9e6d-5a7a78c1ce40", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747380434, "uuid": "3e92aaff-16b0-43ff-b2ae-cc1124fed403", "value": "neon.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30992832-3262-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747405775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747405775, "uuid": "d1167049-9d8a-490c-80a5-44f4b86ef732", "comment": "Malware payload (Mirai)", "value": "baaff4224966956f669f364347c64186", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747405775, "uuid": "42a6b9c4-1179-432b-9cd2-fba406d0f342", "comment": "Malware payload (Mirai)", "value": "06e7b6389a52e78902f67ac09f7e4482039a77a5061a33c9d0d084fecbdd6b84", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747405775, "uuid": "693a7001-5030-4b37-882b-8c350663e98c", "comment": "Malware payload (Mirai)", "value": "a4c718c3c4bcc35c1646775297968264bcdd2e3d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747405775, "uuid": "3090c594-e688-4371-bc8d-1baeb6d82c22", "comment": "Malware payload (Mirai)", "value": "dd07ab576994e35aec44906c520d85aaa9ba6ce9ea9629844bf56c29e932f293fd455d3475814320b21c2349e62ec16b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747405775, "uuid": "6e07f311-366b-48e3-9bd0-8307c36a4551", "value": "T10473195AF8819B22D5C1027AFA0E514E331307E8E3DE73139E249F6177C656B0D7B916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747405775, "uuid": "8a81b8e7-8c55-4ecb-bbf5-ccf9d6f9cbce", "value": "1536:PunoOVghxBAhUiq7nbaUkCdwapg3+QgMIiHj5FyX07lD5JYw8:llAG7kC2ap0j5FyX05Dbf8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747405775, "uuid": "a8e20f46-f167-4027-887e-8c9cf108f4fd", "value": 80012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747405775, "uuid": "cdb87d4b-a76e-411d-86b1-e5b14426454e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747405775, "uuid": "d45d85e5-3866-4481-9f28-cbcd9ad3cc17", "value": "neon.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dc52301-324c-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747396455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747396455, "uuid": "597498b2-9195-4f65-9541-971e21c61ec4", "comment": "Malware payload", "value": "27747037c810ac55e86c7bd8e188583a", "object_relation": "md5", "Tag": [ { "name": "1po56mdxc-localto-net", "colour": "#E5C76C", "exportable": true, "hide_tag": false }, { "name": "AgidCert", "colour": "#56D604", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747396455, "uuid": "a99ccf53-79c3-4232-b197-4a93e25c5aec", "comment": "Malware payload", "value": "0736af36465f55c8b796eef5fce7ec72d2a00295996fc073ec6b641a5253251d", "object_relation": "sha256", "Tag": [ { "name": "1po56mdxc-localto-net", "colour": "#E5C76C", "exportable": true, "hide_tag": false }, { "name": "AgidCert", "colour": "#56D604", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747396455, "uuid": "b1d77708-cae1-4a22-a17f-bde46e21500f", "comment": "Malware payload", "value": "35839f5d7cd9d305ce9f2b92ddcf8a3e7013695e", "object_relation": "sha1", "Tag": [ { "name": "1po56mdxc-localto-net", "colour": "#E5C76C", "exportable": true, "hide_tag": false }, { "name": "AgidCert", "colour": "#56D604", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747396455, "uuid": "4cd64ff6-f2e3-4f09-8223-9d011ebf706d", "comment": "Malware payload", "value": "62ef54f40abc51a1ac1f57756146ab080b48070fb96707072f4c15802e22afc4db73cdecccaf34da9cf3e16e22819409", "object_relation": "sha3-384", "Tag": [ { "name": "1po56mdxc-localto-net", "colour": "#E5C76C", "exportable": true, "hide_tag": false }, { "name": "AgidCert", "colour": "#56D604", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747396455, "uuid": "9abad14a-a3fc-4a38-a02e-43a7cce2cceb", "value": "T14982EC47958C34A703B658F12EB55FB9A53307E2879EAE8A70D23C05D0DC1D3B66CA8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747396455, "uuid": "98de8add-ac24-4585-9d00-3a6f2601868e", "value": "192:vvSr39xHh0M9QHz5Ava1V3x0t6rwl6sYifCCsWuAPvvy:vvSr39xHh7rWWU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747396455, "uuid": "7cb6f42d-7183-4a26-9182-d068378630e1", "value": 19030, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747396455, "uuid": "1845c4ec-a5d4-451f-ab40-96635f3ee9c3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747396455, "uuid": "cac43d68-0e93-432f-a7fc-774842790882", "value": "FA-45-04-2025 (2).vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f0b0392-3239-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747388324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747388324, "uuid": "7e60686b-11fa-47a6-9e80-ccdaa2b0fd1d", "comment": "Malware payload (Mirai)", "value": "7962a00b3dbf4b187151932c62a0271c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747388324, "uuid": "f6cd022c-9506-46a9-944c-0090da5b7319", "comment": "Malware payload (Mirai)", "value": "079cff90b478d9516e612f4faa88dba0b809443c1b2ef030f9a19898a66b96b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747388324, "uuid": "ce822a54-918b-44e5-9d2f-7c608e98d3d2", "comment": "Malware payload (Mirai)", "value": "0eb0c924562e580a52b43c23d38c59acb7d32e52", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747388324, "uuid": "8be922ad-951f-44ac-a421-6218422a94ea", "comment": "Malware payload (Mirai)", "value": "722e39e863293b637b52b236945916261a44b17da755fb493328bb80409542642971a3dd014ef083dbeb67e072e4e21c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747388324, "uuid": "a82cfc5f-ca23-405f-afd5-d61e7e947855", "value": "T19893A80E6E219FBDF358C33547B74A31A75973D626E1C685E2ACD2001E6034E685FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747388324, "uuid": "0e8c2bd5-7c87-41a7-bd44-514ab351ddc3", "value": "1536:T/nztKKruBNQ5YzmV+mVumVHieJBkKWMEYlXE+xeANRRtjYUdyfD:DnztyB0YsflWWXEKRRZcL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747388324, "uuid": "bc1140b7-fca1-4dfb-8749-f6fb027ffc70", "value": 97292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747388324, "uuid": "2c85d16e-e4f6-429e-821d-2b172b9849de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747388324, "uuid": "b22a3932-4bc3-45d7-a319-fa1ac612a1b9", "value": "fmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccf7f24b-3228-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747381126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381126, "uuid": "6bebef46-4c72-4269-9d6c-1da85881e028", "comment": "Malware payload (Mirai)", "value": "6ca79514c15c62b50b0830f29d43735f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381126, "uuid": "3ed4ed8d-66ce-41a7-8ac2-1b8d4881b2f2", "comment": "Malware payload (Mirai)", "value": "08050394bcb9f306237954724ecc7d8cc7d9b5a90fed55336a6c7e323ef636de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381126, "uuid": "49b259d3-ff51-41c6-91d1-507fbae44725", "comment": "Malware payload (Mirai)", "value": "4c9c7018706579db3ab5655ac276617f26704583", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381126, "uuid": "aaef04b4-33a9-4fae-bc29-5e3af823ebf7", "comment": "Malware payload (Mirai)", "value": "ab48dbc0c529b39dd21a84ec55a889645ff34b447b2433f2e939a077e2319f3d9b98fb4ee3d6d215caeeffc524954538", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381126, "uuid": "3f870b40-e539-4ed1-8129-eeb7931965e7", "value": "T17304881D6E228F7EF668873147B74E25976C23DA27E1D640D2ACC1106E6029E641FFEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381126, "uuid": "b5d4ff02-6fcc-4c1c-bf32-51e89ed3d9aa", "value": "3072:jg57RM7LHZwbq1YSBan1yvbysxr1uGSXI:jglRM7LHZ0Bqyy1BSXI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747381126, "uuid": "2178d6f3-5b41-4685-8518-a4311c0d53b3", "value": 173888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747381126, "uuid": "ee3fd0df-2271-430f-a906-183b321f3858", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381126, "uuid": "29a77c85-723c-452a-a0f8-be435c41ad71", "value": "main_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b2159a6-3236-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747386814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386814, "uuid": "c9c738b3-d7ed-4b29-b6e0-ae3dec87c819", "comment": "Malware payload (Mirai)", "value": "95f10878c2808be70e207a1947abe0d3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386814, "uuid": "5723ac9d-2b02-464d-b210-cd808629673b", "comment": "Malware payload (Mirai)", "value": "084df132a08decb4e15cbcb1d97c19cee2aa57b894e751f1381d7fd3d7188f53", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386814, "uuid": "3f4e837d-92ad-4775-a602-b3ab0298a42a", "comment": "Malware payload (Mirai)", "value": "f540c540b7be6020b0928787cf7478a1712707e1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386814, "uuid": "95e454a2-7e42-4930-b986-d3ca48e1a9be", "comment": "Malware payload (Mirai)", "value": "e6e5d1a81b1573ca94bb1b9dc74df10d6cdfea343d7720c63a770144d76d55aa899fce04fada273c90394ebad1e4abdc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386814, "uuid": "29e58509-7511-4e48-91c9-9f82f17cb8ac", "value": "T1FAC2E130924AEBA5D3700C3FFE2D0149B0854F6EB62C76211A5997FCBBC59D2A2745C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386814, "uuid": "9f2f64ae-4b45-4622-ae2d-739aa7d000f8", "value": "768:Z+pkb3kIL7v4b3AOHj1i0OqXZvNSHabuMYas3UozZ:opaA3jHg0OCvNSabuMYXzZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747386814, "uuid": "be09d4e6-9dab-40d8-9ea9-60a5efd5593f", "value": 26728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747386814, "uuid": "cdff6901-278f-482b-b4c6-a30779257efc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386814, "uuid": "7ac9ded0-a0d7-47f9-b6ce-58df8f3239b2", "value": "Mozi.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "944ac88b-31fc-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747362133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747362133, "uuid": "5f4d6d11-c9d0-462e-8709-a9d78c985f76", "comment": "Malware payload (Mirai)", "value": "60cdf6f46e5a903f23004c8a7527f9a6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747362133, "uuid": "39d292e7-98dc-4a33-a0da-650a78d6c3ef", "comment": "Malware payload (Mirai)", "value": "0871f411e978f9ec96e574cfda6617a182abef052b566d60b8a51c1dc3886752", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747362133, "uuid": "48592b03-bb58-42ef-b641-704caea3a529", "comment": "Malware payload (Mirai)", "value": "b35befa021c7d08d0111e0c841d847fbcbedf609", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747362133, "uuid": "75c1f13c-e582-48e9-9d18-03bc0a9bb5ed", "comment": "Malware payload (Mirai)", "value": "3fc0c08a378c2b92a3afd166d1cb1c42deb03746b074a9143520281f3401dc794e287e5b778c8340268371181c45d72c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747362133, "uuid": "e4168f90-aacb-446d-a3d9-e57280202570", "value": "T196B39DAFF20756A1C85247F017CB8B8E3E2323C16F5794E33D1E2A7919751DB5A06B81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747362133, "uuid": "7b290a5f-b4c0-4150-989a-8cbc28f13d6b", "value": "1536:hjODTTl5D7islsONsP/E1G2/7y7lKcQGgxx46Mg9/LWl:hjOvTl5D7XOO4E1G2/7CNQG8Mg9q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747362133, "uuid": "63c967e7-0768-4fea-b53e-4e4547e42ae0", "value": 107836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747362133, "uuid": "f0b55b3b-30ae-47be-9a06-3851594b1192", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747362133, "uuid": "c5c04cda-b34e-4116-83e0-522abe5972d0", "value": "neon.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "453c244e-325e-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747404091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747404091, "uuid": "3529c788-676f-49ea-9647-e1466c4c59f7", "comment": "Malware payload", "value": "9ab6cefc62b16fabfcb8810e7c0d88ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747404091, "uuid": "fa669d53-ac42-478d-a709-5602aa02abb1", "comment": "Malware payload", "value": "0892117d6d9bafdda581b2178e9b74c555d5e86b549a03137f0f77d00461e180", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747404091, "uuid": "8efd131e-73cb-42dc-9b28-36531cdd0649", "comment": "Malware payload", "value": "c9e760af45d04313a136473867a66a4b6712b8c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747404091, "uuid": "8e8e636e-72f5-4841-939a-231b514456fc", "comment": "Malware payload", "value": "0f783559bcbf16493d9ee8d8e8e10a90c8a554486af532a8cb7734f93124ae62943119e26325d79e888fc0121de269ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747404091, "uuid": "9b673786-b18f-48ba-b310-a2320cf60c96", "value": "T18AA52342F6C648B1E17228326B7867216A7CBD305F758EDF67D03A1DE9605C0EB20B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747404091, "uuid": "7d4b4152-7495-43b1-a118-c5b9fbf2a3ae", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747404091, "uuid": "f30a1982-b951-4117-9933-ea10212923fd", "value": "49152:IBJrTpc8iYMljoCIrtufFEUPtPSfdjh/SXjlV:y9TFMlFIQDP4fdj4P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747404091, "uuid": "87f789bb-6b25-43a9-b1a6-3d5540deea0f", "value": 2230224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747404091, "uuid": "434b8494-0191-4ddb-abed-dae8efdd6547", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747404091, "uuid": "aa800e37-1a84-452a-96d4-216513429990", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20ad79d1-322f-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747383844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747383844, "uuid": "1671f1a3-7d5d-4b9f-bee6-ce6a751171db", "comment": "Malware payload", "value": "bbb43e0a25074fbca38c908ffdbcdc92", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747383844, "uuid": "dda14433-a8c0-4f6b-b3b6-feeecf22b650", "comment": "Malware payload", "value": "08a64007c9c4ea40fbad510fcb172bfb9fccfb56bfc5fec5e470069776c42553", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747383844, "uuid": "8044717e-4c20-4626-82cc-30941bccae93", "comment": "Malware payload", "value": "aae1ca0dde957246c5ca614e53fee3da70c1271e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747383844, "uuid": "efd65b81-7064-46b9-835b-66dd583b6b4a", "comment": "Malware payload", "value": "e4f956f90104b2d95c62c04bf3835d2b458a2e99123ed43b39f783c4ad6aec8095f985f6e0441d91491f9572402f8c83", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747383844, "uuid": "54c559cf-1ebd-48a6-a54d-c1959c423740", "value": "T17673D91A6E219FEDF758C33447B74A21929933C637E0D685E26CD2012F6034E646FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747383844, "uuid": "0529f345-9c7d-4b08-ab2f-525589de0a97", "value": "1536:HmzsIr/Pw5T2A9/xOtzOt15tIdRDfiswDv4eNVJp:H0sI85T9/kDfiswDvvJp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747383844, "uuid": "647d6f80-8198-4b19-9c70-2f5e3fd696b9", "value": 76604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747383844, "uuid": "a0958fe4-c661-48b4-b5ce-1126eefbe23b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747383844, "uuid": "dbc775b1-37ad-4a9d-8bd7-39ff3eb4e6e0", "value": "gmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43c045a9-3233-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747385620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747385620, "uuid": "d500f264-4cfd-4579-a47a-01699de12f36", "comment": "Malware payload (Mirai)", "value": "b8a12f35b2e25f1056034cd5328b823d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747385620, "uuid": "f3cae5aa-c021-49ab-b345-ee9790e0b396", "comment": "Malware payload (Mirai)", "value": "08e7accab27970348be10b4d69416e6411f50c2d34a03342ca4ea475e817d40e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747385620, "uuid": "dbc3e517-db12-44f0-b63a-72a8cd1cb231", "comment": "Malware payload (Mirai)", "value": "c5b55c75bca1334c870647f68a7a37ffe55925f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747385620, "uuid": "e86ca653-e266-47ce-a17e-b8f28bac331a", "comment": "Malware payload (Mirai)", "value": "38e9917923f2338860e8976afe5670613e543700e79f76bb4a6b20d9e19be543aabc5449adc49e4cf22a81d1fc11d0ca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747385620, "uuid": "27d1d99d-e9b7-4d2d-b722-3b6b0894d074", "value": "T116E2D083F57A8750F942C93E4C9FF60F9039876D25A59414DBA9371255BA7A03B1CFC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747385620, "uuid": "70654a8a-6b34-4b5e-a9a7-80bc8869b4aa", "value": "768:Gv4ntd/gUyLjqHc1RE+Q4HcMOv91rH1f1MgRiVNqkUnbcuyD7UHQRjJ:vntSRSc1+4HcNp1fKgmbUnouy8HyN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747385620, "uuid": "0244f397-193c-4669-97cc-e3262b064b78", "value": 34044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747385620, "uuid": "86aa4b28-0a1d-4534-8812-65d1efc2431f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747385620, "uuid": "152463ff-5e6d-434e-9e02-ab97c72034b8", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f759e32-325d-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747403813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403813, "uuid": "c494a574-06e5-419c-a9f3-9bf3202f4232", "comment": "Malware payload", "value": "6174f4b5af3adb3e2923338d01abb9ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403813, "uuid": "119b5dd1-4676-4f7a-b5d6-a7804a0f76f8", "comment": "Malware payload", "value": "08f1ef879d9a854a3d9bacaecc03a48377ab22a29a4a0db3a1d46f3957981344", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403813, "uuid": "8b26fc4a-604b-4c8a-bef9-f694e1c50559", "comment": "Malware payload", "value": "034f4f2a0aedce478f8c24d1f718c1dfea26a720", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403813, "uuid": "2e973a0d-2d31-40b6-b317-0d4c007fd986", "comment": "Malware payload", "value": "ab4d4ea0bafdc84c5325c341420afad70d89630dbe0ed28c194b42ec563731ecc87cbb2335cd36f34d3c8c210800d4d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403813, "uuid": "96954e2e-9440-4409-9fc6-9a793ae3fa02", "value": "T1E8A52342B6C648B1E17228326B7867216A7CBD305F758EDF67D03A1DE9605C0EB20B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403813, "uuid": "4dc27c12-93b5-4c34-81d5-62a20abd1633", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403813, "uuid": "f535608c-5a65-49fc-8b06-ea2629967dfb", "value": "49152:IBJSTpc8iYMljoCIrtufFEUPtPSfdjh/SXjlJ:y0TFMlFIQDP4fdj4L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747403813, "uuid": "9d37fe18-e98e-41ba-a309-6edb6410eb15", "value": 2230224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747403813, "uuid": "e5f0b9f7-3cd6-42b1-97d6-fd6641d4480d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403813, "uuid": "2da3a0ec-6e4b-4587-8f50-001a53408eba", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcbded07-3228-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747381153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381153, "uuid": "d77f483b-859a-429a-ab74-3a137ef4d3c4", "comment": "Malware payload (Mirai)", "value": "95789c1eb10666ce931fe1bba811f682", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381153, "uuid": "8cadc56d-5c3a-49bc-8385-8f46b8938931", "comment": "Malware payload (Mirai)", "value": "091f527a4f9df1ac5037b2e4c0dd69b7181e9f99077d52bbe05eafe221793ca4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381153, "uuid": "ba85d8d7-e756-4aa0-8876-49dd29ab1605", "comment": "Malware payload (Mirai)", "value": "023f0d0a067ca9e4bcdf1fb49cfd2a326ede29ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381153, "uuid": "11c8fa65-aaef-410d-a691-6a5e5cba7014", "comment": "Malware payload (Mirai)", "value": "430b5c255817b155623672bd76b3540dc89444cb1bf5c814cd650cd527b0ecc28691ee1720ba26ba1993fb74c2f275fa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381153, "uuid": "59f524bd-27e3-435b-9f98-d9601fbbe2fd", "value": "T182230232F5D819E1C5E4AC30E4FD9A4631A92FA4A24CF160673192D5E98398372FB4F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381153, "uuid": "7bd0c7a8-30e6-41e4-ad8e-b84eba9738e8", "value": "768:gqPb4YOTeTx9krjuxxu0BszWd2FFq2oKeWaE0WAq3UIaT2UemnahFIS0BWOPW9+1:CTeNCCxjBjd2FA2FevEJbhU8t085G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747381153, "uuid": "15516466-e5e2-4e40-afe5-acfb85c562aa", "value": 48540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747381153, "uuid": "aeda6d41-e15a-4b2d-b704-59a9b410b98c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381153, "uuid": "ba71b650-8015-4230-9bd4-c727e481c5fe", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf60963b-3228-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747381103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381103, "uuid": "4a469815-4227-4ae4-9e8c-6b276bac72df", "comment": "Malware payload (Mirai)", "value": "1cd71a87c0d1b98f93b63886a341003e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381103, "uuid": "0b398c02-295a-4d93-93a1-62d60b7c48d3", "comment": "Malware payload (Mirai)", "value": "09356e07b45e41ac79589e78239e38a3cf7c9c62969f5d3f065a15e03565f969", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381103, "uuid": "a4d3bb20-3786-456e-b7e6-d0430859b74c", "comment": "Malware payload (Mirai)", "value": "9c015cb6138401b8ee11cb1e5bfd5277c47ab9d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381103, "uuid": "59743bea-d03c-4465-a6fe-a64401e0ac24", "comment": "Malware payload (Mirai)", "value": "039139960c307cb02814196b6db7eee39b54e3e3bce08391f524c34f77aa1fb1b44fbce9bff24e5accfdcd0deceb38e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381103, "uuid": "f2267bcf-46d9-4da8-b6b2-082450d23390", "value": "T1EFC31B45FC505B23C6C612BBFB5E428D3B2A17E8D3EE720399255F60378685B0E3B946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381103, "uuid": "693f1535-d013-47d5-bb92-607a30fa6499", "value": "1536:p3Ka0rG5yC/cMChygtXOBdWFAcJX4VlgXTAjcFAaUGxrf851WhXVVlnKwywEReQ0:5KaprMh7ROXWFh4UXwcFAa5xovW5kKe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747381103, "uuid": "162c1335-7889-4c54-acb9-e431bb0e3f41", "value": 129824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747381103, "uuid": "afeed8d8-9661-4b13-9832-cfef06c8f67b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381103, "uuid": "c1f0324f-77e4-4516-9db5-3d1d6900c798", "value": "main_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b76de93d-326e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747411155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747411155, "uuid": "44bbdaa7-1035-4440-9069-aa0c318fd71e", "comment": "Malware payload (Mirai)", "value": "81e47a2a56dbe83cfb574cec738be193", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747411155, "uuid": "d8723453-6dc5-4d34-8b1e-0439b4d95d62", "comment": "Malware payload (Mirai)", "value": "098e8b333a0d025a3736faa9cc3062be7ea559a260c989352f991238192ee345", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747411155, "uuid": "cfdecc6f-45af-4396-a486-7ee89895cdf8", "comment": "Malware payload (Mirai)", "value": "0264dd4492dffab9c111cf5b9d0580dab636f3dc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747411155, "uuid": "6c8c303f-7c38-4a77-98b5-6d482778e26d", "comment": "Malware payload (Mirai)", "value": "f2f36a5f1b83d8b53ae372d22508836465a024adad6e0e5870322d2078eeb8cdbe70812901d80cd0c73c5b701a7b178f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747411155, "uuid": "b98b6e55-95db-4ebd-826e-5ce88e1af146", "value": "T1264164D438A116B06ABFF95271AC450430D364CF5CFEBF04A6DC78A9868CD14F9517D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747411155, "uuid": "2a5f3464-034d-4a2f-927c-e7244a19a33c", "value": "48:vpIdpnDpHOxpqcOpp/pgNpPfpDNpexpXa:vCRo0XW5DgM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747411155, "uuid": "471a5994-2a00-414f-8c2e-e435ce5b8d6b", "value": 1903, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747411155, "uuid": "1b54402f-5cbc-461a-ad83-c461bd20bfab", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747411155, "uuid": "4bde7c09-c889-4a2c-9859-0b5685cfe6d1", "value": "8UsA.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d766bd56-3228-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747381144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381144, "uuid": "d71d3a29-1e8c-4c7d-98a3-62fa1c5db236", "comment": "Malware payload (Mirai)", "value": "b0ba64857a48d3f06ce014598fbd2639", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381144, "uuid": "41c0bbab-67ec-4952-b1ff-3ae9d3707826", "comment": "Malware payload (Mirai)", "value": "09eb72382b61ddd4285d3de3a6104176e824c8b5a2607ee252174c3dcecb2185", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381144, "uuid": "cfd09421-f8cc-432f-90d1-0dda9c103007", "comment": "Malware payload (Mirai)", "value": "54c8dfe8bc4249261b2c04846aafdd8669c312a6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381144, "uuid": "96592185-3de9-4cf1-93ce-2db5e0ae1946", "comment": "Malware payload (Mirai)", "value": "514fb44dd4dc40271806bd6ee8134a23bf9a7a92b39f3ccd68772b9d1d7b13a555b38138e7cf952ce1f18d339e81cea8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381144, "uuid": "7db4c4eb-0fce-4de4-b012-862e630f5493", "value": "T1F5E2F111691A847AEB308471E0F681C277A51FBC76FEB1A644A7070DDCC294293E1ADF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381144, "uuid": "cccd09ca-95d9-45f3-af6d-5e586930bdc1", "value": "768:YEKkUgXAnURCr6HmDFStmYtrc9q3UELd8:gkEn7uHEemolLa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747381144, "uuid": "a8f2ec3f-01a4-4b14-9853-49c3e37c04eb", "value": 31872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747381144, "uuid": "c044aaa8-7aa8-4613-99e2-5a1bc8bc7f85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381144, "uuid": "b0b9404b-6db3-4532-920d-88336b52ccf2", "value": "sora.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb756df2-32ac-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747437898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747437898, "uuid": "e470346e-2596-48a6-821a-de2f72453b40", "comment": "Malware payload (Mirai)", "value": "421909d46f34c04043e86fe355d5b198", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747437898, "uuid": "b0dba281-c9e6-4d86-aa56-2f9b4b15e00c", "comment": "Malware payload (Mirai)", "value": "09ee033169fda9264ddaf0b7b60feedcf7e5a63911bd03aa850e7f3a91d0e233", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747437898, "uuid": "e2e527cb-1973-403c-96a0-58121040a352", "comment": "Malware payload (Mirai)", "value": "49b9d7aec1bdd2821791493f934f79890d4f5290", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747437898, "uuid": "0edfbbc2-13b1-4a54-b6f9-89127cce1f2d", "comment": "Malware payload (Mirai)", "value": "deafc4f4efa0b4382015094c45aa12acfa638a7d5984408fdd9adb9d4428be47f3a1392b1f28fc91603f34e429937476", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747437898, "uuid": "d43f87e5-cc38-442b-a669-64fe204e1e2e", "value": "T1CC434C96F801AD3CFC5BE69E40221A1DF931372024A30F2B9697FCE35D321B96D1AE41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747437898, "uuid": "c26f6711-b20a-4589-b262-8194ae168d1d", "value": "768:sPBaz0tMQaaZ261DmbgiqJNS5LhZFGG7kdbPLzty/+9uQ8yhh5Cm7VqntQPGyZlo:s/vi5Lh7GG7mbHA/+MQ8yhem5qqPGsun", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747437898, "uuid": "da4b40be-4fb8-407b-b6cb-7d474c541b42", "value": 59105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747437898, "uuid": "ee6cb31b-f30b-4967-b87a-3b3d2e5649ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747437898, "uuid": "7690dcba-47fd-45ad-b756-72311a62fa9d", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aef8dcb5-323b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1747389236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747389236, "uuid": "6fc1c210-ecde-452b-a01f-43e039628153", "comment": "Malware payload (Prometei)", "value": "f497b485ab1f4a0931e7ab7e724e87cd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747389236, "uuid": "4a5ebc18-adde-46b7-ad7c-f855d0d71da3", "comment": "Malware payload (Prometei)", "value": "0a11f9b26a5275b3ac60bf9bb2c3502bf38a99c2d0e5aa64fe0475f525ec0703", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747389236, "uuid": "10abfb8e-7993-4313-8738-0bb4916193d3", "comment": "Malware payload (Prometei)", "value": "412731f82166fa1060d738b3c18c5109e86b3b84", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747389236, "uuid": "26bb6b4c-46d4-49eb-9796-75bf76ac0460", "comment": "Malware payload (Prometei)", "value": "4c86e2eabba49f8d3b4a2b3ade53bb7224007c6ad209a15bff59cfce949d106e3a2c45273b51893ca7c861ecc4b6e179", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747389236, "uuid": "652c328b-72e1-4900-9099-b1cacea18036", "value": "T1949423F8C83D2E3098169B3CBB5A826CF0A15772D9562F6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747389236, "uuid": "2859b2e0-8c92-42c7-840e-099c309a7b93", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitg8:25WOSACZSV6eKRH5EPiamb4DsDwwcs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747389236, "uuid": "70f354f8-9de5-4dfd-96d3-da46e5ce45e7", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747389236, "uuid": "361544f5-7109-41a1-9906-e527f8fe3ea8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747389236, "uuid": "483ef86c-960d-4abd-a1f0-7f927193f4ce", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a02907ad-3258-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AsyncRAT)", "timestamp": 1747401667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747401667, "uuid": "17367868-5c21-4bff-b585-a596564211e5", "comment": "Malware payload (AsyncRAT)", "value": "c9c3813521971fabdd8a8651e245ac2b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747401667, "uuid": "4ec4f4d5-d3fe-4470-8020-dd672327f6db", "comment": "Malware payload (AsyncRAT)", "value": "0a4b6b527360cd6be2974abbe46942d29f7090310f94336647c98ae3696e9af3", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747401667, "uuid": "650ae37a-9a7f-4650-a807-cd2ae69e07c1", "comment": "Malware payload (AsyncRAT)", "value": "45e438bb401298e9a0044e280c85654363a7add5", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747401667, "uuid": "9df294d8-d92e-4c2c-b4f8-3d4530cfbcdc", "comment": "Malware payload (AsyncRAT)", "value": "233cc529719d1fec4575b0f9676e1a157701c2f72ddd048bc844d7afcd70522101c20c18bc91c4d8c7132125c9a8ac03", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747401667, "uuid": "81a7f07a-2c38-4c04-953b-3f26854bebc0", "value": "T16AF25D083BA4822AC9FF2BFA6973E6130371E5079A13EB4E58C4456A6F37B8049457D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747401667, "uuid": "f81edc89-fb96-495d-8627-f942bbec1c9d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747401667, "uuid": "72e6e847-ed2b-47ca-b9f0-28da7102f805", "value": "768:/mKQNgx0n6sr1R508SbvCyzC+5WDWVFq9Jq/OMh+ulR:/qFnXEZdeHDGFq9JgOMwG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747401667, "uuid": "5d39e7a5-566e-40af-a338-8b1ffaf73a28", "value": 36352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747401667, "uuid": "87d09318-2d22-4a66-9101-3ec20d01fe63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747401667, "uuid": "621af06b-11fc-4977-ae8c-199e2b4b97f7", "value": "1747401665877957c005788afb3bee09ee050b083874efc47d68873edca3576f56bd3a0acd229.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59998499-325e-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747404126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747404126, "uuid": "178dced1-8d36-4883-a0a7-4df7193bc528", "comment": "Malware payload", "value": "e6ffc165458389d667468d386f881870", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747404126, "uuid": "7c645cf6-337f-4631-a05e-afc963cda53e", "comment": "Malware payload", "value": "0a619e75f97cdbe0a7fe9fa564de6d33d5d0b8e4ac4f948ff8845c5a6e78a38a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747404126, "uuid": "cf33cf4b-a3e2-4379-b0dc-68de3c78a877", "comment": "Malware payload", "value": "f85c4467119ec680d16dcdd188b351363f747e62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747404126, "uuid": "40b14489-e257-4a14-b21a-bdbff130fde6", "comment": "Malware payload", "value": "ae8127364d5ec5fbae9d942d4bf065c7309caea709fdfa702815131ec7e0056b68505142a8e6983b7d53e3807719ee5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747404126, "uuid": "2881cb76-3360-4bbc-ae15-f79ca73a70fc", "value": "T1B2A52342F6C648B1E17228326B7867216A7CBD305F758EDF67D03A1DE9605C0EB20B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747404126, "uuid": "61a69ac8-49aa-46b5-be92-919fba6ee539", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747404126, "uuid": "5d7a737c-59f6-4a6a-b0d7-7a576b78a118", "value": "49152:IBJMTpc8iYMljoCIrtufFEUPtPSfdjh/SXjlm:yiTFMlFIQDP4fdj40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747404126, "uuid": "f6b4a226-9a1a-4987-ad16-22c902455832", "value": 2230224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747404126, "uuid": "87513d29-a5bd-4a6b-9066-9e92a31d4315", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747404126, "uuid": "3b767f34-ab94-4bd2-9b1c-e5dcad1185b1", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65245209-3224-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Hajime)", "timestamp": 1747379234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747379234, "uuid": "5a7fce0f-2a4b-4b58-a8e2-642608bd768d", "comment": "Malware payload (Hajime)", "value": "a75666d2dc9810084c5c653f9ca4ae72", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747379234, "uuid": "5503d819-a4e7-4216-b9ee-27e37e42e151", "comment": "Malware payload (Hajime)", "value": "0a863f927160d16f63a83acabb94b6c3ab5b3c91b08b74c3e32c7318f68c9d0b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747379234, "uuid": "2cb6945e-ed47-4c8d-a17c-7d48b5087f79", "comment": "Malware payload (Hajime)", "value": "d39b163160f6bc9b74a8d48b52b5f80d1f5f25cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747379234, "uuid": "9f5b4293-fd37-4a32-b554-ef6c31c87279", "comment": "Malware payload (Hajime)", "value": "4b510bcfc0b9291d6d504f275cf5f134cb5f57d3be1615dfd6ca26cb26972e084ebac9c074953b40c9f3ee4469502dcf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747379234, "uuid": "f986e106-68e1-4ddf-ba28-fc016c506929", "value": "T13E13028236A53F72D52188F4D7BCEFCA614A7D94AFA9181BBC113698707135C28C9C1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747379234, "uuid": "3c2496cf-a598-4c08-bdcb-5a0a166babe7", "value": "768:YTYIDfYG6ZmewZ59+Nw1qsREH20j7UNqVwi7M8ghFM04ZTzEsDmF:yYI0ARqw1qAEW67UIWi7M8gmfmF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747379234, "uuid": "fc1494ab-7375-4c3c-ba1a-8c88a2fc2986", "value": 45056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747379234, "uuid": "30e6c8eb-a0ff-4284-8590-4fcd62d88f7a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747379234, "uuid": "58033f7b-6e12-4c7a-b9a3-4addc27c5c6b", "value": ".i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ba9a3c6-3288-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747422060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747422060, "uuid": "b942d393-6f7e-42b3-9283-e404aaf4050d", "comment": "Malware payload", "value": "6de675a0703cec0a602ce402c77c77a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747422060, "uuid": "761954fb-bbe4-4947-b494-fbdfecf0738f", "comment": "Malware payload", "value": "0a8bcbae774e62d340c259762cd0ffb82ea267cd7e30829f8d8325e3dae197ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747422060, "uuid": "5c7310a2-f51e-4e24-8cf5-a8e02584a933", "comment": "Malware payload", "value": "8a2a7013fa3833698bd3582cf67a94649ba8a684", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747422060, "uuid": "7a91d88c-adf7-4978-b563-b3fe5c167506", "comment": "Malware payload", "value": "3a0d91db9ef512284db3e759605b094ff468eec3739775dba98064f0f1f486e98d8c33067bac4d8a0d2984d07d1f2ad8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747422060, "uuid": "d57b03b5-9573-4324-9c4e-94af1c27bd4a", "value": "T1EFA52342B6C648B1E17228326B7867216A7CBD305F758EDF67D03A1DE9605C0EB30B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747422060, "uuid": "edbe480e-a21f-4624-a541-07643548a290", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747422060, "uuid": "3a35d606-cf4e-4c10-a4f4-92ac69228173", "value": "49152:IBJvTpc8iYMljoCIrtufFEUPtPSfdjh/SXjlk:yxTFMlFIQDP4fdj4C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747422060, "uuid": "2053b948-876b-4e29-836e-842aad96cfd9", "value": 2230224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747422060, "uuid": "b34d2397-883a-48ba-8aa2-ae5af16aec64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747422060, "uuid": "2452ca29-2386-4c56-bdad-ff2d057ca37a", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5a4ae0a-3287-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1747421997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747421997, "uuid": "7a93db13-824a-400c-a146-da9aa6a75ba7", "comment": "Malware payload (Gafgyt)", "value": "802dbae7266774da5ef9da19143c791d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747421997, "uuid": "e4164014-f926-49f4-bf86-9564aaf3371b", "comment": "Malware payload (Gafgyt)", "value": "0ac2567262a3f260c0f819f23d2a935fa2c29c0e32656d4d8886baee6886b8c8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747421997, "uuid": "cfdd3a49-b72b-4696-bf5d-a72b500c79b9", "comment": "Malware payload (Gafgyt)", "value": "2da13006f84670b136743982fc9fb41311308d7b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747421997, "uuid": "6cd4c37b-7cb3-4ad1-b73a-d77f723e5bf0", "comment": "Malware payload (Gafgyt)", "value": "add787b384a3bffa6d7cf9fff9d51d777ed16af3eee0c5e611d626c076e9344279a89fb4cd2791adba12c8b8e63236ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747421997, "uuid": "6a83e4a0-cbeb-4e16-a79d-27daf71a2ea7", "value": "T178C32BD7D942C5B3D40209F2226B624A4622FF3B485B5AE6F71D3CB4AF318897225FD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747421997, "uuid": "e60793d4-1876-423d-8d76-3c728fd88340", "value": "3072:lWjNDoOaP0YsQpZ+7ZetJ8add9QzTsMzd42Jg4NKcXeGcgqGK:lWnQr+7ZetJ8addQlW2Jg4NKcXdcgqGK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747421997, "uuid": "459bd540-8b92-4155-a6d3-f0581717c59d", "value": 125342, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747421997, "uuid": "7918b66c-577d-455a-ae13-206d02b3db88", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747421997, "uuid": "bb736880-e632-4be9-8f58-1a9abf68cfc7", "value": "wget", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1dbcd28-3228-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747381134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381134, "uuid": "934debc2-0e4d-431c-a9c2-bc9079427c3e", "comment": "Malware payload (Mirai)", "value": "54b4773f3f7ab28f8e9c999b65a5cc7d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381134, "uuid": "08b2353c-80a4-4db2-b383-47c614987100", "comment": "Malware payload (Mirai)", "value": "0ad154f408b517c20b280b9bba83a2698f533e52649c1d61faaaedb5bcf6ca53", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381134, "uuid": "f522c9e9-49f4-4892-8e03-807c0ca55cb5", "comment": "Malware payload (Mirai)", "value": "4e53dbeda7737fa74b27ca4b8b04a3b07cb76074", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381134, "uuid": "25a62c10-ab9c-4c12-8021-97644bc6a8dd", "comment": "Malware payload (Mirai)", "value": "1e6b433bc610312ad59f7d7e3138b4c0516260d431e2d199b65bc81ce611ce13b4872a5a08206ffeebf7dee4545a283c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381134, "uuid": "c2cf2f8b-34e8-439e-928e-9ae03bd00a2e", "value": "T1DCF3086522284F7CEFCAE37E812228EBA0AA81859473D2D49FD77991EDB57407D3050E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381134, "uuid": "2c6e32c3-920d-45e2-bdef-9d7163706821", "value": "3072:1UyrqwPpWXPFX2HK+mfPvz6TNMfGP4mNk6HxH8b49+9aS:qyrcXPFXuKpvSIGP4ma6RHe49aaS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747381134, "uuid": "fb8512c0-bb4e-4e07-a7b0-2e89922cfcef", "value": 169516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747381134, "uuid": "7f359847-bbb9-4776-a181-efd28cd9ec7a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381134, "uuid": "80436f94-319f-4316-bd69-f3a0240fd622", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afd6c3e9-3223-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747378930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747378930, "uuid": "be735cbc-77fb-4779-91f6-de5686d699d1", "comment": "Malware payload", "value": "4122b5e6c9c29a0f1d4a2b4062f59b57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747378930, "uuid": "f7eb9cdf-e138-4edf-a119-39cee38001e0", "comment": "Malware payload", "value": "0b18bb51282b489ef34ec1b10053d3726e20252f4cd594eaf82d60214da9741d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747378930, "uuid": "2473a108-1bc4-49e1-a990-aae9d899d442", "comment": "Malware payload", "value": "1d42946cb1b76b72bddb894d77dd409895ee016a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747378930, "uuid": "6c57f1d2-ec51-4e52-bdc0-3d83a783281e", "comment": "Malware payload", "value": "b34455339804c260edcf1ab57b5e38c1ed6a23158cb7bfbbba56b0607871045ea6ee0629da9204be888be61feb73f466", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747378930, "uuid": "f6c59b69-4b01-4624-bbb5-1dd1498c1546", "value": "T116E32A07B2A811FDE1B7A37889A25A01F3BAB815477197CF0350897A1F67BD09E7E311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747378930, "uuid": "1687083a-88a9-4d2a-b0a6-d7663974c050", "value": "45e4653ae633e067079dd72666b0158b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747378930, "uuid": "b4e560bf-e1c3-4366-98de-cd808631e4ce", "value": "3072:+9rMW83f4Mai9dMzhj0Whrnd6eiO5Qsd35NpejAJx3+p5JmmKrju:mAWSf4M9lurnd35qAJxup5Jmnf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747378930, "uuid": "cdb4f51b-4276-4a31-8a4c-bb95975d5c83", "value": 147456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747378930, "uuid": "c66864d6-3537-4443-8033-c89e6c946c02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747378930, "uuid": "0bd247fd-c267-493c-85ee-dfb29fe86b49", "value": "SampleApp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c300add-322b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747382279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382279, "uuid": "02ca3449-772d-4cfe-bfbb-5f811cd2d665", "comment": "Malware payload (Mirai)", "value": "54ffdcde79e8cb213c3db3a9bb502f57", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382279, "uuid": "c782e2f0-6b04-4d47-bf59-6d7cbc1d0ec2", "comment": "Malware payload (Mirai)", "value": "0b55bc13c571ff3a7391506b7c207ec103eb392da7932569ef960c926681ba2d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382279, "uuid": "a72e60ba-36d3-4846-ac02-483d1337d09d", "comment": "Malware payload (Mirai)", "value": "302884086597e019a9c6e2d596a82ee15fa9b392", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382279, "uuid": "116ad50f-3d76-41b5-b192-a90cbf523834", "comment": "Malware payload (Mirai)", "value": "82b4011da0e6307dea7584b35a4f8f78e387822373213a19ffd6fc8f9333940ed0c3a62410da734d73f76a7314955476", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382279, "uuid": "37992c6b-6cab-488f-b5ab-32f7ebe91e19", "value": "T185B2D056F2818DB2C9BFAAF01D0ED5E473B80E1DB7E4CE93B8A11E02D50D2129546ED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382279, "uuid": "dab96c5e-5624-46fa-88fd-a2256200ebb7", "value": "384:1OEljbhfSfGrGLQ81sH2vK2Iyf6aODyqyejVYgoUWy395OIM4uVcqgw05VxJ7:U4Ker7NWC2IyfhqyeigntoX4uVcqgw0b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747382279, "uuid": "29f1fd4e-a73b-476b-a12e-af3c1a7d15ef", "value": 23728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747382279, "uuid": "69dfd0bd-b2ec-463b-921f-94d983abb0b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382279, "uuid": "bc8ea9ae-3362-453c-b1a9-ec7dd1149467", "value": "kwari.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df3f0a11-3296-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747428402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747428402, "uuid": "cc1bab89-30c8-4949-8243-1fca7c2f229c", "comment": "Malware payload", "value": "9e607b291f8d650924f92eebfc1501ac", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747428402, "uuid": "d938ad63-9d65-4ceb-804b-bcb382d3db56", "comment": "Malware payload", "value": "0b5a851500f11a49068f72c97a17d654dadaa053433809943b7c5b8d2732fd2b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747428402, "uuid": "374d195b-0df4-4bab-99a1-7751a7b3456e", "comment": "Malware payload", "value": "124cb5a417fca8632148102f3b5a13093a2b21c9", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747428402, "uuid": "ca0d620c-2aa9-4dc5-af35-6358afc25bd4", "comment": "Malware payload", "value": "a7a83679d3c21113fddf9c59a9e52e6f8cdb60783487a466405523554c0d02c7d72d5861fc4a93efd5f06ec361e8b412", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747428402, "uuid": "e278f4ad-dc17-4967-85f0-cb50de105494", "value": "T1ADE312A954E13B57F280577C6C4A015E8DD5D0AF2AAE03BF8F632CD5C8C226DD89CB85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747428402, "uuid": "90541e87-ad5f-424a-9bf6-f6f590daecf7", "value": "3072:DJFWKFiovmcsLhWi3bzs53mC/DwNLPgqNFbVFfXR3ejrI:D2KFiovfsVXwmC/DwNrRnbPPJej0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747428402, "uuid": "efd82803-27d5-4a07-80ea-b7a05e538b46", "value": 154617, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747428402, "uuid": "adc38e96-b794-4c04-b136-b3127b7b6ca4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747428402, "uuid": "11f390fb-102d-445c-8c0f-ff8a121eb010", "value": "TSF_Activation_TR.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6ff2bcc-324d-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747397034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747397034, "uuid": "dbae2a65-92bc-4ed1-bd2a-01ef75a8502b", "comment": "Malware payload", "value": "5ac2682b19375af4d551236b1b15cb0b", "object_relation": "md5", "Tag": [ { "name": "InvoiceXpress-zip", "colour": "#B98988", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747397034, "uuid": "2e4aafb7-897a-4eb0-a500-be5cea898fe7", "comment": "Malware payload", "value": "0b85185c00bb16f6c1f3296c8b601a90f95f16b69b9fcf44d75054d60d9e13a8", "object_relation": "sha256", "Tag": [ { "name": "InvoiceXpress-zip", "colour": "#B98988", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747397034, "uuid": "f66890b8-58f1-43f5-a49e-3f71c206745e", "comment": "Malware payload", "value": "27d0bc6472337bbb53bdf47cbf15040087e3a8e5", "object_relation": "sha1", "Tag": [ { "name": "InvoiceXpress-zip", "colour": "#B98988", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747397034, "uuid": "9a6af780-00f1-42fb-8da3-b0904d9c29bd", "comment": "Malware payload", "value": "9e9bae6eba71ba05b4beacd054d6c5ea6f45ae84de731c7e3e59fb2c670fd93e25338b36078e97bbb2d8b4fbd7bccfc5", "object_relation": "sha3-384", "Tag": [ { "name": "InvoiceXpress-zip", "colour": "#B98988", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747397034, "uuid": "82eede44-1169-4881-8ea2-1d5bdf275a37", "value": "T167183399ECB40D4AF833D23AEE7A979F839412C61B419D3BE104C75346D7BD2AA7240D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747397034, "uuid": "6bd00b4f-15d0-48e6-8381-5b2d5f0ee3a4", "value": "1572864:d+pSEQPBUWKoUHXNjgDtLcLX7Bu/WqxqMXYEXh3X8n00F7waRlbXq:d+gPO5HXmhQLX7BrqxoEXhY5VlG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747397034, "uuid": "77fcc802-cce8-4a6d-a625-84713bb49e9d", "value": 92183276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747397034, "uuid": "15e29013-6181-4e06-b02d-856a3d95078d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747397034, "uuid": "b6d27149-a0e1-4278-89f0-d5daa0897cef", "value": "0b85185c00bb16f6c1f3296c8b601a90f95f16b69b9fcf44d75054d60d9e13a8.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4fe1fb6-3270-11f0-8bd0-42010a9c0005", "comment": "Malware payload (njrat)", "timestamp": 1747412117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412117, "uuid": "185a4575-2e91-439d-b019-628ace28ecc6", "comment": "Malware payload (njrat)", "value": "35378b6f6d68ae938f48853b3fbf3b4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412117, "uuid": "c35bdba8-4e08-4e8f-b78a-e2c99dd94d0a", "comment": "Malware payload (njrat)", "value": "0b9c492b506d9ce227c13c35dd60ab2060c6dfeaf229877bf0a28bc34dbce09f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412117, "uuid": "727d795f-cab7-4a3f-9b94-1fbae5b08b8d", "comment": "Malware payload (njrat)", "value": "aefe3736f4b7c416061a5d7f50cf7efbfa8a56b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412117, "uuid": "21b0751f-82b2-4625-b0cf-3640be5d1bb0", "comment": "Malware payload (njrat)", "value": "bac9e68488aa25db6e4b4968bf224670248d4fd05a76787ef40c2a3f215ae4d155c7587346df6657d9ed89c23dd23850", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747412117, "uuid": "03a2226f-6900-418e-a070-dac09e9ca130", "value": "T1A44410FA5E842178CD88537FF4136326B1C2884FA2D56A21EF161EF52E3B1AC16472C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747412117, "uuid": "ddcf8733-df6c-4714-92a0-83d730085773", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747412117, "uuid": "24c76ced-aa6e-48d0-a49d-6edab968d6bc", "value": "3072:VWDdeF7/5p1V4ZdhbUdeW6a0Rzw6pEqA7:sdeIHxHM7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747412117, "uuid": "ab853c9e-f777-48b5-8023-8dce7e4e90d1", "value": 260608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747412117, "uuid": "00d603a3-e2c6-4c36-94a9-e6fb6b99f8bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747412117, "uuid": "f24d0dbf-3197-477f-a4e2-5461c1c4cdf8", "value": "35378B6F6D68AE938F48853B3FBF3B4E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff74b9ce-3287-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747422013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747422013, "uuid": "2350afdd-2c2b-49db-a90e-53605ff34acc", "comment": "Malware payload (Mirai)", "value": "9f950e555fa8397765ca68bc5406bcff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747422013, "uuid": "354dab3b-fa5d-45bf-81a2-66988dc0c21f", "comment": "Malware payload (Mirai)", "value": "0c22e537c40e38808160f6be035ea7be9abb51e79bb492527b04a079ed10e1f9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747422013, "uuid": "fa694339-f99a-4f9d-b4a6-02fc9bde0457", "comment": "Malware payload (Mirai)", "value": "18e8b988e92f5ea38e6463655ab6ef0a85ed15d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747422013, "uuid": "6843a6cc-e47b-454a-b942-95fa2a808cc2", "comment": "Malware payload (Mirai)", "value": "d80c059f36bd27e294b3629ece23ab679d079382b7e402bced0fa4ff7421737237e1ec1c3ae3d4bf61faaf0e8653941d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747422013, "uuid": "9695fed6-3821-4f66-8813-8e6957cead84", "value": "T1CE736CD5B8004EBDFD5BDABD81264A0DBA2163045FA30F2BA667FC932C73199AD06C45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747422013, "uuid": "a97b90bd-0df8-4baf-b107-ee3cefb65453", "value": "1536:6EpcV7VeIfcdJg04JUghlzZXq9g2HpjdT/QX/qJIsfwfqObS8Hk/L:pUdmg04nbNlcphOS94qyC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747422013, "uuid": "5183e71e-2141-4302-b7c1-d538cb8d7eeb", "value": 80288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747422013, "uuid": "a6d359c9-6170-45cb-8b2b-8418fbdfd54c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747422013, "uuid": "8ad37ab0-f677-451c-b834-9375fd533191", "value": "db0fa4b8db0333367e9bda3ab68b8042.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82c1b64a-3265-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747407201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747407201, "uuid": "1e3ad30a-9439-45fe-bd9f-38ba2af72568", "comment": "Malware payload", "value": "27565139f1d558e1405eab0549887aee", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747407201, "uuid": "cbee69a5-187b-4367-b1d4-274f9efaa8a6", "comment": "Malware payload", "value": "0d1323d50ff0496c7ee687d65050b02de85e80b81938d7e1df204ed7320ef7c2", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747407201, "uuid": "ab06988b-2f72-4fc6-ac40-2bdfac06e0e5", "comment": "Malware payload", "value": "b05ed2d0632dac7b134dd8f21cb70eea60753180", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747407201, "uuid": "1b43ef47-be8c-4775-b35b-1411ba88e886", "comment": "Malware payload", "value": "247ea1bf11047d0c475b632294d197da3118d58804c4350507195cfd7392207245d131b3217bc8fadbee6117236723ed", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747407201, "uuid": "24abaad1-064f-4d7f-96d0-5ce9c3e67b88", "value": "T1B961022C205D54964B71CBA5C21C049CF92F828F02147655B9BD85EF6B38BD29DFF485", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747407201, "uuid": "c46ce37b-7e27-46a2-821f-1accc15c8d0c", "value": "96:icoHmN7bogBBUlF93aEUChnKWT9/4VsnqVcj+:iTmJjrKfdFK4J4MqT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747407201, "uuid": "bcc0f547-7b1d-4bc2-84e1-58b8ae80a862", "value": 3275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747407201, "uuid": "cc19d04e-8e13-44b9-a2f4-7c7a37d6aab4", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747407201, "uuid": "1e4b9508-85e3-4feb-adbc-91784ce9bd35", "value": "cl.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecba63f9-3272-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747412962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412962, "uuid": "e5acb187-f74f-4a70-8e1c-6aa87b016baa", "comment": "Malware payload (Mirai)", "value": "536b9e09e1060db5bf30b1a22ec3a0f3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412962, "uuid": "05d64552-946c-4fab-8302-ae0e8b299472", "comment": "Malware payload (Mirai)", "value": "0d256e867dbfe7e246b94e275e2e5e5b07890fa1716048fc87276fc08499a6ee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412962, "uuid": "0be0ce96-735e-4c22-832c-016061becfd7", "comment": "Malware payload (Mirai)", "value": "69350e6f9824d8f38bd816a1b363de63a538d8b5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412962, "uuid": "5ede64e4-bd53-446c-9d0d-5b37f3f7d70d", "comment": "Malware payload (Mirai)", "value": "11955db1651a94ff882a7a76b9b73d64505fb9e1eb8b4d0ee290c19bc8351ca8519830c80df30b11c64c3d37be938a01", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747412962, "uuid": "36010e3e-ca31-40fb-a9c7-b1befc5334f6", "value": "T1B14308C17881A626C7D05777FA6F018E37199798E0EA33538C295FA07B8AC1F0D6774A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747412962, "uuid": "adff31b4-96a5-423d-b28c-c1bf922a2bb4", "value": "768:N1c82KhvRRTdj7tsq5sebD07B8drbonjxDdSYGSq/EanRP89UapvTLwCVy/rCxH1:Nb24Th7ttujxynRP4U8ShW+15RL+Sr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747412962, "uuid": "7e024b02-f8eb-40f4-87a0-52b6fcc07b0f", "value": 56584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747412962, "uuid": "fc79f9f8-dc09-4d0f-9aa2-9cace48f4590", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747412962, "uuid": "314ef1b4-c2c5-43b5-bafa-24a411561cf5", "value": "Josho.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "910a78a0-327a-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747416244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747416244, "uuid": "ba1367fc-4bca-4b3f-81ab-cd606d3f5353", "comment": "Malware payload", "value": "c1f89fc1cddd224158917d7af99771c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747416244, "uuid": "8f33575c-89a2-4797-b050-24efe916eb61", "comment": "Malware payload", "value": "0d41b5a943cd82073dc0dee023de6c7e6a6034e5c5af442371f817f81eab5346", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747416244, "uuid": "4d334911-63c6-45f2-87b1-b444a9ff9430", "comment": "Malware payload", "value": "dae6b2649ec696b78d8499bb517227cd3c6248b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747416244, "uuid": "782623e0-c89d-4251-92ac-3049d6b6f115", "comment": "Malware payload", "value": "dbf61549978a686beec04c42ba6809f290a8936543cb29b3e2795b04e6ef57091fe9c3690e74b69be7a6d4231c272c9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747416244, "uuid": "67327e08-5ea4-4eae-90e6-b89eeaf36349", "value": "T1CEA523032AC4C026E8761371D5F5C2F31E367C974DB842AB268A7E9B3DB52D25278367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747416244, "uuid": "76be7501-5860-4e6d-8c88-27ee78528c31", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747416244, "uuid": "ccf2bc7c-8e4b-4857-91d2-6dfd6d5b8e0f", "value": "49152:sg+FAl5LYVNJ1IVptnSGu9i+2Yr2Jn8XBD3XyfL6lj:n+FUSJ1gdSX32G2J4B74Gx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747416244, "uuid": "e8eac13d-a446-4099-a743-7e77b9375864", "value": 2160128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747416244, "uuid": "84a453bd-fbeb-49b6-a4aa-692f32efe32c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747416244, "uuid": "39b9644f-f5c8-4326-9624-d9e14d6a8a14", "value": "SMB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b88dbf29-3227-11f0-8bd0-42010a9c0005", "comment": "Malware payload (DarkVisionRAT)", "timestamp": 1747380662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747380662, "uuid": "fd098fe5-1c68-46b5-b4a7-deb7d6885543", "comment": "Malware payload (DarkVisionRAT)", "value": "7b07898d527a455ae4669c253d8722d5", "object_relation": "md5", "Tag": [ { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747380662, "uuid": "68f59cad-d7e4-4560-8516-1123102c63da", "comment": "Malware payload (DarkVisionRAT)", "value": "0d532157b751a2afe492ed04131e1c05d12d425ce65f5fd9fe7e5f92b2f526e2", "object_relation": "sha256", "Tag": [ { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747380662, "uuid": "85ea3fcb-b89e-40a6-a496-106d8835ea59", "comment": "Malware payload (DarkVisionRAT)", "value": "bfb44ddf270e135ac4d0404036a54ef703e99963", "object_relation": "sha1", "Tag": [ { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747380662, "uuid": "49c95d6f-0b8e-4e25-8253-034529f22658", "comment": "Malware payload (DarkVisionRAT)", "value": "35bbaeb5cbb8dcb1d15482e4c3aea37ba5d764cd96b1abaf3f33ed52dbe5f2ab23f444e661da474d6876b17ae8acc05d", "object_relation": "sha3-384", "Tag": [ { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747380662, "uuid": "8d73e67d-2f5d-410a-be14-7a2c242f7336", "value": "T113E53389BE11EFD2C37744BE89C0B197C7D8429A31CF95C82C19E9C9E896783A933754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747380662, "uuid": "345c30f0-23d1-49e8-9588-b5e5fd664826", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747380662, "uuid": "be8e3578-38b4-4486-b7f4-337e90d2e62a", "value": "98304:9XZiMY1k48QAj6Su+88wvddSD/qGANJJhj2o:1YJkx5j6SH8Dv6DJANJJhj2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747380662, "uuid": "e7804cec-a8c0-407d-901c-3deaea9c2f16", "value": 3218432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747380662, "uuid": "893f2639-8e28-4933-823e-64dd3be578e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747380662, "uuid": "1947c070-5b9f-47e7-8bf5-d986603610de", "value": "SecuriteInfo.com.Win64.MalwareX-gen.12376.26011", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62df2411-3264-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747406718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747406718, "uuid": "04af2a1c-5f82-467f-bb0e-a0089c943435", "comment": "Malware payload (Mirai)", "value": "041b5d00f7669905fc8fa09b82c4c91f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747406718, "uuid": "799c3283-9fc5-4297-8945-dfbc03efbad0", "comment": "Malware payload (Mirai)", "value": "0d7c0e8c0d646ba7ef4d55f5943bbceb55dbebfc62d91705c17b50188cb717f0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747406718, "uuid": "43f1b9e3-142f-4be8-a4ba-7bb72e871ba2", "comment": "Malware payload (Mirai)", "value": "b46c7452f6d48b1992d92d60ac8c56b1e01856f7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747406718, "uuid": "eb5d52e7-1be8-40ba-a75f-76d2162e0412", "comment": "Malware payload (Mirai)", "value": "4e2145953f78209dd5c1b807f61a4952bc47f59d678157fa6a265798ecd3a739a55cd8ddc8ccbe4cfd7ee8bee36e7dcc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747406718, "uuid": "5494876f-b76b-4ef1-8c2b-8f3f4584c68c", "value": "T1D6733A55F8819A23C6C1127BFB5E428E3B2613E8E3DA72079E256F2133C791B0D6BD45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747406718, "uuid": "517e1747-fbdf-4fb6-b11a-4af005b474ac", "value": "1536:kB1GB0wFqm3qzjQcE2FrglEio0OuLZvF:Q1A02dl2Fi/3F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747406718, "uuid": "f01467d5-8a77-4e17-a6c7-30a286c3965d", "value": 75108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747406718, "uuid": "c2dbe30d-2328-4239-b268-d78542d46be6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747406718, "uuid": "baecb240-1343-4e91-b455-122ca4aa996d", "value": "neon.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a95f813e-325d-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747403830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403830, "uuid": "ab4532de-0331-4dcb-8dca-4fa36fda52be", "comment": "Malware payload", "value": "b8d49ad4bebadd7867325f937e1605f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403830, "uuid": "fd1c2295-d1de-41ce-8029-48a910a468c7", "comment": "Malware payload", "value": "0d84f23ca25cc0ce57015f1c599d4de79863cc79f8dad7c79a1cdb4e225843b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403830, "uuid": "bff64136-7128-421f-9351-e03f33241b18", "comment": "Malware payload", "value": "723ec6fa64414a735d14c4ddeb13e5ee24999608", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403830, "uuid": "953d67a5-0dbb-476a-a744-8d1ddc0b9694", "comment": "Malware payload", "value": "3b50c629f713f997580cea3a8b9f0afeddb219eadec63e9b15ff760139330743b52e88dbd847fceaf805ef5fabad77ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403830, "uuid": "ad7d17fa-53bb-450a-9125-d16a75a0556e", "value": "T1DBA52342F6C648B1E17228326B7867216A7CBD305F758EDF67D03A1DE9605C0EB20B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403830, "uuid": "8c317b2b-b218-4d1c-80e5-a66ffe73a63e", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403830, "uuid": "b014789a-be78-4ef8-8d02-8487ef2e1faf", "value": "49152:IBJaTpc8iYMljoCIrtufFEUPtPSfdjh/SXjlT:yUTFMlFIQDP4fdj4N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747403830, "uuid": "48e0ff76-1353-46cd-9388-5abf77135e0b", "value": 2230224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747403830, "uuid": "bc6b011d-14fc-43e4-8852-bc9d622f51bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403830, "uuid": "6904a3bf-728a-448e-979a-b0b355ce0eab", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31ca16cf-3235-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747386449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386449, "uuid": "cf59f828-0cd1-4622-bd69-665454410ed3", "comment": "Malware payload", "value": "c9d3683dc3838bbdba2f6048d2b345c4", "object_relation": "md5", "Tag": [ { "name": "196-251-90-185", "colour": "#01F3BE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386449, "uuid": "4602d75a-6bad-404b-a701-6e87353a312b", "comment": "Malware payload", "value": "0e4250dcc00a2c42bc08f1c1e4aa7691cfc4099f1e7daa7f52f984bb41287a45", "object_relation": "sha256", "Tag": [ { "name": "196-251-90-185", "colour": "#01F3BE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386449, "uuid": "6fb76f73-f162-404e-be57-3c3df50dec89", "comment": "Malware payload", "value": "1e2e0041e03f91bc98c91490166ad4ba10356700", "object_relation": "sha1", "Tag": [ { "name": "196-251-90-185", "colour": "#01F3BE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386449, "uuid": "a5f33781-bc43-414b-9d20-cb0aa88cdd18", "comment": "Malware payload", "value": "ee01597066168ec05abf1ff41e5267290d1ce0175dd938fcf469cfa5731db4eb8400725d8a85212fed00b6e7a66f72cd", "object_relation": "sha3-384", "Tag": [ { "name": "196-251-90-185", "colour": "#01F3BE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386449, "uuid": "4d364faf-f702-48a2-b552-49b870428da1", "value": "T1E611B75157927844DDEE9D312F510182091F82D17172537E6DDC82A4A217EBA4AF830F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386449, "uuid": "a9dfbfbd-16b2-4fa6-9d52-5e6d9272127e", "value": "24:95O6b91/JwyFLSKSP6yF20YOwmZRIbf6/Atsh+lTceab9VYnY:9M6isAB20YOweUfLtnTaYY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747386449, "uuid": "ede63dbf-92f3-45dc-8d5c-86114c8564f9", "value": 930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747386449, "uuid": "240dd9b2-fd57-4453-8eb1-d877e735a3cc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386449, "uuid": "d871451b-e8c2-41ca-afc1-ca9fa915e23b", "value": "markus-dokumenten.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7476b1a-3228-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747381063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381063, "uuid": "71233c9a-a120-4294-83dd-265d7541d8f7", "comment": "Malware payload (Mirai)", "value": "291c198c754e69894784ed93c24d2c30", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381063, "uuid": "98a3cdb5-b59e-4bb4-bcfe-8e5749fb746b", "comment": "Malware payload (Mirai)", "value": "0e4bcb636f031c7d130f04b00ba1b5affe16fd45f4e6bcf685388d32c8508195", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381063, "uuid": "a59799ec-c06e-4ff0-a5a0-457b045a39d1", "comment": "Malware payload (Mirai)", "value": "cfe3f07fa5224fa68d303eca5a01315c9f1b8333", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381063, "uuid": "9bc564da-2e96-4c1d-8214-741d5472816a", "comment": "Malware payload (Mirai)", "value": "d112af8fcfade272d93daf1e944e82090aa688759b9bcccc3efbc8eac79da9c8ed9e1a924fefcad8d12e9204ef76db29", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381063, "uuid": "82a5a7c0-1ca8-4cf8-8053-2c7f29e51410", "value": "T1A14185C5B181723A6D97CD3F25F48A0873C1B071DED32B1465D43CAA89CEF897851E62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381063, "uuid": "1d8848dc-cd44-46b6-9115-9416a498e8a3", "value": "48:vtiRvfRb/6R1VaRbJRXARD3Rj9RuY1/2Rzxe:vt0vJzM/sbzXCDhjfDYzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747381063, "uuid": "8bb7121f-9e00-498f-b9f4-5a9077475854", "value": 2003, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747381063, "uuid": "3cb32373-3bf6-4569-a2de-fa0edfe007da", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381063, "uuid": "9901ece8-b4a3-413a-a440-ae5e60b544d2", "value": "jaws", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f50cef2d-3272-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1747412976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412976, "uuid": "23a74cab-cf19-49a3-a5b7-5295052ff631", "comment": "Malware payload (Gafgyt)", "value": "d8970137d2cbaec2654ede0e57b63074", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412976, "uuid": "be79386c-3331-46a1-a1eb-459d857e3821", "comment": "Malware payload (Gafgyt)", "value": "0ec0ab508b87805359492729e9818cec8a14aec3119e00b148d9b9291f92fd5e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412976, "uuid": "74c734cc-e4f4-4375-8889-ff771a81d7e2", "comment": "Malware payload (Gafgyt)", "value": "ed73771bba171c50a221f3545ad11e81060f88e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412976, "uuid": "813449a3-d274-421f-8bb4-8e245b8921c0", "comment": "Malware payload (Gafgyt)", "value": "ab5c311c19659325ce214ae3b5bcc1b4771052ef99a8d75da160095496f5d757bb22070509b50eb4868d8a23509365ca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747412976, "uuid": "350e854b-8471-4a8f-a20a-68f8d99097ba", "value": "T11E24D80FB6D088FEC0974B75269FA461EC32FC2A072961067356FE5D2F3DD9C994A290", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747412976, "uuid": "a66706b2-b958-43fe-9fdd-5aa6fdfb34b4", "value": "6144:6QN42uECgPF8IhI1sBmGeLn+SyLRy7tFs0sg:6QN42uqhmGeLn+SyLRy7tFs0sg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747412976, "uuid": "ebd76432-0c71-41ae-9245-11a199097ab5", "value": 225446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747412976, "uuid": "00f03df4-d75a-4707-aa30-541aef865b59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747412976, "uuid": "cdb5fd82-cabd-40e1-9c2f-a3164d48107a", "value": "jackmyx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e494b7e6-322f-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747384172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747384172, "uuid": "507a7bb7-4228-4fc4-bee4-c4cf262ca35b", "comment": "Malware payload", "value": "6dce41f8daeb7f2638c7302bdc98b7e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747384172, "uuid": "0faf04db-5ba8-433b-b045-9c753de17f78", "comment": "Malware payload", "value": "0ecabe011a9e44ffe4459c3c92230c4ab4a5b4b464d8748bdc065b911070758c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747384172, "uuid": "d313ac2c-002d-4cb8-8ff2-92d1ba291ca8", "comment": "Malware payload", "value": "891f6a1ee35db440a95f27c5815476200cd1ff87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747384172, "uuid": "9b2d83d2-753f-48c9-886e-1b6e305493e4", "comment": "Malware payload", "value": "93d19198f738065ac271b8da002804d82fc138617b7779e1f7132065a313921cc19041325b83d974884432210c52c5d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747384172, "uuid": "7e990662-aa96-4fea-b576-1da668088d7c", "value": "T148D2E19023FE9BE5F4FF13B5555B4870266CB8E5CBE9C35A0B0052E93800194DEB23B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747384172, "uuid": "d2370a02-6748-4523-aa63-b2f40fb40b16", "value": "4b2df774f65211b4962a056c4da67248", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747384172, "uuid": "e1a0327f-eb7b-47ff-8a7d-11318d440e2a", "value": "768:iIRWpszd/rGZ2aWmj0tpGkAp9zsg+ll+nXGQlpssMG:hWOe2aCtskcsX8XG4pmG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747384172, "uuid": "b896bb4e-855b-4940-8f99-fa00f6121bcd", "value": 29696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747384172, "uuid": "160ee6e5-505f-456a-8796-70280494228a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747384172, "uuid": "c253e450-4b52-48d3-8d65-80d389f64fa2", "value": "SecuriteInfo.com.Trojan.Siggen31.7638.23849.30041", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1978ed23-3288-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1747422057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747422057, "uuid": "24551166-1053-4632-b589-2bba0c1a1f4c", "comment": "Malware payload (LummaStealer)", "value": "e0f16d8cd1eec1c672fe72f736626714", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747422057, "uuid": "0c6d1d02-980a-49f0-8037-a03244981008", "comment": "Malware payload (LummaStealer)", "value": "0f378f4dbf137ca4abdf88f8d137684c4196935df8bc8e3cfabeb4bdc5c3ba75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747422057, "uuid": "eb49f6f2-8933-4cfc-baa6-333f4d21bf5a", "comment": "Malware payload (LummaStealer)", "value": "74d16ab7c6d2a7d66527e3e6a43c2df2b004aef1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747422057, "uuid": "0a91b018-3230-42b4-9995-9416ba586bd5", "comment": "Malware payload (LummaStealer)", "value": "2c5d08f0699c65ae84cffe4e8467be090943ff156f688bb04108b81571d0338b92271ef9cc9f8f1c98b18d58b9f305ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747422057, "uuid": "295d2149-b8ec-4e7e-8db0-179b38bdf185", "value": "T1B595330CBC35419AD9C4847046CB97275BF0B4F186AE93A9BF02552F91BED4A8DF4CE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747422057, "uuid": "e5cd5a7a-3fc0-4904-be17-5b9af48fe127", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747422057, "uuid": "01f99c6e-0802-4708-8e82-65d25b30448e", "value": "49152:Wa061a0om7bt3mB1L+wi/OKR8uNgMMnNkUbydbtu:flNom7btQxRimKZWxNPbo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747422057, "uuid": "0af74912-e204-4452-98a9-4ad15abacbad", "value": 1917440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747422057, "uuid": "3e517ddf-ced1-42e3-b5b8-4f7d8964fa2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747422057, "uuid": "33e6141e-16d8-47fc-945f-8cd47edc7e4d", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f218998e-3250-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747398368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747398368, "uuid": "1faaf29d-dc3a-4aa4-8b33-8d78cb2aa857", "comment": "Malware payload", "value": "a9b42b02b683df68a232a8c69c32f283", "object_relation": "md5", "Tag": [ { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747398368, "uuid": "b35d42a4-d17f-402c-b8e0-b8a387d0579f", "comment": "Malware payload", "value": "0f3b9ddf0bbc867528cc41a0a76af13ee320b326306d44c797247a4a8d274121", "object_relation": "sha256", "Tag": [ { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747398368, "uuid": "05e31a6f-81c6-4337-9d29-897a4ac7a18b", "comment": "Malware payload", "value": "d9c13dc204149cc184e80053ad273e67b40f6c71", "object_relation": "sha1", "Tag": [ { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747398368, "uuid": "26541b11-f605-499d-b028-b89194839ed8", "comment": "Malware payload", "value": "5b718d237fc2859a37160618426f9adaff6e5c4d7965ebe08df5bbb77c4f04dc577b3b8f11cbf00122c7c0b2e7f6191a", "object_relation": "sha3-384", "Tag": [ { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747398368, "uuid": "e630b47f-3155-47c5-997b-e9b9cace7ad9", "value": "T13AD2C08A3F3AE47EE10802FC76951907FE928D0F146B2D03DF0106750F99E694A2E79E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747398368, "uuid": "398c4235-3293-4d53-ac9b-93dcc036eb90", "value": "768:78gANTtyl764K5+AE9f49lesfR1LWo1RY4B/w9tF:IgwTs7o+AEYleIRxh1/B2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747398368, "uuid": "bdffeae2-c9b3-4ac0-b475-37fd00c6e340", "value": 28750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747398368, "uuid": "d62c2b05-c07f-4355-b917-ef7c56fc1e15", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747398368, "uuid": "59ca2b04-a8b8-4f17-8be1-7238edbbf756", "value": "SWELIUM-main.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b03a19dc-3230-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RedLineStealer)", "timestamp": 1747384514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747384514, "uuid": "ed3a8929-1a2a-4a82-8774-cfbc1788c8ab", "comment": "Malware payload (RedLineStealer)", "value": "a85ded286361bd125cdfceb0b6c93108", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747384514, "uuid": "69f61323-988d-42c0-ba37-9b439734ab8c", "comment": "Malware payload (RedLineStealer)", "value": "0f78a658b60f0879acccf0933d9ae8a5d2c188e9f16b8e6f7b01bd0cc9b5c4e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747384514, "uuid": "dc989e7e-74ab-40b5-944e-9f232b4bb898", "comment": "Malware payload (RedLineStealer)", "value": "dcbcead80fbd7aab46ca5669a89c6233cf480550", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747384514, "uuid": "8e112ade-1ace-428e-9d0b-3a0ba443dc86", "comment": "Malware payload (RedLineStealer)", "value": "80e971eaa54361f687939f55b43592c69b85f127e9ec38a31065a851cc28d18edcbc030588c42b010d3046aa194c3f99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747384514, "uuid": "08b4b0db-0cff-494b-b78b-2ef85180a6e6", "value": "T1A6A35D20679C9F19EAFD1B74B4B2012043F0E08A9091FB4B4DC1A4E71FA7B865957EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747384514, "uuid": "42443463-ec35-4f64-8489-103322f7f406", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747384514, "uuid": "d89e9fc7-9b73-4641-8bad-5fd4de1c6893", "value": "1536:9qsINqLGlbG6jejoigI343Ywzi0Zb78ivombfexv0ujXyyed2A3teulgS6pY:rAMOY3+zi0ZbYe1g0ujyzduY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747384514, "uuid": "81db0abc-6539-449f-a8bc-bb1426be2331", "value": 97792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747384514, "uuid": "0cd41e9a-ab56-40a1-91cd-0911cd502365", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747384514, "uuid": "228e61eb-fb18-4260-a134-a5e32cbb27dd", "value": "0f78a658b60f0879acccf0933d9ae8a5d2c188e9f16b8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44c22d1e-324a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1747395501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747395501, "uuid": "91fd8e6c-0831-4a76-af0a-386d4e3d34b6", "comment": "Malware payload (LummaStealer)", "value": "cc82b28bcdbe9e8ab2c361b61eebaadd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747395501, "uuid": "8b93777a-1fd2-42b5-87e9-3bf56cd5e34f", "comment": "Malware payload (LummaStealer)", "value": "0f83ef2e0e2e1efa07c16d3126ec8042358790d4799718f62a31aca3127b42be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747395501, "uuid": "282e11b8-52ad-40c2-9cfc-37d9f9ecf04c", "comment": "Malware payload (LummaStealer)", "value": "af8f7a4cc523831a04f75cd5f84025cf6c3413dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747395501, "uuid": "6dd457f5-48fd-4543-82e9-c4f84360852e", "comment": "Malware payload (LummaStealer)", "value": "0e71c02e59e400760dc9e705c1aeb2901f95f1273a97d6eaf2549785247a5fda21e8b642a33d866214efc63949c6de56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747395501, "uuid": "742cef79-a656-4f4a-832d-468481ff8cea", "value": "T19E853340FE218671DBE15DFFF9ED8D76AA702AA8118B275EE3103A184C930C617BD58C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747395501, "uuid": "1fc8ee5b-3fc4-42b3-a1d9-794ca3a6a315", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747395501, "uuid": "767f9a48-41e7-4557-bc09-2e0eb86e8ca8", "value": "49152:vA1PAkdZ3Xl5keRAal1Om13CRihK+y+sLXwi:vA1Ikf15k+AA1/3CEhdy+sLX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747395501, "uuid": "335f2057-2cac-4228-9f5b-085f01af4d44", "value": 1852928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747395501, "uuid": "724f1162-ca72-4f66-b08e-4ff75c46b6ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747395501, "uuid": "d2ee0706-c1e2-4d72-8080-6789985de98e", "value": "cc82b28bcdbe9e8ab2c361b61eebaadd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8737d04f-322b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747382298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382298, "uuid": "396f591d-ab40-4e71-b6fe-689cd5a02c0b", "comment": "Malware payload (Mirai)", "value": "30cabd8e6ea56b2bf321916276b1541a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382298, "uuid": "a31e335e-1eb4-49ba-9b7e-78a69fc20213", "comment": "Malware payload (Mirai)", "value": "0fe1531f6c4888f85510e2e1df26ff8bcad9277852c8bac78c9365ab38795f7c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382298, "uuid": "b04ef229-0904-41a9-8d18-190787333a77", "comment": "Malware payload (Mirai)", "value": "7abe08b6fc98e5ccdedf77262bc3fb524cb358d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382298, "uuid": "1e32afaf-a2cb-4935-a795-dbdccb44a2a1", "comment": "Malware payload (Mirai)", "value": "d5e765cb666e728c0554b459e9147328cda5c5429b8c9d354843a7d99dcd7a38c8b198f5b08e165bbcb3b208d36eee16", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382298, "uuid": "10ebd22e-c0b0-4a13-a680-bde20f440e0b", "value": "T1D4E2D0DB64E8268ECE7EAE3CD1983369EF61B06191918F2CD7707E4085D7D0A784E069", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382298, "uuid": "857e192f-6281-4774-ae55-36960a1953b8", "value": "768:/uKfgyTlXhSEWKTQVl3aucMzds/vOt3jls/OynNPTuneW+HAEG:WeX9RWWQT2MzWo36mKmigEG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747382298, "uuid": "7ec1a8df-b934-4ad5-962c-0eb67a2dcd9f", "value": 32652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747382298, "uuid": "f31b025f-c758-4288-90f6-a3dbf3c5fa0c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382298, "uuid": "d4ba041c-f1a9-40a9-a44b-e3cb8bdab088", "value": "rift.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cad83ff-3239-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747388320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747388320, "uuid": "b5ecc5c1-96fe-4192-b231-254f165b8d72", "comment": "Malware payload (Mirai)", "value": "654cdddf04ee6be3efc808ae761c4559", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747388320, "uuid": "d81a8043-f025-4aa9-9d09-f44310748c93", "comment": "Malware payload (Mirai)", "value": "1021d4629b5d66de532149303fc06281d118c87bc8a473a2ca98e3c87e07d6d3", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747388320, "uuid": "c29ad174-2ed3-4c8d-8d1b-590a85f1623f", "comment": "Malware payload (Mirai)", "value": "f6949bce88472075e00a0d9c26e877959cd714d3", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747388320, "uuid": "d142f31e-ee79-49a8-acec-ca896593fb8d", "comment": "Malware payload (Mirai)", "value": "a42dfd32f6c4dffe842f55189357c4c29b0f03d7667769a83f0c5f103339da6b5db7d8f74e4658bdec70674c7574aecd", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747388320, "uuid": "49ffa956-7ac7-42b9-a93c-5ba82d209693", "value": "T165E09BC502B0D93550495EE3B22455375BC5C9C99DC00E5875CA14B3D50DC14BD95F65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747388320, "uuid": "b801987b-a9c9-4ae1-943f-a39977b042bb", "value": "6:ebgfr3w5/KjUAFjbKTVpJjFIcMW8MIcMW8NsIV8aCTIcMGMIcMGNsIAaQu:3rWKIw+3JjecMl7cMleIea5cMG7cMGN9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747388320, "uuid": "13c4b129-5cbc-4c37-a73e-89950e01a195", "value": 375, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747388320, "uuid": "16ad3a46-3f3b-431c-be16-8c21d1023f04", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747388320, "uuid": "67f88350-4ee0-420b-84f0-a804fd1cfd80", "value": "f.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da52d0a5-326e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747411213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747411213, "uuid": "22a61bff-8161-4172-af55-28f928d7b797", "comment": "Malware payload (Mirai)", "value": "a33d3c6a4e42f320cad94a56d514f292", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747411213, "uuid": "5e2888ff-8e76-479d-a03a-ddbefde19b73", "comment": "Malware payload (Mirai)", "value": "10563a950196b13fae08f36f3ffde79200ed5692e88855f7e994dddebb97a681", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747411213, "uuid": "442ffb58-9772-46fc-ac7c-c00be0a68ba1", "comment": "Malware payload (Mirai)", "value": "1e9e25af87255048148b799eeeeaca13880bc2c0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747411213, "uuid": "ef7843e5-f372-494c-bc2f-561b563a430c", "comment": "Malware payload (Mirai)", "value": "ef9a32bc64174080c4344cdb37374fa8f809ea5cb2f792b6016faff8da390229250c0734223641bf972d3d76adf84533", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747411213, "uuid": "e426483f-cec9-4e7a-b038-91657224cd2f", "value": "T15583A30A6F610FFBF89FDC374AE92B05249D541A61997F79B930D818F24A21F19E3870", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747411213, "uuid": "e7c767de-7bae-41f8-82a1-5989f5c3e04f", "value": "1536:+3SU2qK0YBEio6jlhDwYfMcQPJeTEPzA5D3/JUC:aSfqujliCbD1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747411213, "uuid": "0f9d69fa-63ec-4301-bf12-2f218aba776d", "value": 88336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747411213, "uuid": "1e487bb8-03a9-4687-9fa0-7dd79830c0a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747411213, "uuid": "57dd0617-eb04-4c4a-938f-3d6fc1bb8062", "value": "z3hir.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c23bd5ff-3228-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747381108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381108, "uuid": "a3fe5806-dc45-41cf-866a-b6336aacad70", "comment": "Malware payload (Mirai)", "value": "cd830391c3979ecbc331a7344975ad85", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381108, "uuid": "9d47a1ba-7dbf-4202-9d35-114a26f2f977", "comment": "Malware payload (Mirai)", "value": "108849578eab7c1a6723116ada303f73be28f91790e25d8e21122776e00060f8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381108, "uuid": "1d428c5e-717d-4906-9741-a9ce8c6540d3", "comment": "Malware payload (Mirai)", "value": "15ac7d729f13a273827aebaa70171b42101b784d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381108, "uuid": "91da7465-0a6a-4f74-9947-52a391c2b5fd", "comment": "Malware payload (Mirai)", "value": "9384f1dc5e9a6d7e2e6aefc97087760b4b7730c3e067e46649e50accc1f06e51a6723ab3a7df870a20137b33033f1eb9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381108, "uuid": "09da20b3-c273-47ca-bd9a-1999e21336da", "value": "T18BD022C201C80C7C1CA29103B2AA87743448E28128F0EFEE86E47AF4000FE607080303", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381108, "uuid": "3355e2bb-04c8-4edf-9002-7e99c63df7bd", "value": "3:TKH/JOnQzanFCKl2f0FWjjVkI7a5ZcjjVkI769fRW74zOdIn:IOnFflE0Fin7aLQn70RW743n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747381108, "uuid": "6c7c9db3-d29c-47c8-884f-bf9bb7ee72f5", "value": 207, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747381108, "uuid": "9aa9f0ea-04cb-47d6-ade7-3c739c83dfc3", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381108, "uuid": "d21ee320-449b-4e33-bc62-130c011950b7", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8df55be1-3239-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747388322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747388322, "uuid": "274733f8-c9ee-4b5c-a0a0-10e626fccd9d", "comment": "Malware payload (Mirai)", "value": "0f56ca782007f072e2763c0ff9d900ca", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747388322, "uuid": "75a8549a-598a-41c6-aa5b-afdd01994346", "comment": "Malware payload (Mirai)", "value": "10fd20f45a44d5c427e55b9128d3dc889e5d25b0a56260a8cecc4b75fc7423b7", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747388322, "uuid": "61721617-38de-409e-b2c4-1823320c7827", "comment": "Malware payload (Mirai)", "value": "c415e80141ae9d9a12ba108a48f1272614bc6094", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747388322, "uuid": "1fdbe00e-5e4e-4964-b146-0a63f997ac19", "comment": "Malware payload (Mirai)", "value": "8b9530861f05776090542cf347b64f42051a6eb392367b8d7790c9873d513a4f00e898a2ed9d93a4b3b822a4fc55a7cf", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747388322, "uuid": "627aa100-91bd-4c8d-a707-5d34ea2d9c81", "value": "T143F0D8CA64A4E95149508FC3F27A5920B982DBC945A00F0DB892387BAC2C92433E9F17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747388322, "uuid": "c02a19be-5dc4-4e83-b2a3-88c2943e784d", "value": "12:QvJXOpue8f+AiJKgCWKDbnPZzJ+jecMibscMcdBcM4cM6hFscM3f0LK2a:QvZi4wDIbZ4ecMibscMcdBcM4cM6hucg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747388322, "uuid": "8dff034a-42eb-48f8-a9f6-eccdd6e6cf88", "value": 618, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747388322, "uuid": "0a5d6e9c-9332-40ff-8bdc-a7cbffb04722", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747388322, "uuid": "1c9444e0-0083-4301-9224-6bae7f481fde", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e91a56ea-323a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (ValleyRAT)", "timestamp": 1747388904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747388904, "uuid": "d4a98861-bc31-49ae-91f8-f104d11f8a7f", "comment": "Malware payload (ValleyRAT)", "value": "ac0daf1c567e4a56b073d3a9f8135a19", "object_relation": "md5", "Tag": [ { "name": "dsh-fvsrchps-cn", "colour": "#DE3429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747388904, "uuid": "d46cb295-8431-4cd4-937a-b11b28d3a414", "comment": "Malware payload (ValleyRAT)", "value": "11144a412422285489c539cfdfc76e4c92e1f9620b488f3161b15b284b533e1c", "object_relation": "sha256", "Tag": [ { "name": "dsh-fvsrchps-cn", "colour": "#DE3429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747388904, "uuid": "d2bdc785-877a-4e2f-b3c4-b117789aa805", "comment": "Malware payload (ValleyRAT)", "value": "0a262b483d93d44af4837b313479c585d24f3af4", "object_relation": "sha1", "Tag": [ { "name": "dsh-fvsrchps-cn", "colour": "#DE3429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747388904, "uuid": "5b4355c3-f001-483c-b865-94e0a9ba7658", "comment": "Malware payload (ValleyRAT)", "value": "c2f97cd1d801ac256dcb5a9fff46814c74a04ce871a9ca4da0cf0edc4a14f4cbb07227a8d1d31327cfe232a4f86705f3", "object_relation": "sha3-384", "Tag": [ { "name": "dsh-fvsrchps-cn", "colour": "#DE3429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747388904, "uuid": "318debc1-f00a-4015-b594-0623780e08c4", "value": "T13406494736A840AAE1A7D179C6438F8FDBF278510B3187DF0065869E1F777A14E3A326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747388904, "uuid": "683eedc2-8e0b-4728-a5aa-5d20202d6f72", "value": "1ba138a42b4f44c4a5878503553f7c2b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747388904, "uuid": "638e1915-4a9d-42c9-8d34-edb0cbdf7d48", "value": "49152:IlEiuHDYDxcSWXqcOQzcrumZAeQN5IsN+iqWBJkGziyZs8vbXz3ACppV6HQh:KujYDxc4Q4rumKfzPppVz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747388904, "uuid": "25dc4e3e-eb33-4eda-ac65-f3f6f9e0b69d", "value": 3890176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747388904, "uuid": "ffaf6af9-c55c-44b8-b3fa-a13671f90cfb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747388904, "uuid": "7d5ed0f6-ca9b-41d8-8cd5-f5e1eb5650d3", "value": "11144a412422285489c539cfdfc76e4c92e1f9620b488f3161b15b284b533e1c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "302eb77f-3232-11f0-8bd0-42010a9c0005", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1747385158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747385158, "uuid": "baf10813-5672-4ea6-b280-391c88c7b0bb", "comment": "Malware payload (SnakeKeylogger)", "value": "7a38d9a10ff810f0af23d5ffea5596cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747385158, "uuid": "f7268e21-2a13-48f3-bfb4-a7eb6e825a2e", "comment": "Malware payload (SnakeKeylogger)", "value": "11a6f8044b9078f2d4617c4523f6540948a71b26b38890ca099f5a74ddd217a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747385158, "uuid": "0ab07382-af22-47c0-915f-14508b1ad394", "comment": "Malware payload (SnakeKeylogger)", "value": "107f203d83db44d09908622bafa68fbe20b9ad1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747385158, "uuid": "1af4d023-395c-42b6-8c48-e83b449d606d", "comment": "Malware payload (SnakeKeylogger)", "value": "e4f38ba6e7bdc2409ce709c9cf0a65f35520154a532b9e8a8c6fa46247d0c6a6eb8a95c7d00c889cc885e41f27fcb677", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747385158, "uuid": "0c3917ae-e427-4f2b-bf55-e1d998b935c6", "value": "T14ED4F11415A9DD03D4920FB00972E3B90B786EDDD921CB139FEA3EEB397E7542858392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747385158, "uuid": "277a8beb-9487-4fc5-85f8-c3d3be99e85c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747385158, "uuid": "650c01c3-7f88-4fcd-8dca-63e4de4521fe", "value": "12288:4bv79F7Dv+bWSgFX0Ny8wP6d3X0M/uXNiDOjl/TP:xZEk083Xpmdiix", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747385158, "uuid": "63183d8b-5cf7-4bcf-aa4b-bb9ac8a0e3b9", "value": 600576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747385158, "uuid": "bc7f1088-dbcc-4b26-ba5c-b012b4740f5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747385158, "uuid": "ce963886-646e-426f-aacf-1911f08f78e2", "value": "Price Request for Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d68ca7b-325d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Amadey)", "timestamp": 1747403783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403783, "uuid": "a01e7ddd-3bb5-470c-8bd7-c4d8ef778758", "comment": "Malware payload (Amadey)", "value": "621e96ab28e9a9144067a6cd9448fa4a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403783, "uuid": "3a2107ee-6f08-403d-ad07-90d7c0a3a784", "comment": "Malware payload (Amadey)", "value": "11d5b091a869bf7da852526ca1d450d80ae6cfe0c2fac54575af6c724f8300bd", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403783, "uuid": "e20de482-2a4a-4e37-85ff-593e0c8858fe", "comment": "Malware payload (Amadey)", "value": "b52a14cb4b745e4de82ef0cbb983f71a7c8adbbd", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403783, "uuid": "7e363f9d-5ed6-4cc3-9fed-e0aa214f99d8", "comment": "Malware payload (Amadey)", "value": "1c1746a1b8b2cb0b7fdc9f635dfc4c56c3ad3482a58d34e6f8211798346ca050b7ebfd385a67a22e9198f02d22d36eab", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403783, "uuid": "ce0c5465-5175-40ab-86f5-32bb5483bc67", "value": "T16E159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13A81DB9BD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403783, "uuid": "b604110b-d6e5-48da-9622-4ed8e069490d", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403783, "uuid": "3542780f-252e-480a-ae39-b8769f199a1d", "value": "24576:yqDEvCTbMWu7rQYlBQcBiT6rprG8aMgb:yTvC/MTQYxsWR7aMg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747403783, "uuid": "ff61d5e5-a0e9-4bcd-94a8-9107ead622a2", "value": 961024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747403783, "uuid": "7d9254e0-881a-4f53-80dc-d25aacd30394", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403783, "uuid": "580feb95-ed2e-411b-a7c5-3369013e5063", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13fcd98b-3267-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1747407874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747407874, "uuid": "b463b0e3-784b-4452-adef-531bef96c401", "comment": "Malware payload (Prometei)", "value": "37bc199caa23066a23a451e25ec07417", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747407874, "uuid": "ca11a660-80bb-4b60-ac05-8eeebbb16433", "comment": "Malware payload (Prometei)", "value": "1220e738dfb18f1280870b785114c9cd1363fa9d18c08d75c4db2cf25b02b1dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747407874, "uuid": "67325acd-2d32-44f1-b733-eda0b6269303", "comment": "Malware payload (Prometei)", "value": "af72211bd462c8695987919e95c6351e92915bf1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747407874, "uuid": "42885933-c59f-46ee-bd5b-da7bc71bd9e1", "comment": "Malware payload (Prometei)", "value": "3c3a8baeaeac999b38bc4a732a522d1e3f51d35f30819d1187dfb68d41b667de2b3b9d0783e94dd69ec48483b8d9e67e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747407874, "uuid": "91149d9b-b576-4cfe-beef-bb60b78f544c", "value": "T11A9423F8C87D2E3098169F3CBB1A826CF0A15772D9562F6AB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747407874, "uuid": "15313453-6b36-4117-b55e-9bd8b04d8649", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgz:25WOSACZSV6eKRH5EPiamb4DsDwwcD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747407874, "uuid": "7898d48f-e3d8-4cc6-945f-f7f0cdf50900", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747407874, "uuid": "93dc9ce1-7789-4e3b-913b-5cc70b271d75", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747407874, "uuid": "f3c72d44-cd6a-4bea-9325-9da0b77a4354", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eaad138-324f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747397611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747397611, "uuid": "6bb547da-d488-4bd5-bcd2-0e7eca7a6d76", "comment": "Malware payload (Mirai)", "value": "a3322e1aa0f907e91091c7daaf04c239", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747397611, "uuid": "3c080a0e-af53-442b-b15e-fbdbd92af69b", "comment": "Malware payload (Mirai)", "value": "1225c2ed8afdb69733b59a23f77b6aa6ccd62c5f817c9da8a9c169c3aa157322", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747397611, "uuid": "e96cea6d-9682-4eb5-ada8-f293f530a8ae", "comment": "Malware payload (Mirai)", "value": "71a02e3621ea5bab007bbe600e3f77ad4ac1abdf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747397611, "uuid": "e093f8df-6013-44ae-9324-2a4ef03e5de9", "comment": "Malware payload (Mirai)", "value": "7ea6b8ef2abbad25444a6be47f7e24ad314659012fead46f99a0ffbb4edbe0b9261009acd91109d1dfaac5a80f8cf56c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747397611, "uuid": "5473c49e-961d-41cf-9801-cc8a9380116b", "value": "T1EE530238D3D8D9C0CB29ED3536F52035A6A95ECA5AA1CA73B6DDBB22D10F83752002D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747397611, "uuid": "97739752-1b7a-4aba-aad0-5ac591778bbd", "value": "1536:5P0yR5eMQKOH1UhnmAdiDN26oUSWS2geKvM4u+qgw097S:58yR5e7KOHulcDN2Efb4u+qgwES", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747397611, "uuid": "18b274a8-22ca-4be3-9070-0eeda1f6a436", "value": 64156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747397611, "uuid": "66534ace-c465-4e12-81eb-18886e4a1418", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747397611, "uuid": "7c77f51c-70e8-442a-857f-9ea6fda277df", "value": "Tsun.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81c70428-324c-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747396462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747396462, "uuid": "6657b85f-13dc-428d-8c10-39d118802152", "comment": "Malware payload", "value": "579906428298f61ea6e1d45503c8ffd2", "object_relation": "md5", "Tag": [ { "name": "1po56mdxc-localto-net", "colour": "#E5C76C", "exportable": true, "hide_tag": false }, { "name": "AgidCert", "colour": "#56D604", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747396462, "uuid": "37161b69-6ae7-4b09-af74-0546d44af5da", "comment": "Malware payload", "value": "128471b87f570a368e0ccc359c6f8b04f00f57a06b3300f225a1e0b5dfb36cc6", "object_relation": "sha256", "Tag": [ { "name": "1po56mdxc-localto-net", "colour": "#E5C76C", "exportable": true, "hide_tag": false }, { "name": "AgidCert", "colour": "#56D604", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747396462, "uuid": "3b812852-7fbc-44ca-9258-1e9740b35428", "comment": "Malware payload", "value": "116a23c711de7492898f72a3c9cf040975cd4d10", "object_relation": "sha1", "Tag": [ { "name": "1po56mdxc-localto-net", "colour": "#E5C76C", "exportable": true, "hide_tag": false }, { "name": "AgidCert", "colour": "#56D604", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747396462, "uuid": "168b503a-c17f-4711-811e-20c3e6cc08b6", "comment": "Malware payload", "value": "46f437b9acc500791577d2fa50014f04177ef6c247bc8bfaa00a7a27e2e770d96980918d213010da853cc94238808d35", "object_relation": "sha3-384", "Tag": [ { "name": "1po56mdxc-localto-net", "colour": "#E5C76C", "exportable": true, "hide_tag": false }, { "name": "AgidCert", "colour": "#56D604", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747396462, "uuid": "226485b9-2442-4cd1-8b85-d1e8586d319c", "value": "T129825878468D6C3B4C93A632075A62CDF6135CEA11E7FD21F0B31C9A0355E30E96E9B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747396462, "uuid": "ae88e95e-e94b-43f2-b498-5bac6c240750", "value": "384:B8uR1iYSzYCYMYSYd/YwuzKc7xaYq8ssBSsTYtj65uTWP6aY7YjAFMzNY7V7bSYM:Bz1iYSzYCYMYSYd/YwuzKc7xaYq8ssBJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747396462, "uuid": "14964580-74a7-4c1f-bc96-0d5c19a8896d", "value": 19005, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747396462, "uuid": "6c8eb899-8dcc-4e51-8b74-deffa2d166ef", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747396462, "uuid": "d0f4fbd8-f3ea-41c2-ab3b-0f596840d6f7", "value": "FA-45-04-2025 (3).vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a901c469-328a-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747423157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747423157, "uuid": "09249cef-15d7-439d-aeb0-e5f98bc117a2", "comment": "Malware payload", "value": "a20039173917fad021dcd3e043411e5d", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747423157, "uuid": "fa8a5469-f669-4dda-b60f-a8079c5faf63", "comment": "Malware payload", "value": "12b177cacaeb0ae87dd92b4c547b4d7eaaaaac7f2e31e8e1200c4c31c6abc656", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747423157, "uuid": "77d7fba7-bbe9-4269-848a-098b223e7748", "comment": "Malware payload", "value": "d646a07aa9837cdc2a2a0b857fd16e8c871e1538", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747423157, "uuid": "8dea34c4-0b27-4169-8f17-351597da59e1", "comment": "Malware payload", "value": "68157a12bfbce638945a9f3db46becd001016984df1d907188f1f5a43088bc7b626e884b91ed431fa4ac41d2d8b8c011", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747423157, "uuid": "f05695b8-8e9e-4948-baf4-1665a1919ed1", "value": "T181F423AE8F71A555CDC951A12C32130E602A05B30C9BF89E2F3ECB6FD487746707A6B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747423157, "uuid": "f1971c31-30fa-4471-9987-abce6bd2af89", "value": "12288:9pck+bmvqhur5jCgxHOFHLxEF/6FNqq9nqjpI+UGOe4wfeYVNsaZ8D5PXtw6UmG:9pckamv4m5UFHbFKu+UGf4QeYVNsBD5E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747423157, "uuid": "a188d050-81c8-47e7-a6ce-0be95f5a6e50", "value": 736196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747423157, "uuid": "d1538bf5-dc0e-4fd2-9c48-9f39497871cc", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747423157, "uuid": "e7a6870f-f14b-4737-bad6-0ffee0245929", "value": "Po_8676787667856.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2119e63-328a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AsyncRAT)", "timestamp": 1747423172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747423172, "uuid": "242c6b71-51c4-422d-a3cf-c74b686bfe32", "comment": "Malware payload (AsyncRAT)", "value": "63622f5f6751fd78c264e636b7ffbb81", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747423172, "uuid": "b4d65ea6-2f71-4b97-8c34-ebf146aca8d1", "comment": "Malware payload (AsyncRAT)", "value": "12d996752a3c128d52c2373e3bf9cc63135ab3a724773c90cdcea6361ce13856", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747423172, "uuid": "8ade549c-3599-40de-8ad7-b2332c07ec02", "comment": "Malware payload (AsyncRAT)", "value": "4ea132caef32412640ca3fe396fe78fcfd0ea02b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747423172, "uuid": "450f98d0-c8a1-4a8a-b3ee-5fcab0624437", "comment": "Malware payload (AsyncRAT)", "value": "f92be6020c255795e89d6d35c5691cd7743d42f739ffed53621932365fb3076ad267dde955f2d38accf68177bc7051f0", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747423172, "uuid": "adf80133-97fd-4824-b270-a6e2cc51b4fc", "value": "T125B3F93EC4225CCC87BBB5C09B6D7186905C2BA3A8744E7CF8C519A6CFB746D96E6C00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747423172, "uuid": "098540d1-ebce-46f7-af89-a0d07d5cfc31", "value": "1536:9C/S8bZ+Kj4hZgEBvc8e49mF/2sGAZuqJ8hrkbmEKFfM9xb2rXkF5yA1tXE:9sbZ+PhlBvc8z8eBRqfX2rXkvLE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747423172, "uuid": "f4956069-7e20-42a1-9021-383e268dd755", "value": 114709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747423172, "uuid": "7302dc64-1d57-42dc-a3ff-db868240b170", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747423172, "uuid": "8a55f137-d497-4b73-920e-e74d7e0d765f", "value": "NEW ORDER.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cccc2605-3228-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747381126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381126, "uuid": "e8a51f2f-22a3-475b-95f4-4df3034c3076", "comment": "Malware payload (Mirai)", "value": "b2233a9ef8aa780eac1c3977f6d1abd3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381126, "uuid": "a71e3e0b-77bb-4fe7-884f-adc11621ee7f", "comment": "Malware payload (Mirai)", "value": "12e4deed56991c1431d7194911658dcecf4eda8cfb5356161616bfa11a3d3c98", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381126, "uuid": "23aa728c-c799-4498-a049-77a5ab9b2217", "comment": "Malware payload (Mirai)", "value": "3b49ea4c27bdcd4c3073fd37494dfb837612ca15", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381126, "uuid": "04809463-6ccb-4482-8502-a582d4753e6a", "comment": "Malware payload (Mirai)", "value": "885b7cac89b3edc77b03819666a538dddc1ec4d314f5f49f3971ffbf191d597e246e0cac61a305565d4d35959693f691", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381126, "uuid": "cd5a28e5-ad32-4c81-bdcd-e3102af488f7", "value": "T16F4429111B544F36CAC3037DA2E618CB27A682DD87F3E2408F5B6AB03EA57467D3952D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381126, "uuid": "281de7b0-7859-4db5-95ea-5bc88c310522", "value": "6144:UIFc0jFkOOzj4aozVjyRyDEHpzvXPd0RPsdjISM/9w+x:LFc0jFkDj4aozVjyRyIJ7PdOkm7/qG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747381126, "uuid": "0af12d64-dc54-4698-9a2c-15c18ea31bf8", "value": 256605, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747381126, "uuid": "d0a3e9a8-0a97-44f1-8174-52df3ef8ca2e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381126, "uuid": "ec758350-25d8-42aa-ae82-11e503b6bf2a", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c05c6023-3228-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747381105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381105, "uuid": "20666dd3-8282-4e59-ab05-3caf55ccaffe", "comment": "Malware payload (Mirai)", "value": "2c34b4c79017111da5253d9fcf9e3b5d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381105, "uuid": "b7b683b8-8ebe-4974-aa0c-e8671eadfbcd", "comment": "Malware payload (Mirai)", "value": "133ba0b43205de6898d203b24aed61a842684545db7d2c68814e76a318fb3700", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381105, "uuid": "17f7de58-b079-4c11-9b20-6c67a112f7f0", "comment": "Malware payload (Mirai)", "value": "e06eedffcf03752f4e6408e49c3898104996fadf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381105, "uuid": "4d8de39e-9055-4174-8633-83c310f85356", "comment": "Malware payload (Mirai)", "value": "33c14694c1e985c7206fca8ee61f379f5877da5197ca3a9e276c5320bcd5bd0fd582fc57e44bb8777da3fa80299b4379", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381105, "uuid": "9f432e0f-6ca4-45ae-8eef-5f51f0c71112", "value": "T11793D706BF610FF7DC9BDC3705A92B05289C665A31A97B35BA30D818F64B21F19E3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381105, "uuid": "44902896-6ec9-409b-b406-ab01b840b861", "value": "1536:NF2GXYZ8a8fnwEvLNPENIdhs9WZx0ZCufqZhK:NFjXYyCEx0shK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747381105, "uuid": "6955562e-f3d7-4015-bd1c-622ecd13cdf0", "value": 89408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747381105, "uuid": "dc07004c-66c2-4ce2-94de-f6471e38564f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381105, "uuid": "96c9fb61-d716-42b8-91b0-e8e9e2e9c18d", "value": "sora.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a7514f3-3235-11f0-8bd0-42010a9c0005", "comment": "Malware payload (ValleyRAT)", "timestamp": 1747386544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386544, "uuid": "c02e59e4-8d14-4802-b5c3-37dbcf33003a", "comment": "Malware payload (ValleyRAT)", "value": "8030e60ebed7df5d76e3cfd3223435c6", "object_relation": "md5", "Tag": [ { "name": "dsh-fvsrchps-cn", "colour": "#DE3429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386544, "uuid": "9734d5b9-b98d-4f79-86a7-1e221302c6b0", "comment": "Malware payload (ValleyRAT)", "value": "139466a8596fe3e2f172b28e5a7437a400fba6c5b6d85d83359101ed68e95a5f", "object_relation": "sha256", "Tag": [ { "name": "dsh-fvsrchps-cn", "colour": "#DE3429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386544, "uuid": "e8dc6127-1894-4384-a51f-009627342c3f", "comment": "Malware payload (ValleyRAT)", "value": "0920b2a959387b700d0dd2878bbfb80d84e3cc74", "object_relation": "sha1", "Tag": [ { "name": "dsh-fvsrchps-cn", "colour": "#DE3429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386544, "uuid": "dc05b74f-af33-4816-b8c9-01786361a2b6", "comment": "Malware payload (ValleyRAT)", "value": "20670e5a21a3586c38fb0ea8a8cfc19d650a5a12352021740fc999e4891156c972f421052a8eda919f1f6bc56739d715", "object_relation": "sha3-384", "Tag": [ { "name": "dsh-fvsrchps-cn", "colour": "#DE3429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386544, "uuid": "2f50c24d-f341-4786-b9f4-d8eeaa1b3a2a", "value": "T15E26D05633E892D9D2ABD2B8C5165E0AD7F5F8510B31C7CF00A5479E0F332A18DEA726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386544, "uuid": "5175c0bc-1e40-43f3-8b16-2186dbdc6fdc", "value": "0eb1f2853390332c465754ccf6bb5db3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386544, "uuid": "d6134028-f2ea-4a34-9101-7c1052f9c1e4", "value": "98304:5rt5ZCJ/Mn85U9VgAKPyKwIw7FYfsJvy92k:5rtmF5U9GRPm9mU9k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747386544, "uuid": "cb220184-ee10-4aed-8c03-f7553002efe1", "value": 4497752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747386544, "uuid": "93693bf2-8244-4e2a-8150-d436db9d5284", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386544, "uuid": "c31ad861-68cd-4eca-b214-6f5a0104458c", "value": "139466a8596fe3e2f172b28e5a7437a400fba6c5b6d85d83359101ed68e95a5f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1642920e-324f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747397570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747397570, "uuid": "64274fbb-a5db-45f5-919b-be2b3460fd31", "comment": "Malware payload (Mirai)", "value": "0cdf6edf6390ae7288e59eb65b97651e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747397570, "uuid": "ff783d00-f26b-49e4-a863-bae5bb5199c7", "comment": "Malware payload (Mirai)", "value": "13cab87cd2580d34f0c60b31897281fc5870f1a979b8ee71683374dfe0c250e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747397570, "uuid": "5a75e23e-ce1e-4f94-9fd2-82af0a202ed1", "comment": "Malware payload (Mirai)", "value": "d5ff6b8c4ddf3cb9c78ebaa6c80f252f92638f0e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747397570, "uuid": "e43e1916-0b0e-42f7-b915-c4b3c29dabc2", "comment": "Malware payload (Mirai)", "value": "540bc89eb5a8e6467c62a4531fc429997fff3ae6f88335d16988a35a9ff39f0623d131611111e2f1534a706d747fd032", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747397570, "uuid": "09151e8e-1e02-4a00-bd18-d0f5abc230ca", "value": "T1AD63023A5E1C64F5C57194F20B78B3E42FC8A13E39914C56D98AF381EE81A88214BF94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747397570, "uuid": "ad5bc85f-b8ad-424f-adb3-eff4956514b4", "value": "1536:w0cSXAlyH8C0FW4ly2UqzOc+oklqdGtprjg0iXjnKoOVJus:wiXAAcCkQl/led2Hwr0VQs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747397570, "uuid": "301b3051-32ca-42f3-b4e7-5b603bbc1a5a", "value": 70552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747397570, "uuid": "78c3e71f-418d-435f-9945-b34d31f041be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747397570, "uuid": "d17d9028-7649-4574-be7f-736fdf04357e", "value": "Tsun.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebd14243-3277-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1747415108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747415108, "uuid": "9ebb5911-974b-4500-a93d-237e886cb5a8", "comment": "Malware payload (Prometei)", "value": "fe9165feea2d6a0ba1e8e66e1371ddab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747415108, "uuid": "473549f0-9e36-4b89-bc92-71db96b8baf2", "comment": "Malware payload (Prometei)", "value": "144670d045b4ffe1d4ab8791eb9ab82a9d0eacd1f7d7ede590858d7d3e31aea5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747415108, "uuid": "fbdd9c47-9d0d-4be5-bcd8-0e1ae94a26a9", "comment": "Malware payload (Prometei)", "value": "93f2eb8b96b369019d5bd57e982957009b75e09a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747415108, "uuid": "19494ff2-2316-406b-bdd9-e9fc8a5c51f5", "comment": "Malware payload (Prometei)", "value": "a0898eb0210356eae443c02659db11463d070f077f801c3531c104b7e1a772c70a1c8a881ac98976503e4387b0261e20", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747415108, "uuid": "fb026d23-bbbb-4957-b374-971d900a7ace", "value": "T1079423F8C87D2E3098169F3CBB1A826CF0A15772D9562F6AB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747415108, "uuid": "108bfddf-91e6-49ca-9219-783c1e62d80e", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitg4:25WOSACZSV6eKRH5EPiamb4DsDwwco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747415108, "uuid": "007bd2af-31a4-48e1-908f-d785cc409c50", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747415108, "uuid": "e4235667-b382-469d-a24f-48ff10304f57", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747415108, "uuid": "aff575f4-c468-4f90-a19f-c89879f1a4c2", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "826dacd1-326a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747409348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747409348, "uuid": "082cdaaa-7a84-4696-80db-a9313a4b6691", "comment": "Malware payload (Mirai)", "value": "a6490c89ee3577ca55fe9b26a4580739", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747409348, "uuid": "d31c1624-6692-4381-b459-7d35c5c772d1", "comment": "Malware payload (Mirai)", "value": "146712bf4b2645fbd75272ce9ebc1acae61a9d3891022694fcf473f9b54ef296", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747409348, "uuid": "fd37c309-6446-416f-8f8e-b896b125f628", "comment": "Malware payload (Mirai)", "value": "9394c65c6cd237f23968645aa9f3360ec7958815", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747409348, "uuid": "5d39c4ea-d30e-4f6f-b52e-9515a2a16e39", "comment": "Malware payload (Mirai)", "value": "bb4d2fe91b528b6ea620b53ffdd123191821dece0c04917230061d3dfc1e18f3657dfee12847b68b96a1d4cec1598c3b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747409348, "uuid": "51539c2f-a4eb-4c87-b9fb-2c47673dcdc1", "value": "T13863E746BD828E16C4D512BAF92E018E331317B8E2DFB2239D146F2477CB92F0E67556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747409348, "uuid": "d36528d5-7a3b-4d5d-99f0-0dd3c88465ba", "value": "1536:TZnhd6NV2suwhAIFGWHiuwIU9rQI/BVW/5JPjITiSXoYshv:d6X2/hl/TXoYsh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747409348, "uuid": "c2d5b109-7e65-45e0-ab3d-621daafa9b3d", "value": 70788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747409348, "uuid": "95141728-50c2-4de3-b12b-5ebe23d5814a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747409348, "uuid": "58c6f8b3-f75f-428f-9492-716476770b3f", "value": "kwari.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d66f9829-3228-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747381142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381142, "uuid": "40b21fb2-8b88-4688-9254-dc2696ed5b40", "comment": "Malware payload (Mirai)", "value": "4fab12c74067b9ddba88dc71994cddc1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381142, "uuid": "0ca55c45-ca75-4105-947d-e99854f48eda", "comment": "Malware payload (Mirai)", "value": "146b588976af58692202a7c6f715a52dda4390a04f750f4d07f75b4438659d0e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381142, "uuid": "a805262e-080e-4c52-aeef-c5a9962c9347", "comment": "Malware payload (Mirai)", "value": "2278ebd8676598a1be260584cae55c8a50c531f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381142, "uuid": "e77e27fb-7844-4ea4-95d7-51d28c57aa35", "comment": "Malware payload (Mirai)", "value": "ffb8e1c82c693d138ee84e6f9ea80a744498bb7a984b4c40b57ecdb83202e1ca2d0db45d4ea2548c25b6671adeed0b8e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381142, "uuid": "f14c2f4b-a692-4970-8c46-1993fdeb45af", "value": "T1B4B2E0161D8D072FD205B077F1ED9E69857CABB4DF3E4890778E898AA18367E8129C50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381142, "uuid": "5a2b9375-38cd-4eaf-9074-acf7787d70f2", "value": "384:MYV3MlsbHlq0vtzf1aQ/CjHaI6qyQs2ZfrN9IzDL2TAJkF1q2Mx67fTEV3xzMj0o:LOlr0vtj1aQ/01nFs2ZhRTAgq2MxCTEe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747381142, "uuid": "a83aa306-04eb-4008-a833-af0304f0fc72", "value": 24080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747381142, "uuid": "c9111ada-e2aa-4bbe-aaab-00c026514375", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381142, "uuid": "8892f1b6-d7cc-4a9e-9c90-be25162c136e", "value": "kwari.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bd96f8a-322a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747381688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381688, "uuid": "e951f953-74ce-4efd-940a-50db722281c9", "comment": "Malware payload (Mirai)", "value": "a033ede7e275d32b1f01e783397fd083", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381688, "uuid": "ea28e7ed-e15f-44ad-8d22-190caa1a967e", "comment": "Malware payload (Mirai)", "value": "147125b7314161e8eeaacc8887ec43c85f38936bd96c534276ac90c97594fd56", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381688, "uuid": "820b7f1b-4d03-482a-9a46-3e5bdf105852", "comment": "Malware payload (Mirai)", "value": "0429e07d2183c31a27ecee143130e91128286d67", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381688, "uuid": "b9cb705e-ac1f-4fe3-9ff2-d288c65c0392", "comment": "Malware payload (Mirai)", "value": "693ee6302ecbdd71d11670c4f6b7cb9203d8f60a83a6198f7dc45e0f8b0eb948616febb3f3645a8932937b40504940b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381688, "uuid": "6fca5b87-e7ac-4a4e-9a3b-a6bdfee3687c", "value": "T174A3C61AAF610FBBDC6FCD3B06B9070535CC551722A83B3A3974D928B54B54B4AE3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381688, "uuid": "1caaa7e9-3e75-401c-9d78-34746b2864d3", "value": "1536:fVSMASH5lYCwbdig02xYEVqx/O47uhLkZtbPK5RdA5BtWyQy:fQMASH5154q5O5IbsO93", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747381688, "uuid": "073e15b9-ffaa-43b9-ad9d-2510a0919824", "value": 98412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747381688, "uuid": "4efae2d6-a0b1-4626-bef6-89a68c130051", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381688, "uuid": "f92872d8-b9ee-469c-88b9-878a4d450c06", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61f8f93e-325b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (MassLogger)", "timestamp": 1747402851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747402851, "uuid": "f2fe59d4-1eab-4695-a742-d51a90102bde", "comment": "Malware payload (MassLogger)", "value": "5099450c936339f9a47494b958de719e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747402851, "uuid": "a99273e2-d3dc-45b8-8d1f-86675dbdb365", "comment": "Malware payload (MassLogger)", "value": "147df6d9002c2a3d567f521595f16251f12b7e8d2adecab583a349aa95818736", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747402851, "uuid": "f3cee101-1998-42a0-9bf1-1e68196ba26a", "comment": "Malware payload (MassLogger)", "value": "ccefaeeabc30dc8ce0a7c8e566eda28ef4bfc92c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747402851, "uuid": "f3c27f76-6f22-49da-bdea-6f53a2cbfc3c", "comment": "Malware payload (MassLogger)", "value": "5efb1ccc96559061d0433c28f8a3bc8a4ea8381f6a5e5e284f7764cca2fc668f9d074433e8d573dc386f4cba315ca32a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747402851, "uuid": "ed592e21-e381-4206-b16f-bee6e3563ebe", "value": "T151358C12639D826FC3B27173FA156701AE7F7C2506A1B45BEF94293CEB331214E1A663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747402851, "uuid": "7706f64c-999a-45a0-879c-cd6a985abf35", "value": "3d95adbf13bbe79dc24dccb401c12091", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747402851, "uuid": "5699cee2-93b8-4356-a44c-612b2aaaa2b1", "value": "12288:rtb20Qc3lT7af41ePBRYuQLKpqeUhbTv5OFgNuPPpHSga2qgStJoM4u4kPxl6A:rtb20pkaCqT5TBWgNQ7a2qZtJHNxl6A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747402851, "uuid": "9fdbb267-9f31-4cc7-9e0c-c24b6c921d7c", "value": 1086464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747402851, "uuid": "fce725fe-0b1d-4e1d-8d16-4f7963ba00a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747402851, "uuid": "8d378d0f-48a0-4860-8783-25258c458484", "value": "dekont_html.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb9309bd-3223-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747378950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747378950, "uuid": "687615fd-3b42-4fce-86eb-e2aa3b120704", "comment": "Malware payload (Mirai)", "value": "1bd199b5ebee6a0a7ec95b38e975f542", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747378950, "uuid": "fa68757a-08a0-4030-9f39-225531ec6c5a", "comment": "Malware payload (Mirai)", "value": "14a786d36fe9d06f1b80d1db183c4e025e053e13aab671fb588bbf06b3c50363", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747378950, "uuid": "1ace92ba-c5ec-42ae-b6e5-e2cd7252ec3e", "comment": "Malware payload (Mirai)", "value": "000bd82ac8315dcc4a2c88418a7e5ce060003541", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747378950, "uuid": "32afb188-b1af-4d2c-8ffd-c9477975dc05", "comment": "Malware payload (Mirai)", "value": "5c54f9f176fc438b07b97d7a41351a3d0fb7a9ce124d2bc99c4802887a49b7df973a084632ef05fa64d504f1f2ca4421", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747378950, "uuid": "63643caf-5f53-4df9-82a3-3ca22247c1fe", "value": "T158E2F25B3891DE26D0AE023540AD790519A4B64CC6988CF633CA2939FD4FE7C3927E52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747378950, "uuid": "bbded0fb-6523-4353-af62-f2eae36d351e", "value": "768:egCvQ/HJw+9djZsHAmy8DJbztHnhEnCg1xmiO1N7TaaApWWd/SynbcuyD7UHQRjC:KvGOe8HARsztHxwm7XXaXpW+nouy8HyG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747378950, "uuid": "a60f8c39-caac-4e0c-8c2e-fe0f46df96cc", "value": 33168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747378950, "uuid": "a9a91f23-bc0e-4be9-a7ed-580f73b8837f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747378950, "uuid": "185c5cc3-1c65-4ad9-bf7b-fa081fa5ea4c", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e093f49-328c-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747423782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747423782, "uuid": "c44ffe6e-34be-4465-b083-ab918a509afb", "comment": "Malware payload", "value": "749311f0d56d4cb2d3ad91ce5f9a610b", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747423782, "uuid": "f9e56db1-d753-4406-a05c-0a908f156a9d", "comment": "Malware payload", "value": "14f7f2a27376e84b36fd98c109a7d45321385443b7f1f737be7976584aa07a69", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747423782, "uuid": "3ce97898-331d-43bf-9dda-da9386ab1cab", "comment": "Malware payload", "value": "3e4018c9956e673ae04cdebee195b273fe9c45ee", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747423782, "uuid": "83ec61d3-1347-46ee-a836-a5d8145f975c", "comment": "Malware payload", "value": "8f3fa592ef9fc62f0045ff71ce79666b43381d7b92819406e677823948a2aaeaa1a2a767262601f67b4f572f910958f3", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747423782, "uuid": "e2b22b94-4b95-4857-a769-92db6e52e362", "value": "T1A383C32EE74F0915DF55977B434A4A4A0AFCB339F28100A179AC973437ADC3E4A6297C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747423782, "uuid": "122851c5-60f6-421d-adac-d0dd9fbd6485", "value": "1536:CegZotjhBOzLPbDCLqpqxdAawxvRaQReYuEb6IHg7ysHkQGu5VPj4vZdrZ:CegZotjhBOzbbDFq3+sQReYuG6IHg7yp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747423782, "uuid": "eefa2081-e703-48e5-94b6-ca17cfe7a41a", "value": 85594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747423782, "uuid": "792905c5-f5a6-410f-bdf3-0da72cddf6c2", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747423782, "uuid": "d6194f3d-87ff-43bc-b293-69354d6825d4", "value": "eugoodwaytocreatebestthingswithgreatgoodwaytocreatebest________goodwaytocreatebestthingswithgreatgoodw______goodwaytocreatebestthingswithgreatgoodwaytocrea.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a46f2c77-3271-11f0-8bd0-42010a9c0005", "comment": "Malware payload (SSHdKit)", "timestamp": 1747412411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412411, "uuid": "760c2e05-50bd-4c11-aa0a-57a61d575736", "comment": "Malware payload (SSHdKit)", "value": "a1d72c33aa6a974dbfc3a227dc4ddc58", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412411, "uuid": "3f8a3899-97ad-4196-bc2a-27b153d76800", "comment": "Malware payload (SSHdKit)", "value": "1512535df9bdc500af3d3ff4ceedfe2c2cdcf2b8523aaf0d8e33b0f03bd213a6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412411, "uuid": "2b5441bc-57a6-4ea7-ba75-aef408ddb4bd", "comment": "Malware payload (SSHdKit)", "value": "e154f6782067b37d62cb8219897c2b95ed1f40a4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412411, "uuid": "435dd80d-5dd0-48fd-bfdd-74bb20064475", "comment": "Malware payload (SSHdKit)", "value": "ebe95eccbfd59a30cc78eef6022de9f4091ef295656f608c1aeedab59214cc3639e978784cf2df9ab6cc3e4ac8695fef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747412411, "uuid": "8d7b5a56-2ce2-44fc-972a-6914d56519c0", "value": "T142356D56F9808EA2C5D8177BF75D835833134B78D7DEB102CD08672877AB95A0E3B982", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747412411, "uuid": "98eb5d59-8b48-43e6-90ae-cb4a098fb7a7", "value": "12288:E8dASOYRNCAJump208iJftl7zmnSrlcaUxQ5TVFQGl9eLtRajZa6ZTxIVD7bLH:E8dbbsO38+TfgRinIVvH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747412411, "uuid": "249c6e39-c8f7-4016-83b6-58ee6215caf3", "value": 1110304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747412411, "uuid": "f15ea052-e39d-4df9-874d-ff2f95031c81", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747412411, "uuid": "82bf36df-bc38-402a-8be8-286446cbe942", "value": "sshd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f685126-326a-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747409397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747409397, "uuid": "17cb6d6c-7d83-4be4-8484-b720f303e7b1", "comment": "Malware payload", "value": "b17911ddeab973db51362721c940d882", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747409397, "uuid": "bde2cfbc-a62b-4d57-9786-769d3c8df895", "comment": "Malware payload", "value": "1515cf2bace264bdecb76a9ac6691084ca5cd77d4d6715b96dc140dddb5c4f8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747409397, "uuid": "794ef419-3b3c-4a29-864d-e20ae1f1911a", "comment": "Malware payload", "value": "9cc11b7f5eaef6dcbb09bf8af99c24a8292f6a0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747409397, "uuid": "81df89dc-a259-40cd-bb07-efb775038239", "comment": "Malware payload", "value": "bd373d3ff5ac30900df67035bdcb1ea1d39924dfa739ebba0c8657561e7f9a77d88c162507f8b6425bfaf12ae7e2ce58", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747409397, "uuid": "a16cded3-5011-4ba9-802b-2cd5ec287672", "value": "T17373E0DF9A9FBAC6F6D33ABC6981449E7174209CA0F83D586C045EECC4A530523DE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747409397, "uuid": "9c2a4bf0-69bf-475a-bfba-be516c50753c", "value": "85cb861057f6a329c3b61e26fb713991", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747409397, "uuid": "ed153369-69b1-440d-af6d-0ac2b49a1106", "value": "1536:nlPR0uxKlV528faprA64cJdDf/BOHvH2vXKNf1BnJNP7dcF:BRMM8fupdr/ONf1NjdY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747409397, "uuid": "a8c474f2-cf7b-47b7-9601-9713e4a5133d", "value": 78336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747409397, "uuid": "23b21d48-2291-475e-af4b-e5ea6976d8df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747409397, "uuid": "470529b0-7496-4ce1-b553-660773e0f5f7", "value": "b17911ddeab973db51362721c940d882", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7399ace-3257-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Formbook)", "timestamp": 1747401249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747401249, "uuid": "da970090-d2c7-428e-a245-040bb1849552", "comment": "Malware payload (Formbook)", "value": "024f399961cc3c96487933f8091d8a3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747401249, "uuid": "0f743f74-35ca-4ddc-9485-c8c1b00fd0a3", "comment": "Malware payload (Formbook)", "value": "15525aadbe6cafed08453ddf093153bdf7faeb2d19f22349a31bf59f79c5e03b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747401249, "uuid": "4eeb32c4-a6c6-4d1d-8edb-f184c2e24bb7", "comment": "Malware payload (Formbook)", "value": "c8f8cee1f3d18df8fba4c342d7f529ae3e287a58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747401249, "uuid": "0990eaa8-943a-491f-83d8-5d18d1029b5a", "comment": "Malware payload (Formbook)", "value": "8187d0422c3ceaffefe118f78685dacae017229ec26fc36217e6c0fd8841be143249c3f633465c6e8d7b9dc2d4d88d45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747401249, "uuid": "7fbca2e4-f7eb-4883-9b13-34ae42590674", "value": "T16B35CF2363DD8361C7B25273BA55B701AEBF782506B1F96B2FD4093DE920122521EB73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747401249, "uuid": "081baabc-ff85-4854-a9c1-5e300d9967bc", "value": "3d95adbf13bbe79dc24dccb401c12091", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747401249, "uuid": "00262422-0ccf-4505-9cd0-dee953c5ff9b", "value": "24576:gtb20pkaCqT5TBWgNQ7aVyMSArBVE6r8L17M6A:pVg5tQ7aVdSiBNr2A5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747401249, "uuid": "42b08792-4400-4a96-add4-40273e181a90", "value": 1094144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747401249, "uuid": "5cfd449d-e01f-4ce7-86f2-5df3da03ace9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747401249, "uuid": "3595daac-1181-44b7-b47b-15850f4b759e", "value": "Global Payments and Cash Management.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56aa1c71-324f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747397678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747397678, "uuid": "4bd4c367-1715-4d28-a005-cf466ada9189", "comment": "Malware payload (Mirai)", "value": "1251ac9a6bac2b5ad5fde1b5b71abfb0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747397678, "uuid": "261432a0-8c8e-4c34-8b25-f2ddb2121809", "comment": "Malware payload (Mirai)", "value": "16865e2a3999e1017feb549c5aee697b50addb9b6bc08c92e3608a23496e489e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747397678, "uuid": "9cfc605a-b4f4-41d7-8754-a5a8acdecb0d", "comment": "Malware payload (Mirai)", "value": "8dee69bf0d9877161cb3f7203c8121a3b4bc919f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747397678, "uuid": "0363ade8-32f6-4a62-94b4-cc32bb39ebc0", "comment": "Malware payload (Mirai)", "value": "19f39876f2eedbccef8f048f981aa5c35432f689b0fcb0f58647404e1c5665dbeaf45504bf8e4c58774846ea9ac6720e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747397678, "uuid": "ff9fc0ec-1357-4426-8e7d-c7e9c17ba0e7", "value": "T133143845B8819E23C6C512BBFB6F018D372967E8D2EA3207CD251F6437CA95B0D3A746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747397678, "uuid": "9279a2a2-8019-4cbe-9a97-39e7cec1f68b", "value": "3072:HgZF3ixw46YfMA3gja+MUW775XZBa33V4VJKyGd3R1kZT:HgZFSxwqYjaCmQHV4VcyGdfkZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747397678, "uuid": "66d6af89-36a0-4a11-90b4-2f0b429efbd5", "value": 195136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747397678, "uuid": "bfb15e60-c74a-4d08-a435-b2ee4a13ab35", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747397678, "uuid": "f2a7cbf7-60d5-4ea8-85c1-ec444cdd5c18", "value": "Tsun.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f653e8a-3265-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747407249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747407249, "uuid": "5be6c58d-aea0-4879-a564-7a64d267058c", "comment": "Malware payload (Mirai)", "value": "c82716156dc198e5fa9055648939870e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747407249, "uuid": "19b1a7db-4770-4750-9873-c120a7791ddb", "comment": "Malware payload (Mirai)", "value": "169068eb4aaa3f1662215e6bc789424d35074e6eefb27801b5a899ce77b4dac3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747407249, "uuid": "99606299-492f-453e-b8f7-96de83dbb7f2", "comment": "Malware payload (Mirai)", "value": "b8a85e279a1b21866268abeca2c6e2962b4d50a5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747407249, "uuid": "a35af516-ba30-4ee5-a982-74a3d096f067", "comment": "Malware payload (Mirai)", "value": "53f1e93aa2200560ff2d02b2136f193592d3e81c5c4a91f3f87cd95d283bf1ab35bf1d2da218db1d94cac635643d5a2f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747407249, "uuid": "2fcf392c-129e-4ce2-a8ae-d74ae8fb53fd", "value": "T1054301A1A11706458AA46C3AB9EB0E89177223F0F0BB69361944C798A1D15837BF4BDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747407249, "uuid": "200af4fc-6846-4bbd-aa3e-a1d3b8ae5b78", "value": "1536:a6FCWEFHdjsTFnsOcGGLgZZKv1kC6IZbCSTAJu:TFnEJd4JnsOZGLkgv/Tb2A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747407249, "uuid": "f2a73576-dbae-4e71-b55f-c9af66c21aca", "value": 59484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747407249, "uuid": "1cc77244-0a0c-4c15-a806-d235bb1e29ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747407249, "uuid": "4db9dede-e6b1-4edb-8ca8-c32ff4dc961d", "value": "neon.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c44c747f-32af-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1747439094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747439094, "uuid": "5fb00d4b-dc97-4ae6-8825-49456b9a616d", "comment": "Malware payload (Prometei)", "value": "6b53fa0dec02abe168f5dc9a1c8f26cc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747439094, "uuid": "732ffb4c-50f9-4081-8268-6930656a87a9", "comment": "Malware payload (Prometei)", "value": "16aaa8dc4172745ed3fde0bb876ef528b4c8df47917174f0dab5cc47dc7c67c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747439094, "uuid": "309b81f8-2c21-4389-b653-f4d5d21e396d", "comment": "Malware payload (Prometei)", "value": "12194d2109cb84ff37357b3b732e4a984f0a02b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747439094, "uuid": "8ddfa866-41b1-4241-97da-3cc699ee7a9f", "comment": "Malware payload (Prometei)", "value": "e792af99e2a859a0f9a8e9b00e80341d2f766d53fe99084c22f3b11d0a5ee72378f670a406cfa49293d06abf9fb06e55", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747439094, "uuid": "148b2b3e-ace4-4d92-b089-2d91774cae8b", "value": "T17A9423F8C87D2E3098169F3CBB1A826CF0A15772D9562B6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747439094, "uuid": "05756726-6757-479a-af12-07deb74a2a21", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitg9:25WOSACZSV6eKRH5EPiamb4DsDwwcN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747439094, "uuid": "d10796d2-38e8-4078-8708-2477f0524f4b", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747439094, "uuid": "5169a736-0996-4e07-9cc4-1c692ab54a31", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747439094, "uuid": "49d787d8-ba33-478b-bc09-d4fe1654fdcb", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5dd7638-3228-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747381087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381087, "uuid": "90989cd3-c1a8-4664-87fb-0944500c619b", "comment": "Malware payload (Mirai)", "value": "a288427c7a01ced632304e28184d20f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381087, "uuid": "6d9ee06a-a860-4416-bd13-0c171d052eb6", "comment": "Malware payload (Mirai)", "value": "16b40dbf2cc6b03ed96221e5d8ec118bca78294eb3b4078f7b55b72f220421ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381087, "uuid": "f2060459-9c91-4aa0-99ef-ed6098cdae06", "comment": "Malware payload (Mirai)", "value": "e9c58175a99b17853117744ab0b98d4cd2f2b5b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381087, "uuid": "ad54cc76-760e-4221-9037-c7f02bd74301", "comment": "Malware payload (Mirai)", "value": "58b40d4ba9d5d512eb5f9eac23bac1b77ed41c253a24b345890b9627ca82fd9a1e7b2b15468b0ae4a199255c06bea2f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381087, "uuid": "e6f8024d-d870-47c0-a1ce-f821bf600fd3", "value": "T16A831231F0206933EA524C73DD3CCE8E9D1546E5D1B762B3A8F88C146D9E1B0A9E86B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381087, "uuid": "60118f8b-6585-45a9-a72b-bc278448779d", "value": "1536:YTiFlDWttDEONpZiyMgLZL5P5ktOnI9lKElCNiELXEqlmuVmdO/LA:FPiZFP5kII9lCAELX/m2mSLA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747381087, "uuid": "5c1dd522-4fa8-43cc-98a9-d1cebec67b63", "value": 86616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747381087, "uuid": "5a0e8936-c2ea-4fc1-bfc1-041870540cb2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381087, "uuid": "6a2f0fd8-9240-4dab-b7f0-87864f3d7175", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24f7570b-3262-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747405755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747405755, "uuid": "e4d9a434-f1a2-4ec7-913d-efae693e10b4", "comment": "Malware payload (Mirai)", "value": "8aeec84c859cfe6bfa770f67c0ede43f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747405755, "uuid": "5b34c842-b93e-41e3-bc87-ddf331984535", "comment": "Malware payload (Mirai)", "value": "16d2c2671a4d7a32f28ccbecf68c3f33caed1ba279261eae6620272767902bb2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747405755, "uuid": "8a6a8ca3-0c42-4496-ac30-0d7c1f086d18", "comment": "Malware payload (Mirai)", "value": "83ccc52a58f4a922a0ed7d620e6ecd868c975709", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747405755, "uuid": "6ec7b6f5-f537-47e1-8297-36ea513952e8", "comment": "Malware payload (Mirai)", "value": "fc0ecb3d4bca74602c66dd914abe8fe0902b9765e9e7899f56350bb5af85baff625003fb750618159c1e67f1fdb8d8e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747405755, "uuid": "16cd032a-e730-428c-a5ce-5235642df9fc", "value": "T127E2E10112DA5F48ED6E0133ABDE7C469860E23EB10F8286E351F2F98ED47D41AB0396", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747405755, "uuid": "1996bd7c-c7b4-48bb-99c7-acf9e44fa429", "value": "768:3H8Ex72JJsItE1blK6bdU8z4pW8cTv3t8raRYVznbcuyD7UHQRjXe:3H8Exuab86bW48gv3CraRYdnouy8Hyje", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747405755, "uuid": "d12f1100-5c82-4499-8294-a8f405c50b09", "value": 32684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747405755, "uuid": "5be31b5f-3dc4-422a-8805-9e73cc34ae66", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747405755, "uuid": "2e2b9795-fc9d-4731-b4ec-30efcf59131e", "value": "neon.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d977ddf0-3228-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747381147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381147, "uuid": "6e1cb841-086c-48b9-b8ae-3ee17494fb46", "comment": "Malware payload (Mirai)", "value": "27f794217f4414939df0c22f2309864f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381147, "uuid": "6d7c6d61-edd5-41aa-a5f7-a39411be104d", "comment": "Malware payload (Mirai)", "value": "16d6bcf4ce86428febb823645d7c032a035bb2afda890bc73f684c2475324966", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381147, "uuid": "732f0f91-aec9-40d6-ae6c-5a66a67788f2", "comment": "Malware payload (Mirai)", "value": "329d19409ac9bea87b8de6aa9a2c0e62905c6334", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381147, "uuid": "537878d9-da79-45a3-8ddd-7a7d43ad1fd1", "comment": "Malware payload (Mirai)", "value": "38179f6deaa4626767f9d4cf86a48d4a7e66250559ac975c4d5a9e9fd92844b7db19f427ebaf3b568193ec4d6f0c36e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381147, "uuid": "1962b2cc-06ea-47ff-a3eb-3495be1b90df", "value": "T1B153F2DB48F02CA5CED64DFE00892B9B5961B3C91B8D8ED053898CC5D6F5A1D3C86C79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381147, "uuid": "343a2240-d7a4-4d63-9332-10b8a378cfed", "value": "1536:sYwI1JtTgArKvnpE7IJdCbYU3IlHEj2kPUnJZd94HWY:sv2Jt5rKvnpHvOoHs2rnJZdGr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747381147, "uuid": "55ea32d8-efc1-424a-b62b-590a01179b58", "value": 62800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747381147, "uuid": "eba85e9d-31e5-42af-aef9-4d4c8bf658cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381147, "uuid": "90edeff8-da97-4867-a6a7-5d1496847fe6", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4e523ab-3287-11f0-8bd0-42010a9c0005", "comment": "Malware payload (MetaStealer)", "timestamp": 1747421969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747421969, "uuid": "a2324d7f-db8c-4110-96a5-99da3022eda2", "comment": "Malware payload (MetaStealer)", "value": "41f43fe82fddc8f4768cc18f74ae6f41", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "metastealer", "colour": "#68BF73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747421969, "uuid": "b8295b62-66e8-4ab7-9381-b4dc92ca354b", "comment": "Malware payload (MetaStealer)", "value": "171ef8fbc2c797221daf807f61c3ffbc33abfc385b6edd489e80251b99dd7eb6", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "metastealer", "colour": "#68BF73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747421969, "uuid": "fe5c764a-63e6-4cf8-bac1-277d22c8a636", "comment": "Malware payload (MetaStealer)", "value": "9c67d336b00e77715570d77cf44b9b7a190261fd", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "metastealer", "colour": "#68BF73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747421969, "uuid": "b082ce72-9df1-47f2-941b-81a35ca5cde0", "comment": "Malware payload (MetaStealer)", "value": "2d83dfe933fb8c183585468b3017ccb40d421a8caea1bd7a53b1e2dfe1fb9b7b9cc61d631f30de676d41e61bfdc296ff", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "metastealer", "colour": "#68BF73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747421969, "uuid": "495ee625-db0e-443b-92d6-9fb4e48d3a73", "value": "T1175110122BEA0729F3F34D3E58FB9A16693BB985EA65CA1D0064420C5862F00DC35F7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747421969, "uuid": "20dcbcc8-b28a-4cde-b2a5-9d18b03d31df", "value": "24:8wUJ3PjKUCAFx+/5+Vg2YnbYMGn/Sbdd+5CwiXuHY8IHzLGLm:8lPlaP2YnbYMGn2dyRiXuH8HPGL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747421969, "uuid": "5b5c98aa-be55-4c03-bd88-8ce337c2cac2", "value": 3045, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747421969, "uuid": "91a1edb2-73e8-4bb3-b030-ca687d7ae33f", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747421969, "uuid": "342773bd-002e-420b-9058-5729ff912ea3", "value": "Tech_Specification.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8c3997a-322b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747382354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382354, "uuid": "07507cdd-02ca-4725-866c-d9782ed4dc63", "comment": "Malware payload (Mirai)", "value": "61990db2553fe5508bb16317bd89fbb6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382354, "uuid": "b5bb284c-4d73-4474-8c56-7d003342e83f", "comment": "Malware payload (Mirai)", "value": "1754b5798e71e1f4b7785255ff93c36357dc70946949964f36b9e5780a140fb4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382354, "uuid": "40cff3a6-6e2a-4c72-9873-44ed72fdb770", "comment": "Malware payload (Mirai)", "value": "82c41158db699caf99c75bde2283927deba521a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382354, "uuid": "713b5802-2d6a-4a9e-9211-b5e6b3f0390b", "comment": "Malware payload (Mirai)", "value": "42c10bcf64426fe3ddb1c34298adaee1c42d6178e84aa90c4e57b81a809f4cdd138eb41998d4bc0508480fe5b422d4a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382354, "uuid": "896d917a-8729-4585-a8c4-458523ada66e", "value": "T16F73C70A7E229FBCFB9846354BB78F159A5833D627D1D641E2ACDA001D7024E341FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382354, "uuid": "a876a2b5-759f-4ad2-af06-a2f12c9eb36f", "value": "1536:bpxe5qoct9fdlQBI6rldnUFndlBotYG9CJa10qDv:Fx3oANd6gndvomgC47", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747382354, "uuid": "a6b8cfe9-da92-446a-8fdf-b3ee4d52fad3", "value": 77288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747382354, "uuid": "91f1f3a2-1b49-4745-bbd3-70f22c6965e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382354, "uuid": "65d0397f-9110-4d64-8303-5564c5d8bff0", "value": "RpcSecurity.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddc5d544-3228-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747381154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381154, "uuid": "585742bf-0630-4ae8-ab33-2f09dbe3270f", "comment": "Malware payload (Mirai)", "value": "f3bf0c89d18f257c008dede5b737e153", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381154, "uuid": "909372e9-13dd-475d-8249-232d4d214ccb", "comment": "Malware payload (Mirai)", "value": "17e5f7c08255941f88e6eec63ced98b2cc008e693d376ba6d9061ed66fb3d09b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381154, "uuid": "643d9e50-e51b-4214-aeb6-dbf031e64a9d", "comment": "Malware payload (Mirai)", "value": "48ca28ed67ec6f4bc2a4d5119bfac510a08fc4eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381154, "uuid": "293961a3-e967-44be-aece-96afa27b56cf", "comment": "Malware payload (Mirai)", "value": "b1ca6d9e3894287965d65df2e107199a366409d479cebee6cc09040fdbad9488dc151b11b556f2179d37a2f113ac996b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381154, "uuid": "7eb6408d-fd6a-43b7-ad31-da20a4ab2668", "value": "T122430231973A27DBDAF37AB5AF7913911343270252248A5154BDB3713116F6CFB08BA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381154, "uuid": "4a94e9bd-ddb7-4c83-a452-256fd5d12eb3", "value": "1536:VxTr+if4Sp9CIMDTHyZMSgTvq/Ldk4u+qgw09Z:zlf4QPmSZMSgTuk4u+qgwY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747381154, "uuid": "62a24faf-b10c-4f3e-8ddb-9a94899c6999", "value": 59320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747381154, "uuid": "fc9e2466-c4dd-4079-ac58-4394aedf8a76", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381154, "uuid": "37218050-b235-4f2a-8a48-8180ba725a22", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "118efaf1-3236-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747386825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386825, "uuid": "124af904-86af-496e-be94-b6c72b7848c3", "comment": "Malware payload (Mirai)", "value": "c53b77fabd1e760eb313a3e2a8fb58a2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386825, "uuid": "77f4e5c4-289f-49c7-9488-7d58ee3b107c", "comment": "Malware payload (Mirai)", "value": "1831fc5cf36cb163faa540aa498139e5bbae1aaa92d809c3d07698b85b2a72d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386825, "uuid": "47d9c9ab-dcab-461b-8302-af9dcb686a07", "comment": "Malware payload (Mirai)", "value": "1fa499ae6f530eaf58528b01d0575a3fe0514987", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386825, "uuid": "b092bfaa-2f23-41e1-914b-7a37ec7684f7", "comment": "Malware payload (Mirai)", "value": "a8da48ae8f3244c4171c7b2b23dc7e62890d896735b103b56fdb0c78bbc5271e11580d04b71727a89dcc04fb954872c5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386825, "uuid": "48e59247-1a93-4c66-b291-eed8a926eaea", "value": "T19A5309D9BC00CF7EF84E9BB954620A07B921D3D0CA932A2657F3BCF219A50C45F56D86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386825, "uuid": "1904f5cc-89b1-4342-8176-049ab77fc30f", "value": "1536:uZO5qMX4fpyjGBSurDw5M8tTvJUBkBlEgjbt:uc5V4EyksDsfGmEsbt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747386825, "uuid": "d3fc62d3-fac5-4af8-b641-2eb3e17e8afa", "value": 62808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747386825, "uuid": "192e0b14-dcb9-4cb2-bcde-f130f8070723", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386825, "uuid": "3ec83b0b-0f19-4130-a419-dff865ac82d8", "value": "Mozi.M68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc2e8e3d-323a-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747388936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747388936, "uuid": "defeaf82-667f-4ef5-9bc2-afaf150287e4", "comment": "Malware payload", "value": "2072f7764778cad8bd8b0a4fdf8f0a3c", "object_relation": "md5", "Tag": [ { "name": "dsh-fvsrchps-cn", "colour": "#DE3429", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747388936, "uuid": "0914e34d-e76f-4cf7-8071-7e3fcab359d5", "comment": "Malware payload", "value": "1833d9c965d99de0adbde74ce4e975d05ea97f131c3189f6725052d03e77c9a9", "object_relation": "sha256", "Tag": [ { "name": "dsh-fvsrchps-cn", "colour": "#DE3429", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747388936, "uuid": "ee1d0152-10fd-4c51-a843-08d679c93cb2", "comment": "Malware payload", "value": "75f905d0aee4b77fbaf052b7fe403ca205769eb8", "object_relation": "sha1", "Tag": [ { "name": "dsh-fvsrchps-cn", "colour": "#DE3429", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747388936, "uuid": "0adf3db4-efcb-47bb-9398-05b2271a0d0d", "comment": "Malware payload", "value": "eccc1d0c3561635a4d83655efc24384eb0209337282c2614afe621efcbc72368986897b0e062867c154971c7f34da92c", "object_relation": "sha3-384", "Tag": [ { "name": "dsh-fvsrchps-cn", "colour": "#DE3429", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747388936, "uuid": "06e33ea7-fbf0-462f-87c0-d2890f7c2a9c", "value": "T18A4733F410DD3C7CA7C87301B94844A7B7E3322A0016AE7613B2677A1796E9507A6DEF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747388936, "uuid": "11b9aa15-c7e5-4ae1-9523-e550c2f16578", "value": "393216:ndugkBIOhk7DQXTUHVb9/IXbmXIilfayOlY7k2bFzaYfayDObLSw+Y8ifTe5Zt2R:YgO670XTSVb9obwIpyOyFRavyDKL+wTN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747388936, "uuid": "a59fe81b-4856-4704-be96-99361b77ef46", "value": 24846474, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747388936, "uuid": "2e60f3e6-19f8-4a4d-8019-f0de4848c2ec", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747388936, "uuid": "8186a792-5e0d-43d7-9753-3a3eab4c7800", "value": "1833d9c965d99de0adbde74ce4e975d05ea97f131c3189f6725052d03e77c9a9.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efb779be-3287-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1747421987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747421987, "uuid": "380b4ee3-848f-47fb-a9ce-9a95bb935a48", "comment": "Malware payload (LummaStealer)", "value": "981f6077b7bbd3c39d69fa5a740a6d24", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747421987, "uuid": "c3e91c43-69cd-4fa5-a722-739d7ead6930", "comment": "Malware payload (LummaStealer)", "value": "186ff54556fc88758fa7d80c8a2d901011ea59a2740d2f5cc793b5cd29a897af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747421987, "uuid": "2a37a108-7e87-46eb-84b8-587c1d2269d7", "comment": "Malware payload (LummaStealer)", "value": "3083f5855053c2fcde28e946aff1f59db0fc4539", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747421987, "uuid": "9a4a6116-75b6-4e41-ac4f-696528e581bb", "comment": "Malware payload (LummaStealer)", "value": "7f6df0b86ed26a5c2f33dd7ac2d363faefce40aa3ed2352974bf2c9f628cf01c9c8b3922b630de7793009c2975ffeda2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747421987, "uuid": "66631c17-a495-406c-94a9-cc097f46f2d7", "value": "T1D89533F18EA33F3AC11C6273F327F661DB2874A97682F2A83B50D9379596A05147CD90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747421987, "uuid": "fb9818cf-0c6d-47df-bab4-43c17b12c211", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747421987, "uuid": "d886975c-3601-4783-9a1c-37ea4142cb93", "value": "24576:xozDv+dsUrtEAY5ULOiIPfMSDKSafGddjY1KL6LYROaOyRj8Cvr30tj6DxgBEPOQ:xYDmRK5tHMSXDdYwjjXAtj6VazrZ/e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747421987, "uuid": "766a5b7c-866f-4a40-943f-691e6a059b3e", "value": 1928192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747421987, "uuid": "ed605898-ed6c-415b-8b08-cb85ce6c4680", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747421987, "uuid": "9aab0b5c-7c03-4654-9619-90d28402c2e4", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "579d8e8a-3279-11f0-8bd0-42010a9c0005", "comment": "Malware payload (QuasarRAT)", "timestamp": 1747415719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747415719, "uuid": "afe4b0e0-6b81-4aa9-8769-4b52e46f5584", "comment": "Malware payload (QuasarRAT)", "value": "6a497a436f0ff474236190edf4e2561c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747415719, "uuid": "e2d47337-33f3-46b2-baec-f20a8ddfec73", "comment": "Malware payload (QuasarRAT)", "value": "188c3798b6d41bdfa3981bb61a40b81f4fe123c64b9bed2d4c40951de2064f19", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747415719, "uuid": "4005fad5-e712-488c-932c-3ba07e28e49d", "comment": "Malware payload (QuasarRAT)", "value": "50c3543bbd13ce1a26d569d3868a1b1fcb5bbb13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747415719, "uuid": "00d3a6ea-6b6f-4563-9d66-102d75f4d6e7", "comment": "Malware payload (QuasarRAT)", "value": "4c807682abaa392d2e707262c5b28969d14bf16abefcd1f3dd824af2c662ba8c05087740b30f8859246f014b71162f3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747415719, "uuid": "dbcabea4-d36d-4676-8f60-f5fefb36a1d5", "value": "T106159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13A81DB9BD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747415719, "uuid": "69c5f62e-192f-47c7-9f59-873453b0708a", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747415719, "uuid": "dc70f806-da27-4096-bf82-e15cbe1e2af0", "value": "24576:aqDEvCTbMWu7rQYlBQcBiT6rprG8aMub:aTvC/MTQYxsWR7aMu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747415719, "uuid": "dabacdeb-c669-426b-8ad8-65c8f214e457", "value": 961024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747415719, "uuid": "f9a52980-40c2-4cc0-8336-ad5c8ce8e954", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747415719, "uuid": "cc76727b-4769-48ea-b944-33daf6c425ba", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05eca001-320e-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747369625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747369625, "uuid": "788e7b27-1520-4be9-9532-ddf699fdefac", "comment": "Malware payload", "value": "7808c592157783ee9710871655d2c473", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747369625, "uuid": "3d66b169-c8d7-4bd6-9a67-de3fa0dd5ae5", "comment": "Malware payload", "value": "18d78534f696280c9ff99d50a46f3f85770f18fd389af799461e9c0dc5bff0cd", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747369625, "uuid": "9519a330-77a4-4871-b88e-d9f521643b46", "comment": "Malware payload", "value": "3c3cc2264d3219153ebfdc23dc1cf7664a97da57", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747369625, "uuid": "3e4a06a5-4f93-4771-be3e-8d5ba3de1ff9", "comment": "Malware payload", "value": "096c33d900e820bd4fdc7bc8fb4b3e4d25b83450ac9c607961cde31853c826b3dd0940d9ae15fa95bad0b8766171e911", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747369625, "uuid": "a1798a27-49a3-450f-bdf1-fa8a3c2fbb0d", "value": "T1A50128CE1158CD7158558DDE31D2191978CDC5E95ACACF87608E00BDA4CCE0CB162EB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747369625, "uuid": "af0d7333-ed6a-4249-bce2-8a623bffebd7", "value": "12:3rWKIw+u5ZMoFF7+MB05vWPOtWPNDNkpjNXWIyTtWIygDNkpjN8Tvn:yRk5zFt+MB0A1Dkpxmm0kpx8jn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747369625, "uuid": "85252a78-ceaf-4739-a39b-9569e0e6e50b", "value": 709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747369625, "uuid": "70d81b92-ef6b-44a4-a63f-f6c7b652828d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747369625, "uuid": "8055448a-eaa6-4794-a435-67d6aafff836", "value": "l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6d3418e-328f-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747425381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747425381, "uuid": "3d9babf8-955d-4238-8610-1e3b4ae313bd", "comment": "Malware payload", "value": "badce636c6e468b09502aebaed3638ac", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747425381, "uuid": "4b35a3e8-61d9-41f1-940e-0480fd4376ae", "comment": "Malware payload", "value": "1977133dd331f0b799da2f4c4c56582388ffe07582c173fc57c17c62f07f2a19", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747425381, "uuid": "d8c6d76e-6c97-4e1b-a19c-4ef63a36c6eb", "comment": "Malware payload", "value": "7eea5fcfb88056d1827011c92e032f09aa091f53", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747425381, "uuid": "9f63db1b-a250-46f8-b2b6-872515b4a858", "comment": "Malware payload", "value": "fca1bb159a352a6d6c976cb6fc86312546c10ef9cdde774a5f9ac1af39318413effdc9659cb75860155fb9fe3ed668d6", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747425381, "uuid": "2a8fd859-1ed0-45c4-ae49-b844c8d0c920", "value": "T191F7336DC336789EC8ED67FE718A8110B970510D6B33962F9EA820815D8779C3E16B1F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747425381, "uuid": "274b2ea1-737e-4bd8-b06c-4a99b259fb8f", "value": "1572864:trgidc/5HLl3KvmysajEC1bbN6CyxByIt2pnnUl5ioX:tkiQ5Lk+yDHdy6p+x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747425381, "uuid": "956070e6-2871-407a-b4da-36cf0c59e22e", "value": 74614543, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747425381, "uuid": "f3b143d7-1468-4738-b166-7f099e89abd0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747425381, "uuid": "d8868a95-3bae-470a-b0bc-99173585f1d9", "value": "Eazy_L0ad3r.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b6fa959-31fd-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747362441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747362441, "uuid": "8adeaf02-d767-488f-aef6-89681f0b44b5", "comment": "Malware payload (Mirai)", "value": "fa0ed7f012b9c82263eca7e2f43330bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747362441, "uuid": "8ea58b87-710a-4ab4-92fb-18b9dc39b63d", "comment": "Malware payload (Mirai)", "value": "1a1fe028dff60f81b905f16209ceefd1eb8cbcea9142cd2d0c3eef28fd580322", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747362441, "uuid": "71d29f7e-93e5-4ec2-bd6e-6deec1f17d16", "comment": "Malware payload (Mirai)", "value": "56bdfca7d49a120b05c505f0920a0cd4169bdde3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747362441, "uuid": "4107c1ac-7527-480e-bc53-ca917aeaa8d2", "comment": "Malware payload (Mirai)", "value": "084d29528e77f76462721765a52fcf23d2e177e1db57ac8228f109eca16ed5eea0fb0b1893fe3da3ee09b608fd7c92e1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747362441, "uuid": "18a289d3-9471-4a7c-ae94-7429db97305e", "value": "T17AF21B95F892553BC6E06335B39E690E3731B3D4D3CF7607EA150B6136AA50F5C52E80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747362441, "uuid": "72bef0b8-3d3a-4938-b9d9-24a1fff6cc0b", "value": "768:l/TtWNMhlYuzHp6kMvMse/sfaB5ois1tzgQGK:ZlPHVMfaBM1lgQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747362441, "uuid": "74548e08-1928-4e31-b121-49063ba9c596", "value": 34332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747362441, "uuid": "be925089-6d83-498d-a4a0-d1187f0a4e14", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747362441, "uuid": "65943148-3ec5-418f-b060-eea1af8f7011", "value": "neon.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36989d83-324f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747397624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747397624, "uuid": "98fb0562-4a12-4fde-9206-af341b7330ec", "comment": "Malware payload (Mirai)", "value": "9dd16039dab0ee32d35553b90ad0e206", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747397624, "uuid": "b43c1826-2a88-4f66-be38-23fc31d14b31", "comment": "Malware payload (Mirai)", "value": "1a212f5d854cd5a21239232901ff2f5783ebabc73906304644b486474de6a1b3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747397624, "uuid": "fbd26727-8357-4b1b-aa67-bb7e5edebc57", "comment": "Malware payload (Mirai)", "value": "29b9e6ee61b937c521983de1496233d8ea385585", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747397624, "uuid": "01b3c931-e2e1-4633-a3e1-489795fed719", "comment": "Malware payload (Mirai)", "value": "2c68584aa1ba707047fb44420354e1219cb11c60fbc9f72f9f51e65e073f8ef91e2135c91443f00f4d56df213e169ec0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747397624, "uuid": "0d9c8dff-cbb3-4147-8f9e-73ef3c273a07", "value": "T173F38D32D879AEA8C265C534B0E48E386B53E18441472FFF9AE6C3BA4447DD8F505BB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747397624, "uuid": "225a456d-ec6b-4810-b20e-07d479676702", "value": "3072:t4HZeTYnECx/4mCJV0feC82Tu40wHIoW31d23t+ZA:KHZpnECxQn0zu40/x3zOt+ZA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747397624, "uuid": "7dcd714c-a1c7-46a0-b2ab-7a19ec44a24e", "value": 172704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747397624, "uuid": "c10c9d02-0d4c-4b2a-8892-248836d5defa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747397624, "uuid": "b3fcb841-050a-4173-a3d1-dca9555d5d55", "value": "Tsun.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c44d90e1-322f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747384118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747384118, "uuid": "f67c7306-8298-4c45-bf7c-daaa06a351a9", "comment": "Malware payload (Mirai)", "value": "81916eab0c53f38f4d01a62e030c5548", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747384118, "uuid": "1e1e5e56-49a8-4c1e-8be2-8927829f50ac", "comment": "Malware payload (Mirai)", "value": "1a6076b1d80f51bd3c7975c26ecb8a445f8560ab0b09286458835b7dc5d8ef0f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747384118, "uuid": "3182aaec-cfd4-41a4-b87d-2d19bc53851a", "comment": "Malware payload (Mirai)", "value": "2df694bb23564f91e97aa804c7b24ebe0969d702", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747384118, "uuid": "084d723d-7649-4a08-9cda-91ecf15bb4ed", "comment": "Malware payload (Mirai)", "value": "f0c22492b754de112c5be7dac24e9fb106f6eaec0b274d327d89fe8b299ba7930c9d833a710ca9f129036dbe3fca3b6d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747384118, "uuid": "9456efc8-2601-4922-8883-0cd0f606d538", "value": "T1974164C9B3010831BFB35EAA79B7C458F2C4B06B9EC49A85E4ED74EA844DF086D51663", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747384118, "uuid": "27645f7e-c8d1-4742-aafe-a3ca11642e3c", "value": "24:vJ6xOSJnhaIOSJnTYnkaUoOSJAooOSJFJOSJlYBOSJXhOSJD7OSJ0NOSJjzDOl:vQRzRlwRRoRVR8RDRhR6RNe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747384118, "uuid": "41bc9f16-7bb4-4c9d-b03b-408aca8b7814", "value": 1893, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747384118, "uuid": "7ed871ab-7b68-4e81-ba74-23146269909c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747384118, "uuid": "ec426040-bcb6-4a0e-8fc6-405f07f0ed60", "value": "yarn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a95bd14a-3228-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747381066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381066, "uuid": "6c1e8045-4b89-48cb-8a35-a4fecf014f44", "comment": "Malware payload (Mirai)", "value": "bb6afbe224e2469e96ba88a8733767ff", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381066, "uuid": "1696268c-c255-40cb-b545-3422b010934d", "comment": "Malware payload (Mirai)", "value": "1a98fbc3853d295f1da0a5eef0cb24cf06ae8f6762902b0376b5232dde5dce97", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381066, "uuid": "9b5d3845-0f66-4123-8efe-06d77cb5fb86", "comment": "Malware payload (Mirai)", "value": "e8af2c435084806d81a0cbc252aef7e4e190a3d4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381066, "uuid": "48ba86ed-0425-47a4-8141-4f36bef2c558", "comment": "Malware payload (Mirai)", "value": "58b5fc4512016575ae40e2e1a2dfd0f8bf0d1b4ceb96b2f74b888f705259295b9922bca84e767411aa1c04902d6ffa66", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381066, "uuid": "16c264f6-be87-45a0-922b-3ac5958a8b04", "value": "T1BC41F7C4156104F53E59AB27B6B549203AC7D0416CC0AEE969FFB8AF404EE8C3359EE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381066, "uuid": "cabe1fad-b922-4fa0-b990-cb210725bc51", "value": "48:vXoXoSXomo5XoMkooXojoNKVssXokosYLXoBowdJXoqoIkXosozXo0qo0TfXo4o8:vXczXX6XO3XavHXxeLXUxXTyXXyXiTXt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747381066, "uuid": "b6e9e095-3e51-4fc7-ae50-dbefef528344", "value": 1980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747381066, "uuid": "f83c30d0-f883-471b-9fed-d57ccbc41f50", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381066, "uuid": "f10445f2-cf2b-44e9-8a99-d44738840215", "value": "8UsA.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a65e043-3272-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RedLineStealer)", "timestamp": 1747412717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412717, "uuid": "3a55bf79-324a-4f04-baaf-6522c3282228", "comment": "Malware payload (RedLineStealer)", "value": "47d0dc2b70e5b1aa76b78365c0bab5e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412717, "uuid": "d4cd2cba-bbf8-446b-a782-ad34bd2a9a69", "comment": "Malware payload (RedLineStealer)", "value": "1aa3ee229a01291246afb56e5c79d2c8de523bcd76e603c1bef084bb2acb3d24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412717, "uuid": "9f0900df-464c-41da-9b83-b5ea826277c2", "comment": "Malware payload (RedLineStealer)", "value": "cb6ffcbb6cb9d44e76ec620f8a92d7ef9aac4361", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412717, "uuid": "76ef3721-61aa-4d09-83a1-b8d7e1ff4c35", "comment": "Malware payload (RedLineStealer)", "value": "609c81f34a9a68b80aea3b828d73894e135e847bcdcace5e7e72daa1817908b216e041f955cedefc6f97ef51c19e7a75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747412717, "uuid": "de7a2585-075c-468e-83dc-ed8ab3c082c7", "value": "T1081633CBE3ED8583FA30D3F04BBA63532E727C60A9350A9F2679291D08E06756721753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747412717, "uuid": "64ff6a36-35a2-4f99-b251-f279b60b3f73", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747412717, "uuid": "1e590823-c77f-45da-b60e-f876a76a49c6", "value": "49152:s59U7ZK+3Jcw4uOoYCMvHsy5WwlrdPsOxSSNFy/H+Y0Xyo/3Fs1ye0n7kDtteD0V:O92cwiCMUyJLsfSNFLHGHSD0sq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747412717, "uuid": "4be3daca-2430-4b31-9211-536b285b4d62", "value": 4312576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747412717, "uuid": "331fc600-4dee-41e6-b883-8d7caac6b359", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747412717, "uuid": "d25980c0-8aa5-4922-a1d6-131a13fa17c4", "value": "47D0DC2B70E5B1AA76B78365C0BAB5E5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcdd0dbf-3223-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1747378952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747378952, "uuid": "ec432439-767a-4a68-9286-66cc4ecb59b2", "comment": "Malware payload (Prometei)", "value": "60e9ab04def9f957db6f14fd9322b241", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747378952, "uuid": "7cc98a5e-1316-42b4-9f32-27a9f87976cd", "comment": "Malware payload (Prometei)", "value": "1ab9d917541baa8be4047ca0ae414cadbe2ffe72d1176ea3b735cac6ae3a55b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747378952, "uuid": "f29b9a70-86e6-43df-874f-76e0d1de87b2", "comment": "Malware payload (Prometei)", "value": "ff8e0503594f5b08674dea6af9175643687a9f3f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747378952, "uuid": "99831ff7-5802-426a-bd9c-2b581835b156", "comment": "Malware payload (Prometei)", "value": "2036261c4f2115ef5750b01b6e329a5f58d32caaf836498fe7946b85b6539713f1034023f4577b62ab5aa0d974183993", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747378952, "uuid": "4251e9fb-fe8a-4879-b602-3b1841e6df06", "value": "T12D9423F8C87D2E3098169F3CBB1A8268F0A15772D9562F6AB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747378952, "uuid": "3a4ca29d-f619-48fb-bd73-3cc86bf88401", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitg5:25WOSACZSV6eKRH5EPiamb4DsDwwcJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747378952, "uuid": "f1d9d295-5593-406f-98ab-a78c363ddeae", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747378952, "uuid": "a3a17d19-dbe3-4f48-b8c4-ffda6fcb6792", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747378952, "uuid": "325aca6e-f55e-4c77-8430-59a5d79c0caf", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d10e1a1-322b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747382308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382308, "uuid": "03722427-2fe9-4334-9d2a-090c17241917", "comment": "Malware payload (Mirai)", "value": "1f5fa1a9eb651c9f535147df55910252", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382308, "uuid": "856f295a-0b21-4163-abaf-edfe4c8e96de", "comment": "Malware payload (Mirai)", "value": "1ac14fb4f5b40133415d2256ce7cf7629e287fa394c34f06d49f847aba03191b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382308, "uuid": "f540f95e-cf4b-41fa-88f6-e3e3cc81bc0d", "comment": "Malware payload (Mirai)", "value": "fe647f6ac61f2b6bd81aa85d2059bdec1035eeac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382308, "uuid": "09468ed6-e85c-43db-89ac-62af52194a2f", "comment": "Malware payload (Mirai)", "value": "b2954b6af4cf45902b0363962f333224515e1eb2be3a28c416b7a4343281674e6aee5c082008a3fe25e4b552ca70d11f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382308, "uuid": "b3431a1c-4227-4032-80a1-b5c87be9be30", "value": "T1E7E2E0054A6295CAFD6F88BE63E343952F728F475993CD862CA8E483C983053751A6F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382308, "uuid": "7eaea828-9997-4a74-b814-08222c7daf00", "value": "768:GfF4s4cxe4egRhQHSZrDUAU0qQbDGAddJgGlzDppMgm:M+6e4dQkr4mKK3V8J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747382308, "uuid": "0ced2313-5ec6-4a51-b39d-47b7d78982fc", "value": 31752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747382308, "uuid": "9639a136-552f-4edf-afa4-cd0cb1b3cb9a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382308, "uuid": "31415c6f-76b7-4f22-a26e-690c2096d2d5", "value": "rift.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "013d1cb3-325e-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747403977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403977, "uuid": "9aad71c3-dd4d-43d2-91c3-f9f8596e60bc", "comment": "Malware payload", "value": "53ef6d83c636c60943be1830c3b1b686", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403977, "uuid": "720bc38f-372d-423f-af88-655aae8cccbf", "comment": "Malware payload", "value": "1b3956323743dc44c08dd12041ecaafd146ccc3a0a5b936d52acd50f1c8358c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403977, "uuid": "0eac6345-2c79-4211-9b35-0cbf961daed6", "comment": "Malware payload", "value": "88f925a07eb67352c2822ca52cc966e0f3082a76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403977, "uuid": "0ef50ad1-796e-4e34-b6ac-a2876e63fac1", "comment": "Malware payload", "value": "1fa0e74ff724a032c64ce0c026759522994120607a935cd7ee4a38c801f8dc14c4c38edb7109b64b8a4000caf4a25958", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403977, "uuid": "ea2d7e34-8716-4f02-bc26-7df8c097eee2", "value": "T156A52342F6C648B1E17228326B7867216A7CBD305F758EDF67D03A1DE9605C0EB20B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403977, "uuid": "8b7b255a-9512-4002-9e15-16c4a4cf7ee1", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403977, "uuid": "f2a328c0-d71f-4866-9015-02b431ab74b3", "value": "49152:IBJxTpc8iYMljoCIrtufFEUPtPSfdjh/SXjle:yXTFMlFIQDP4fdj44", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747403977, "uuid": "64150473-e27e-4650-abd5-4c9d1be90eb8", "value": 2230224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747403977, "uuid": "dfa0cecd-41ac-404f-a091-f5ad787057bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403977, "uuid": "3470dc5e-c847-4a78-829a-51f08eb13718", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daa47aca-32a9-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747436554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747436554, "uuid": "64440b0c-455b-438e-a61f-aa781d88964c", "comment": "Malware payload", "value": "3a3d0f34d470b355cd99da3503d6bc96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747436554, "uuid": "4fcc8503-f5a8-45ab-ad1c-c18c771f3a43", "comment": "Malware payload", "value": "1b8e8c6c7d7dc2d1d0b7afdc8830dec8781c4023c37b3d00aaf9196c5b0877b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747436554, "uuid": "28a8a6b8-3386-4f36-92c6-52a73dc97265", "comment": "Malware payload", "value": "d81d02cce76928c5db08aacff7d5dba50adbaf21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747436554, "uuid": "a68e8a6d-11c9-4f66-8c6d-d663a5c8fe4d", "comment": "Malware payload", "value": "001967bd04bba14d9f9e69b1f648e2a0fb1b1985ae4e0519f28891e8bd46ec56739723da9a1938accaaecc578cde4819", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747436554, "uuid": "5ce2a833-37f6-46ed-b0c5-0dd0dae7b7a2", "value": "T1102833443CF4FABBDF2827335D5CE461E7A27B6A1A42D4F17186DABD29D1A205F08630", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747436554, "uuid": "a0189ffb-ac23-46ab-bf39-faba72bac52a", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747436554, "uuid": "3986956e-7a09-43f9-89bb-fae136cc81e7", "value": "1572864:L6kSyS1hX+6ZLB+mDkm3EhGRYJUnahJQNesw3e8hSQIbdZBFsAFlfn1L3RlXvonx:L6kSySXtfDkSEYn6+UFhZIbV6ADdfo3B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747436554, "uuid": "871381bb-00bb-45a4-98ad-bf424117a22e", "value": 99264705, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747436554, "uuid": "2bdc20dc-e600-490b-9bfe-1fb243e791e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747436554, "uuid": "d0fb5d87-b71d-43f7-b139-c0a74fa23998", "value": "BlocksMC-Tracker-Setup-1.1.2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cd23092-32a4-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747434249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747434249, "uuid": "23e476aa-67af-43a7-b164-3a1ddd505009", "comment": "Malware payload", "value": "50c7c9dec23edf3fd1b3500051c63971", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "vgszf", "colour": "#2A4731", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747434249, "uuid": "510cc7ff-71a6-4732-92ef-0d8be83eb84c", "comment": "Malware payload", "value": "1b8f6a918721eb6f94723ee879d935941797398827b75b69939262be41f2728e", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "vgszf", "colour": "#2A4731", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747434249, "uuid": "7cab7623-97a4-4b74-a83b-b6664e88272b", "comment": "Malware payload", "value": "82f4514ce0662456a6589e05511d6f1d50c90d4d", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "vgszf", "colour": "#2A4731", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747434249, "uuid": "5cee9b0d-1d7d-4095-9951-c2706466a58a", "comment": "Malware payload", "value": "a1d487df1c2b7b086e1d415c5406628a2aaae8f4d59e08582f63d4fb553c663466efcb66c475e8c5c4af9ec6caecac0c", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "vgszf", "colour": "#2A4731", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747434249, "uuid": "43715d49-f96f-4837-98fc-486c82d08cc5", "value": "T16A726EE35A60ACEAFF9B8C3C52C84C27F674FA521B4185DB1278C2054F417C2767D2A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747434249, "uuid": "99cf87f3-238c-446e-a3cf-440b4b40adb3", "value": "f26d4d130d47de058333610b89631dea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747434249, "uuid": "92539fa6-e671-4498-bd12-9c6aa99baec0", "value": "384:TMDMbWM7Py5ZqvS7Z3AM+o/8E9VF0NyzVM:iMbWM7PH6d3AMxkEDM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747434249, "uuid": "271481e2-bc45-48fb-80fc-0cc8939679cb", "value": 17464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747434249, "uuid": "344cfe73-6160-45c3-bf33-a56d17e6bd04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747434249, "uuid": "9a4d2562-723e-46a3-bc1b-f0c5b5916eda", "value": "driver6.sys", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b93619ae-322b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747382382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382382, "uuid": "2c60945c-1946-4402-b97c-4d70b0378e01", "comment": "Malware payload (Mirai)", "value": "5146143dfd0d77a246b17ec3c99a1888", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382382, "uuid": "83a15b34-bda3-489e-a407-ad9d329304b8", "comment": "Malware payload (Mirai)", "value": "1bd16fc75da5690e71c6bb38b997f43a0f8bc585065d8cd959023ef3d5ec66b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382382, "uuid": "24907800-28c4-477f-8167-2859f44caa3d", "comment": "Malware payload (Mirai)", "value": "10a2c9e514e34798ba940cfad018114711215066", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382382, "uuid": "3e340c31-39c6-426a-9e8d-e6efe0c8d22d", "comment": "Malware payload (Mirai)", "value": "8df341612eedb08fd1a855bfbbbc795e705fcfdb0b52860db4523de69a79f867bb57d385062d689c102de7b3690cb4a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382382, "uuid": "6b56b333-20b9-466e-89fb-5de681474ddc", "value": "T115D2D1214017E45AE7308C3AF57EC8C63A171778E0EAA2232534E51C2DD78BB7BB4A47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382382, "uuid": "e22de8fa-4fd5-4fd3-a6d7-7b3d6167f7bb", "value": "768:uyYDPF7UgkrBGipgP40ECDLJXNOhBr6n79q3UELQp:vYbRUBwif8lX0hBr6naLk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747382382, "uuid": "1d7d9a29-9c6c-4757-830c-e4f4fe14b1a6", "value": 29536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747382382, "uuid": "0d43302a-1006-40df-980c-e347f37e8871", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382382, "uuid": "902426ab-ebd3-4661-8b5a-8e6cfd75e112", "value": "phantom.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82f0c028-3252-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1747399041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747399041, "uuid": "98943139-2ea5-4995-8abd-41db899d82d0", "comment": "Malware payload (Prometei)", "value": "5d0c4030d0796623f613c24c672c41b2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747399041, "uuid": "50d5812e-07af-4be2-92d7-c19e5ef6d19a", "comment": "Malware payload (Prometei)", "value": "1bfe96962d995903675fbc2496f860c28b10cbb4af7b5c76f1833dbefc5fe58a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747399041, "uuid": "ffa51d93-1d9f-456b-bffb-17b0007c8678", "comment": "Malware payload (Prometei)", "value": "434e8685523cbb0ac22430d5536908e67446b8b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747399041, "uuid": "4ec9cf7e-452c-4170-b46b-5e2eeb8fd2a0", "comment": "Malware payload (Prometei)", "value": "bd86cefd9f7a6a0d1f5337510fa60b2a50edd61280f4c0b9f24bcf9aea0a9a3e12f86ec4cbec55a0cfcf3b34c9cfd0b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747399041, "uuid": "29aa43b7-0e05-4de4-8e8e-ec00761ac550", "value": "T19F9423F8C87D2E3098169F3CBB1A8268F0A15772D9562F7EB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747399041, "uuid": "b9a6890b-29f1-4858-8d05-7b734ff2ce8d", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgK:25WOSACZSV6eKRH5EPiamb4DsDwwca", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747399041, "uuid": "755eb715-d46f-4575-a23e-927583983494", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747399041, "uuid": "38fcc19c-f45e-449d-bd04-6ecd9817ea84", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747399041, "uuid": "fb5d56d2-db45-4519-90d9-ce3d493d2427", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c35c802f-322f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1747384117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747384117, "uuid": "eaf6bb38-d502-4fc2-a5f8-55a52942de92", "comment": "Malware payload (Prometei)", "value": "80a24413a74bdbeec5deca446da07b5e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747384117, "uuid": "ebf88402-f104-4344-96ae-4c0e606297ff", "comment": "Malware payload (Prometei)", "value": "1c3d4ed75885287fad1153f6550e5fcf6a831a863691c8c5167e3cdb34e1100a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747384117, "uuid": "96e88a71-a8b2-4873-af82-75edfa4785e0", "comment": "Malware payload (Prometei)", "value": "54b8edd5b25c2cc9be1a7f41650ade97ebcaeb2d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747384117, "uuid": "da7c88f2-a0d9-47bb-8736-d0d37422ef88", "comment": "Malware payload (Prometei)", "value": "57eb55596cbf9565c3966528ae3596e0d7fb30150fc09c7d4a69d03eaf375576a896b9b9f8eed6229a3634945b0a7076", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747384117, "uuid": "1b4572be-51c0-46ab-b750-9b0358f60d38", "value": "T15C155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747384117, "uuid": "76a1e4d0-d4df-4dae-a55c-25fddb0c1db3", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8MplV:qmShf4OTjMgXSJhBXEsVrmz9MOup1Khq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747384117, "uuid": "03fc462f-5a40-49dd-b177-6a0d417ea019", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747384117, "uuid": "f82148fa-093f-42bb-89cd-429178419af3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747384117, "uuid": "643155cc-4f58-4089-a53f-9db1551c85c7", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f5191e2-322e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747383627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747383627, "uuid": "019faa8a-1a07-446e-8b7b-c141fe829350", "comment": "Malware payload (Mirai)", "value": "16a2c4465319b6bfcc476a66fa2beca0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747383627, "uuid": "97afc35b-7a3f-43e9-8734-eab89f1bb5a1", "comment": "Malware payload (Mirai)", "value": "1cd1969fde0384347316b000db008b273b976a07f127eb7b040e5a13e37f7ef6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747383627, "uuid": "81891c77-6d29-4e0b-ba29-85bc3ca82ccf", "comment": "Malware payload (Mirai)", "value": "be330e0df8aa70bfa06c27c83a45219847e06a9f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747383627, "uuid": "6c04b856-6d69-41ef-a751-e3406c8d0bd4", "comment": "Malware payload (Mirai)", "value": "4fb2a6535f489a97af54e8a970badf2efe4754d8d2cff871d194f74af85a261f4d52e09175eb9d065433caf0b9c35a75", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747383627, "uuid": "d2f791c0-d06f-47b9-b70a-3cd28d7de416", "value": "T1DEE33B46E7818B13C0D61779B6DF424533239B9493EB73069928AFF43F8279E0E67906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747383627, "uuid": "2f66b480-eec2-417b-8f5a-ec2bf860cf06", "value": "3072:Tao9tEW0aDwqBHvO7T+d52vGmHM0nHvTM/9cbh:eAt10aDwqBHvITo2ums0nHLM/9cbh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747383627, "uuid": "b73c001e-91d0-4558-a86b-0becfc31d7a4", "value": 152797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747383627, "uuid": "7537c2c9-1271-4d35-90b1-62ce255f0604", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747383627, "uuid": "5b1d11fc-5d79-46f8-a4f7-22e0ed7cdd6e", "value": "neon.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0eac7f9-323b-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747389240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747389240, "uuid": "5503fdec-57ce-474b-8e8e-17b28a193457", "comment": "Malware payload", "value": "5a9efb6ec2d6f9363b73e6b9571f3770", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dsh-fvsrchps-cn", "colour": "#DE3429", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747389240, "uuid": "e8f79a20-d7ad-41ff-821e-cc0e3f9b71e0", "comment": "Malware payload", "value": "1db338e2de1f8bccb770503c51c5ba53d88949c85f6267d62ac8d5b621e31812", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dsh-fvsrchps-cn", "colour": "#DE3429", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747389240, "uuid": "10ae62b3-ab71-49c9-abf1-8228cc3418b1", "comment": "Malware payload", "value": "c99fdbacc0f8c42e23efdb729ba50a60a25ab775", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dsh-fvsrchps-cn", "colour": "#DE3429", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747389240, "uuid": "fbda9c9d-8c77-4c80-a6d8-58addfecf32c", "comment": "Malware payload", "value": "eef3c4c615563257e9d424159e8e52f9a4bc30e4136d4a9ff88f11d9aaad88262af1f8c12db6d60e9451ad5edf323a50", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dsh-fvsrchps-cn", "colour": "#DE3429", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747389240, "uuid": "85fde79d-1b11-4fbd-b629-300d562e24f8", "value": "T1983733F110CD787CB7C47700B94845A7B7A3322A00169E7613B2677A27A6ED503A6DEF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747389240, "uuid": "6465278e-4868-4650-9619-6539db2eebda", "value": "393216:bdugkBIOhk7DQXTUHVb9/IXbmXIilfayOlY7k2bFzaYfayDObLSw+Y8ifTe5Zt2d:sgO670XTSVb9obwIpyOyFRavyDKL+wTJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747389240, "uuid": "536b3c02-e1ac-42f5-a305-e317b1e8f673", "value": 24369173, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747389240, "uuid": "cea36511-e9f0-4703-ae61-e1981dc2773f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747389240, "uuid": "a7433c41-29ad-48f7-af1c-c8c3caacc2ab", "value": "UpdateDriverSdk (2).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b802306e-3231-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RemcosRAT)", "timestamp": 1747384957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747384957, "uuid": "caea061e-ec3c-47ef-878e-f0af31e2b7b8", "comment": "Malware payload (RemcosRAT)", "value": "25608ed3093e013063007bcc36c5afdc", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747384957, "uuid": "2411c2b7-490e-4ad7-80a1-2a1652f03e86", "comment": "Malware payload (RemcosRAT)", "value": "1f7886c87d4f10651e5ffe9c068aa037d859b3f8c21a112eaf738f6bdde8fed7", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747384957, "uuid": "63808f0c-a33b-4cca-9790-f727c058ede6", "comment": "Malware payload (RemcosRAT)", "value": "2b3d5bde50cdf92726d3dd37f24d46c45fbb9dcc", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747384957, "uuid": "64fcd91f-6b7d-4cc0-b44a-74ed7a723eb7", "comment": "Malware payload (RemcosRAT)", "value": "1bfbf78f2ebb69e5054621a8d2857f1574bfc315107f8de2abff33f3026c31af38f7e33d308b9500ea978779e338438c", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747384957, "uuid": "ed2c5db3-bd74-4c9a-864b-94f209dd2b58", "value": "T1ABC1089F0F3D22E2074C43F9A95021CD31A2A77ED632E1B5D375C215A18024B397E2B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747384957, "uuid": "922be0e4-7b07-4425-af21-c257cf0ef29b", "value": "96:gFbLWSAM5/9H0TXSqal3R32FKbxJtI+oFbBZUFhxOMidbDSWoKljZXF:2R59H0rXQBmghDMbHQz4dbuWoKhZV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747384957, "uuid": "6dec7b1f-5d29-480c-8f12-f270a04522a0", "value": 6050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747384957, "uuid": "aff1d166-76ec-436a-8a9e-11121c96b4c4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747384957, "uuid": "9fcd7775-98c4-42c0-8fe3-86c175f68713", "value": "Bestellung KNAPP Smart Solutions GmbH 4500569830.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f98ce486-3272-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747412984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412984, "uuid": "759d77b1-fc1f-4888-b4dc-19010e74e36f", "comment": "Malware payload (Mirai)", "value": "f0a41751595d3375157ac4b5bfd70b1b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412984, "uuid": "290432a1-50e5-4b3e-99ae-72eefc5d7017", "comment": "Malware payload (Mirai)", "value": "1f87ff37c60f85eaa77540683dd43e01a8da02d2b3e0fec5acf11826095577c5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412984, "uuid": "6d479b9c-d8d5-4739-ba90-1fd280bc7278", "comment": "Malware payload (Mirai)", "value": "4e0d25e56c2cc7aedfed97e935caec5e32457639", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412984, "uuid": "3fbd3c51-96a7-433e-990d-1941016ac023", "comment": "Malware payload (Mirai)", "value": "df7150c534af692828cc2660f8d6890b9b54150f9db49d3e2f45372f682b2034aa38edb8fe864a7d2d5d9ae5966a24e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747412984, "uuid": "435e976f-8c64-4b3c-9021-ecc4a41c24a8", "value": "T142432925AD792E26C0D4B57A51F78714F2F2220E26B8C61E3CB21E4EFF04B4065577BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747412984, "uuid": "d60b304c-d1f4-4f8d-b967-7055ca31c616", "value": "768:TXon00+q9wp3C+vactfa1sDHHYAzsv6WswWSHoXdss63B/9JO+zC3m:TXw00+SY3CaactfI6Hvzsv6vwcGJN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747412984, "uuid": "db7864f6-0a41-4b32-926a-acdcc8a7848d", "value": 60116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747412984, "uuid": "036513e8-56cb-4119-8379-46bbcc044db5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747412984, "uuid": "9dcfb5b0-3c57-410f-9bb6-910e8d6eb726", "value": "Josho.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "880c8960-326a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747409357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747409357, "uuid": "0d4dd47a-c377-417e-8bed-f644ff041de5", "comment": "Malware payload (Mirai)", "value": "08fd5967580980fa8f74b51ba58cafe4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747409357, "uuid": "421fa51c-f11b-4ef2-88a4-886b409e15c2", "comment": "Malware payload (Mirai)", "value": "1fbc1c6f7b5ee256c77f26faf700a0516e1486c1ec6f69dcab2adb8b896a466c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747409357, "uuid": "70ae670a-c4ea-4355-a232-61dff4657d6a", "comment": "Malware payload (Mirai)", "value": "2047ca88312d789056b833c7316a20945418dd07", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747409357, "uuid": "1dbf8205-0ad0-4799-9ffd-1b93cf1b1b29", "comment": "Malware payload (Mirai)", "value": "8a59234139e09f92c0101ea15fc2bb1361dd607f28dd35b4f0d6c8d21c1b9cf8cbd3b36b32e03219be7d1f4faac795de", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747409357, "uuid": "dc22eb0b-2787-4f74-b9a8-585a745f1d63", "value": "T13C337C67D82A4D98C5194278F4688D391B13F408A2973EF65E8EC762501BDBCF60E3F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747409357, "uuid": "36b8646a-5a60-4590-bd74-1efe84ec2ce2", "value": "1536:uaok/dgBORYzVUsvbE05/EFDBiSurCei:uG1ftsvbE05/wDYSur", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747409357, "uuid": "a10a22d2-c7ee-4a61-af9d-778be3f78a55", "value": 51968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747409357, "uuid": "8fa47400-8616-4c91-ab61-77e0de9888de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747409357, "uuid": "cc4f177b-bdcf-4614-81c4-ec0dffefc86e", "value": "kwari.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35161f6a-3227-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1747380442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747380442, "uuid": "0dac45e6-097c-49ab-848e-00169b28c400", "comment": "Malware payload (Prometei)", "value": "126bc91b3e751043e819921c5793f807", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747380442, "uuid": "bcbc5db3-4f35-4515-ac19-9465dcb7729e", "comment": "Malware payload (Prometei)", "value": "1fdd4ca265a973a6a332705244da401b024f65a09bcbad44bd186cb66294bbc7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747380442, "uuid": "6d9c257a-5e6d-4b43-a814-b338e3d2c620", "comment": "Malware payload (Prometei)", "value": "38d16e9c1d3eccedcddb0e242cbf57b02f7477ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747380442, "uuid": "dd5af129-1760-4d1b-9766-6bb930c9182b", "comment": "Malware payload (Prometei)", "value": "5c7e5c94684ad1cf8b88db95b66d483c0c77978b90ad5552d30acca8b6a8c50657eb795539cb3be7fa42a059c363436f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747380442, "uuid": "c8065d31-db0f-4dad-99fc-d6d118675e9f", "value": "T18F9423F8C87D2E3098169F3CBB1A826CF0A15772D9562B6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747380442, "uuid": "e2c70d8a-954e-4123-86bd-b5b492e7c0c0", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgk:25WOSACZSV6eKRH5EPiamb4DsDwwc0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747380442, "uuid": "c7d028ca-bf30-4d10-8a61-aa12036130ec", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747380442, "uuid": "b108d040-300d-4ecb-b7d1-30c0d9b80f03", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747380442, "uuid": "eb850c2f-ca75-42ad-bcee-da35ec79254d", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9f3440a-3287-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747422004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747422004, "uuid": "4da4849a-96ea-422b-992c-f82a4d91d3a3", "comment": "Malware payload (Mirai)", "value": "f89b77b35f9d1bfdf4fae559f8f3c226", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747422004, "uuid": "89233132-34f4-4e26-a40d-c0876f61de54", "comment": "Malware payload (Mirai)", "value": "1fe4096817723623fb91648a34133554b750ed3436bdef4956becb727da1adbc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747422004, "uuid": "fcababe3-d743-4ac0-a79d-fd555ea4c21a", "comment": "Malware payload (Mirai)", "value": "c4b01974985fca6af96b6f4076a11da03d018826", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747422004, "uuid": "ff9a8367-e223-44c1-af64-25fba66f69e6", "comment": "Malware payload (Mirai)", "value": "56e49ac8e1231a6550236de5f7eaf70294a5255f75c116bbc15a541c8f1958412170b8b846651d323cb361bfe36989d6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747422004, "uuid": "9145deb7-031b-4054-8ad8-3dc59b9be8ac", "value": "T13CD2E0503993D9A3CFB06DB1EDA8DE81531520B5C69B66E99F08937CB7C00517BFB04A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747422004, "uuid": "e98b476f-c5ff-42d7-b7e7-cba36d8b2f1b", "value": "768:NoB1gLFjuVKWeuN+SGszjrHKcImyj1JcVc33Uo+4:Na1GjuVK2MhsLqSy1Jccg4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747422004, "uuid": "3095bb07-d50e-4be3-ab86-dbe523ac02e1", "value": 29492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747422004, "uuid": "f6352f4b-85e4-43a2-bb31-b5197c8f569a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747422004, "uuid": "45a3ca3f-9369-4a5a-92b7-1e7d1ef5114d", "value": "db0fa4b8db0333367e9bda3ab68b8042.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c630768f-327d-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747417622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747417622, "uuid": "c7aa4b7b-576d-47ad-89c9-a61ffc348926", "comment": "Malware payload", "value": "16d9b6b20f8c2128a6254b251ca2df37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747417622, "uuid": "a5322428-e1bb-43b3-99f9-bc91e924ebaf", "comment": "Malware payload", "value": "1fef41299172635002516d3f22cafdea0feb6bcdb0afd20dbbd2b7debc9ce650", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747417622, "uuid": "a3ea59ae-41fd-40d6-a926-80180d4da0f8", "comment": "Malware payload", "value": "e4610f277afdf46acfd6bef409b4e8a35c028da0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747417622, "uuid": "4e9afc81-68fe-4568-a422-cf662c32084f", "comment": "Malware payload", "value": "846180ed31aa499ba72eb764302c3bd092cb637488837bd7c7b14c7e1042759f7a77627f560bda721119a086a84cf16a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747417622, "uuid": "b8b541ab-2dd9-4e7b-b5ae-49c03c21d660", "value": "T111647C217A919471C66303334E28B71481BEBAA10F369A9B77D81F1DCE745C2EF36762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747417622, "uuid": "455a9c2c-cda2-4fe5-b32c-a491a42b0fea", "value": "a7e8b8f9d5657e7c8afed4875cfe61d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747417622, "uuid": "827f780e-cefb-4217-a860-3e468bc9103c", "value": "6144:tZOKdmZ/LXKuU+T9iL21B+OxO25yk94eLLsvu:tYj6u9T9iL2nO253uELX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747417622, "uuid": "6e9d58f3-1054-4cce-8c98-2fd7e6ed7dc8", "value": 320000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747417622, "uuid": "4811a93a-7ce0-4c16-81d3-0ea411d06fec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747417622, "uuid": "359eb92a-9da5-441f-aea9-442baf0f1a35", "value": "KingdomCome.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "164bbfd1-3225-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747379531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747379531, "uuid": "bfb4c6a0-c962-4dae-b43d-c853fc79119e", "comment": "Malware payload (Mirai)", "value": "98a56e212f13e44f0ac503c1236057a8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747379531, "uuid": "46bc74ad-2b5c-42ae-aef8-668d3d19bd80", "comment": "Malware payload (Mirai)", "value": "20631c303e9da859b59802b5aed19830d741d815fab13831e6a95711b3eda48d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747379531, "uuid": "599ffe72-9f8d-431a-a7b8-f72ac84c3b65", "comment": "Malware payload (Mirai)", "value": "8bf99c4feb065e94c856151c0a24ce7a32735b0f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747379531, "uuid": "3ea18215-435f-46b2-adb6-678e421ae6d5", "comment": "Malware payload (Mirai)", "value": "17c16161f21b7c5bcdfa3a635a9d1280b0f351970c36ff039874b00c03a02a8a941f344d9aa997c43f60ad6b2a8a2659", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747379531, "uuid": "44c74c97-4cf9-4228-856f-337dbf1dea5e", "value": "T151E2E1B4E0275DCDEDE395F42699CBB3F7662B12A1158AD0A4C78AA29C279331350FC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747379531, "uuid": "59aee8ab-f8dc-4c1f-9b3e-166009c463cf", "value": "768:I0gM+rd9EJmvxaBibpxisqNr9Jlpq0Vsli94uVcqgw09n:bzid9mcxJZ+nltci94u+qgw09n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747379531, "uuid": "924c8239-fc0b-47bd-960a-adfb3c2764eb", "value": 32200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747379531, "uuid": "c0e61d07-d5ea-4dff-9b68-22e0c596f2f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747379531, "uuid": "87614e85-1812-4b29-89b4-a1341603b5c4", "value": "neon.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c77ef784-324b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (SSHdKit)", "timestamp": 1747396149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747396149, "uuid": "1b5bf72b-3a09-4160-832b-e4941321e178", "comment": "Malware payload (SSHdKit)", "value": "2410a93874b96152556276efdc02a108", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747396149, "uuid": "f5d50c61-3a88-4d94-8947-7c4b412844b1", "comment": "Malware payload (SSHdKit)", "value": "209b640000fa5f042ff35b6442e2da6c44be360a178be37fadf6acc07600c7cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747396149, "uuid": "92a5f868-b289-419e-be9f-3a01a5c0db7f", "comment": "Malware payload (SSHdKit)", "value": "a2f665256d2eb3a69bfa4c9fe6a32731a96db047", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747396149, "uuid": "0c5855e2-d620-4712-83c8-0b52e4f4b221", "comment": "Malware payload (SSHdKit)", "value": "ddbdc1491d95c796591b12f837502c38819be217e42cfa2b062fc8dc0b1b097267265ce9f5b4e0b41665cf189fea75ac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747396149, "uuid": "d3b8fc54-f1c2-4bcb-8448-377bb9b30907", "value": "T118356D56F9808EA2C5D8177BF75D835833134B78D7DEB102CD08672877AB95A0E3B982", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747396149, "uuid": "ac85dc4a-b1f5-406d-b8dd-0764b86a56b9", "value": "12288:E8dASOYRNCAJump208iJftl7zmnSrlcaUxQ5TVFQGl9eLtRajZa6RTxIVD7bLv:E8dbbsO38+TfgRifIVvv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747396149, "uuid": "e11d9235-842b-4885-9c7c-5f5e2293f277", "value": 1110304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747396149, "uuid": "bb995c88-a46b-469c-946c-0f944de13b91", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747396149, "uuid": "8287e662-875f-4d34-81e6-579df1ef4d52", "value": "sshd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f7d82a8-3213-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747372031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747372031, "uuid": "6e23845d-64af-4804-a44b-2118c1d56ed8", "comment": "Malware payload", "value": "3a6640470eac92f86497b5cada63fa9d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747372031, "uuid": "3d0d40a1-8e21-414a-acae-cd2e4df7a6b1", "comment": "Malware payload", "value": "20e180473928ffea12f21f6e40bdd456f5bee82ae987c4c814d2d52d236617cb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747372031, "uuid": "65506eb0-52e3-446f-95ac-b06f00820a7c", "comment": "Malware payload", "value": "5a4bd56ce712bc6ffd58d9bdd776aa4c86373520", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747372031, "uuid": "3d2c0b8d-1fa5-4c73-a088-14fa167f8ab3", "comment": "Malware payload", "value": "bbf3964d4cd57decd2890af1532a39b664aa3f2e2b327c3b7c7374a61c4fc028fb88e47a1a5840fa31fe72838bb3515d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747372031, "uuid": "35cb5693-9c0f-4019-ba68-07485d6ace94", "value": "T1710633FA375B4EE4120C5B8ABB1F4090B6CCB9B96EC31B603ED9D6EE887F6401159117", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747372031, "uuid": "f3c5a665-f419-4842-88ec-3ef7a1eaf949", "value": "98304:uStAaG04DTIjLrjGBSqVprli26/IxEJSTj5DObKf7Uv:D2ag0LrjGoObxEJ0EbK4v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747372031, "uuid": "ef4af2a2-bb1a-4381-bade-7196ad6a8965", "value": 3784908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747372031, "uuid": "21a5ce4a-a48b-4b06-a547-37a84fdbf44a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747372031, "uuid": "c7e3f973-fafe-4105-8802-7c956d2d9f19", "value": "linux", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f754841e-3272-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747412980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412980, "uuid": "52b92ab6-d930-4504-8e7c-070c354d8b74", "comment": "Malware payload (Mirai)", "value": "da06d47aca7b6bf969e7ccace0ac2896", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412980, "uuid": "1fd203ef-0790-4c62-a368-2c07bcb25f7c", "comment": "Malware payload (Mirai)", "value": "21b54ececc92160559932e589e4f1838d72f1573ee0839a546378f3e53831569", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412980, "uuid": "9e82538d-9f45-4cfd-b955-38cc5f602536", "comment": "Malware payload (Mirai)", "value": "b9f126a6bda82a74a9a843463921e05035406b15", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412980, "uuid": "070c0b96-5e0c-4bf0-9585-a13cea8e6198", "comment": "Malware payload (Mirai)", "value": "445b1a92053500eec7eec0998c9c56ee1c224b3f1ad0e25d335b926cb3eef06267d1228dcb00fc2b07591644be76ffdb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747412980, "uuid": "82563f5e-5172-434f-8540-53215861e73c", "value": "T15D332942B22C094BF9E65AB0353F0FE093BFE98024E4B585695EEA458136F335586F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747412980, "uuid": "1361e2bc-31ca-4907-a673-a44884c26adb", "value": "768:/KfsbnHAt1ezbnAgCN7RkIV3fgB1TRNRR7Eg3tbv6VFssuWXwdy4q:k6HAt1ezbnAXZUBt33tbC/3XwBq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747412980, "uuid": "bf60d23d-5491-4e26-b2aa-1172aaaf8be7", "value": 51332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747412980, "uuid": "c98750d9-1298-4849-8df9-26f799fc3946", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747412980, "uuid": "25f94774-4f2a-4a4e-bd84-21eaa1346359", "value": "Josho.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d12a3dd7-32aa-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747436968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747436968, "uuid": "deb1309b-1e51-4e37-bc35-4d17798038db", "comment": "Malware payload", "value": "c3e0b4bc50bfea388a257827ecdf8e32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747436968, "uuid": "075df7a6-a702-4efb-b019-2025c01633e3", "comment": "Malware payload", "value": "21cfc0456efbfd7d450ea93e3170ccd17d8b308d39b92b2e94863116a08e4dbb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747436968, "uuid": "e30d8523-9e56-439b-a41c-7d0f250d6dc9", "comment": "Malware payload", "value": "451b70a6614735b538d3aaa11f1f827cbf77d5b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747436968, "uuid": "a7fdcbab-fa98-47ba-b394-3e8a2ca1525f", "comment": "Malware payload", "value": "e64986f9370d50a4f1df5826f8d80baa49622b1fa0b831a5613a48e0637c0b833c164e0692025dd6d6aaf8ff5e96eb8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747436968, "uuid": "74b3e051-5366-47bc-9ac8-f1b0aca2dd57", "value": "T15935F120D24924EBFE6740748642A682BD677CB18B281FFF6198E7772F473C0592D7A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747436968, "uuid": "ac79d398-52c6-48aa-b94a-853584ff97f9", "value": "cc56030055f1b3ec9cc1fa678dfddfd9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747436968, "uuid": "c6a2ba72-32f1-4d59-bf81-df04d7acead0", "value": "24576:J88xQ/Sz/clrxulP7JbqbQzxiehzH15K7P7JbqbQzxiehzH15Kwt:J88xQ/SzWrkNJb0QzweZV5eJb0QzweZt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747436968, "uuid": "4f337387-bf07-4afc-b542-9b4e250e2a9b", "value": 1079336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747436968, "uuid": "b3bf2226-21d8-47b5-b0bf-72fc4a95305a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747436968, "uuid": "cb54d6f6-b292-4220-be8a-5bdd4d64e388", "value": "Galaxy Swapper v2.0.3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cdc668a-3226-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747380133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747380133, "uuid": "3c0d040e-69a5-441c-b807-2e380b438da1", "comment": "Malware payload (Mirai)", "value": "dc846f072770b8b41d52089ef15f8c19", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747380133, "uuid": "6c891f22-6f75-468e-8de2-273947ed227d", "comment": "Malware payload (Mirai)", "value": "21d7e0768f1bb6b67e0f542fabad827d4941ffb629bb475c474414801afd7153", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747380133, "uuid": "f0f3881e-bf72-4b7e-91b4-d0e4ab279411", "comment": "Malware payload (Mirai)", "value": "e4d8ff6a302bfa5bb5a24e5c2e988c90d5e1f522", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747380133, "uuid": "c33422f9-18af-4a0d-b554-27968a09381a", "comment": "Malware payload (Mirai)", "value": "f1c06cf2fbe784a808b21c1d63612a700f27e8b4e583cc011e575d97bb15a1b5fc034d75e3c89a444db5fda8df0532e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747380133, "uuid": "7d8e0a43-c580-4e1f-ab4b-bf37d8fc0e9a", "value": "T192F39C36C8257F68C2A1E234B0759F792B5395A492435FBE25B7C2718043DCDFA09BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747380133, "uuid": "addd9dbe-3dfe-466d-9f1c-3be786dc1cbf", "value": "3072:OyOje7InWIDBXsrDq0Zdm61/hvzaQ6We8k3u2y:OyiKINDBXsr9Zdm6Xvneru2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747380133, "uuid": "edb9da52-1e25-4b5d-8559-ff8edf118bbe", "value": 161056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747380133, "uuid": "07c4f827-af9e-438a-a74d-f1cf96ddc69d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747380133, "uuid": "0152d1a0-bba4-4a5e-9e70-b1e1a9409d21", "value": "neon.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bd4a24c-31fc-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747362146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747362146, "uuid": "0b205adf-70d8-4a43-b3c8-0d22dbfb9514", "comment": "Malware payload (Mirai)", "value": "e156516ca222ce3a698ce215f5aa79f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747362146, "uuid": "245025c7-9f70-4058-ad80-18c8de724f2a", "comment": "Malware payload (Mirai)", "value": "21e3a1bfbeb06a429abc82bf594207d1dd30c789029c7115c5e7c640e623bcde", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747362146, "uuid": "44478217-8d21-444c-8f6a-d2ff39be9282", "comment": "Malware payload (Mirai)", "value": "b0ea6787067aeecb224d4b9ae6492c229c9e5a0a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747362146, "uuid": "529e6711-3f03-4116-95cb-b6eb35ff90b2", "comment": "Malware payload (Mirai)", "value": "0f379b14f569ae0da305c503a7a43b11d9a1f689866470dec88ba845bc77d0effa2e4a2b9ee1d6daaf8e5742640512b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747362146, "uuid": "fde1e059-4038-4837-b944-7f583a0ecdac", "value": "T11D732ACBF800D97DF80FD77B4453490AB931E3D126931B277767B9A7AC720A54826E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747362146, "uuid": "62858c96-7a6c-42e3-9b3c-2204fce778e7", "value": "1536:sEXV6KJW0YvOTHxldZzGD/o8I6O32IXwDjeJFvvRF+NodXGQdi:sEXVP9fZSD/CvTwXefyodXldi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747362146, "uuid": "f6c1b5a0-7cc9-43e7-a214-82e30c82cb21", "value": 76508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747362146, "uuid": "e82ba4e5-93e3-456f-a906-71b13085503e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747362146, "uuid": "dffd24e1-2c67-4d0e-b916-975dbc9a300e", "value": "neon.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f27c02ac-325e-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747404382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747404382, "uuid": "0e8087c6-3282-48ea-91de-c9e5e7019891", "comment": "Malware payload", "value": "963582b454fb900974f77da12b084323", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747404382, "uuid": "2f948f2f-dc0d-45a4-970f-19f5f2172f12", "comment": "Malware payload", "value": "22af72d3393a6b965b0ec24cb2ee580d7028b0829010ddb76b678dcc5fcb1983", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747404382, "uuid": "be43e2e7-d263-43c0-96ce-7844ef7d4958", "comment": "Malware payload", "value": "e3109a286ed339ed15220353d93ca9d4f8d0b7b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747404382, "uuid": "ac3b058d-8732-4a45-b02d-d88ecd852d2e", "comment": "Malware payload", "value": "3d7bed3b79cad189c3cca8394d53044657785f9966fe4769af05b11d571faefd621f6d5741eb0b54bcfbc8dee4b60170", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747404382, "uuid": "e84dfc9a-7b66-4610-98c9-cd76c950594f", "value": "T1EBA52342F6C648B1E17228326B7867216A7CBD305F758EDF67D03A1DE9605C0EB20B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747404382, "uuid": "b637c7db-3121-4625-8647-932147ea2873", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747404382, "uuid": "850ef29d-9a29-491e-9c45-7d148aa6b40a", "value": "49152:IBJpTpc8iYMljoCIrtufFEUPtPSfdjh/SXjlG:yHTFMlFIQDP4fdj4Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747404382, "uuid": "941e3aba-5241-4806-8b97-0501cc3a594f", "value": 2230224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747404382, "uuid": "c465dac8-f1c9-4ee1-a5a7-a87b48e08168", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747404382, "uuid": "64a6e3cf-51c0-45ff-a3f5-ebadefbb8f46", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b72af86-3264-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747406652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747406652, "uuid": "29698313-d939-46b2-b148-81db1abd74f9", "comment": "Malware payload (Mirai)", "value": "ba030d3c2897b10949b00cf6974ade8a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747406652, "uuid": "f599b890-2802-4390-8b16-4d7a44bd4d81", "comment": "Malware payload (Mirai)", "value": "22db7bc0e2da6d6b053d2ac3814ad90123a90ca3aec7c4fb33dc5133a74816cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747406652, "uuid": "aed2f74b-6db9-4eb0-8273-dbde80f1745e", "comment": "Malware payload (Mirai)", "value": "6a4d28c2c1d4491217045546dc2675d305e1606d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747406652, "uuid": "78851dde-1b05-42a1-bdce-c11eb9c84f1d", "comment": "Malware payload (Mirai)", "value": "787251f8ad8979b1fba25e59f95691b630176726fc9203fa0f980506cca1003a143afb88af1052bd940e8e75827ae163", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747406652, "uuid": "86b5a5ec-0370-4238-997b-bdd76822b726", "value": "T1A5F2E04DE1E966BBCCCDD8BADA4C3BB44C51A24032FF4D4983798C8C1B25567A678C29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747406652, "uuid": "5eb0287a-31dc-48d2-bd45-d87b4d6b32ce", "value": "768:l2LQ1lC7VfGLkjbkmtPH2Bwa+m6h7uW5vzWv:l2Q1lKELCNtPHDFDh7ZlW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747406652, "uuid": "ef98bd58-1a4a-4063-9075-ce82113bd442", "value": 36700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747406652, "uuid": "fa1e32c4-d7d6-48c9-894b-089eea9e7f67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747406652, "uuid": "a568cdeb-45d8-4562-a8e8-10935a086c2c", "value": "neon.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d534d9ce-3228-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747381140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381140, "uuid": "25e45e9b-0446-4a4e-a16d-ab39e14909f0", "comment": "Malware payload (Mirai)", "value": "d5e88f80d96aeb3126d33f66804722f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381140, "uuid": "2c701380-c0cc-42ba-96b6-523145ddfa82", "comment": "Malware payload (Mirai)", "value": "22f510a7475c8c488c66c952d3cd85c5f9497df349ca6a68870471eba6035c1e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381140, "uuid": "7decca73-e55f-44aa-8605-6b31698300c2", "comment": "Malware payload (Mirai)", "value": "fa246ba98215ace62854564a910860ecebdaf20c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381140, "uuid": "1fce868c-296e-4ea9-a228-6e27c5cff968", "comment": "Malware payload (Mirai)", "value": "c89b20084975d55f0a0e2de2e75d31dca7602f61013b477cfe35351000fd9b8f3ee8617c35eeb026311234ed3a2874fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381140, "uuid": "ba3a2b1d-2a40-4ad9-9bc1-4a390c98a0b1", "value": "T14FB2E1B1A1823E72D770713A797CCA0057AB57F8A0BA72753524B6AC4BD2C4B64B414F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381140, "uuid": "530f16e7-ee7d-4c98-a4dc-82af2a46d972", "value": "384:vZUX11S49enZh57fYONQ/yQVQbFxD+ckPvDxqSwPzMvdTWhymdGUop5hKb:yX1De9kONQG5xD+jHMDzuys3UozYb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747381140, "uuid": "3b89f6eb-5780-4e10-8f39-6e9556a28692", "value": 23732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747381140, "uuid": "76ad9750-43d6-47e3-a780-86549d3813e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381140, "uuid": "e17465d5-ebc2-4f67-8fd7-83c122061167", "value": "sora.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf9d34fc-3228-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747381131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381131, "uuid": "3f1b792e-5f8f-4e33-b02c-e38eae2da2bf", "comment": "Malware payload (Mirai)", "value": "590a46a88184a6f3f04df0941f3f1da7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381131, "uuid": "3fb49a80-88c8-4642-8b09-3f8a75761d29", "comment": "Malware payload (Mirai)", "value": "22f6c882e7d3936f01652ff483aa0e2c1fcc8119d26685bd420000f61591fd48", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381131, "uuid": "7fc98a15-fcd7-4d56-a979-a49bf3d04b0f", "comment": "Malware payload (Mirai)", "value": "c79b4c2c13608f22f275c474983433d906f534c3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381131, "uuid": "0b5991b7-4cb2-4e14-b513-4516b136b949", "comment": "Malware payload (Mirai)", "value": "e415e7c1ed69cd082dfed475a2c25f1817fc0e96edaa45e599d4847b729815d274b6a13fbbfdb47640c45f96a63e7986", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381131, "uuid": "eaa6ac8d-e748-4f51-a815-01a6f597fdd4", "value": "T1E843F001CBD6610CC589D874C9EADC7B9890E6CD809EA5DF6AC170BFEE5C7292B35902", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381131, "uuid": "05393381-eaf3-453d-99f4-1f54c38d29f7", "value": "1536:5vKZiDg1MxmEtH0VY4EHcDA6sXRnWRFTx9YD2MrCgyPmnouy8ty8:siE+xmEtmYXLBWRFTx9YZboutd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747381131, "uuid": "52a559a8-a1f4-4152-9590-4efc9dfff344", "value": 60440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747381131, "uuid": "ecaee03e-b1c9-41d4-804b-15ff799c6a38", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381131, "uuid": "fe45a21d-8a38-4ebf-94ca-d6750af5e43f", "value": "boatnet.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faa4ab22-3272-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1747412986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412986, "uuid": "d1b66e3e-df2b-4f9d-82b1-f53e6995c837", "comment": "Malware payload (Gafgyt)", "value": "47482170723de952f1c36c103100f67f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412986, "uuid": "85179dbf-8ab5-497f-9b80-2deeac1f2624", "comment": "Malware payload (Gafgyt)", "value": "23ad9d63c8950df4fc4bded78921ff5ac03c7984181da4e2cb60c2011592c5dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412986, "uuid": "5228968a-5f22-4436-b6ac-d7e84a1d3646", "comment": "Malware payload (Gafgyt)", "value": "e4071fc07636419a44bcf84e84daed837c527cfb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412986, "uuid": "11582fa2-7f4b-479f-a3e0-2a8466354f13", "comment": "Malware payload (Gafgyt)", "value": "5c13803e08e802ef6ea1828d40e1857e021a721da90068a2ee9a32aaf864127b495992564f8fae5cc094ca9f40963b15", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747412986, "uuid": "4f46a90c-a0b6-4491-a8cc-6cb9147a3bb6", "value": "T14B14191654B20E77D85B5F7A2D76A5A0039EEE901F4F0E8FA1A9B5B0461BCCCF00E634", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747412986, "uuid": "af66ec43-4495-4b08-8069-0cd26b150df0", "value": "6144:Xr8Kv8dBU0laVBdFrP25mvWq+H/CpGr1Pis+ss:Xrxkb9aVlrPWmvWq+H/CpGr1Pis+ss", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747412986, "uuid": "219cc13e-1532-4ff7-97c2-20860e7459c5", "value": 197657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747412986, "uuid": "87481d1c-cfb6-4338-91ae-01c34a61517b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747412986, "uuid": "ded98695-7d8e-4e1c-a76c-a53dd6770e81", "value": "jackmysh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86dcb1c9-325d-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747403772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403772, "uuid": "334dfe96-f3de-4d0c-bf5b-8103af58e9fe", "comment": "Malware payload", "value": "e38127746cbfbf2fb0d992686e49aec1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403772, "uuid": "055fcbc3-a7fc-470d-a02c-6519af69d0be", "comment": "Malware payload", "value": "2418ea352e018621e209bd71cdb44963724ef960ed251ba4dda89c4bb18ec1b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403772, "uuid": "771e044c-70e9-440b-a920-22bd08f9c27e", "comment": "Malware payload", "value": "a5eadf55c636d663c9c98297c1bbbd6edfc9855f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403772, "uuid": "7dc304e3-6b21-456c-a737-a643231edf05", "comment": "Malware payload", "value": "d7e3f1b0303afe7caddfb055ab0706665f7d14c617f54c70fb08b3c4af97f10b90ecae96108707d0ce4bd580574db8a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403772, "uuid": "4d65ece4-1592-4612-9cf7-7bd39eb1f9ec", "value": "T197A52342F6C648B1E17228326B7867216A7CBD305F758EDF67D03A1DE9605C0EB20B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403772, "uuid": "b3a5a7a8-713e-44ce-a460-1e6e530ad9ad", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403772, "uuid": "c010e3f4-717a-484a-b111-11fc1db21ad4", "value": "49152:IBJ3Tpc8iYMljoCIrtufFEUPtPSfdjh/SXjlW:yBTFMlFIQDP4fdj4E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747403772, "uuid": "0d11ac62-9d28-4044-9385-9afdcc3d9b18", "value": 2230224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747403772, "uuid": "9d296dbf-bbbf-4ae1-8a13-fa8700eeabdf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403772, "uuid": "5585af55-2e73-4c1e-9b74-8ffbc2cf6854", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b6d82e5-324f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747397686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747397686, "uuid": "2ed69164-d7f5-4ec9-9cda-49ba56f5398d", "comment": "Malware payload (Mirai)", "value": "0678838658597dcafc98b2c6ffeaf710", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747397686, "uuid": "f3a0b192-61f5-48ea-91f1-d2ac5264a864", "comment": "Malware payload (Mirai)", "value": "2476c739e6c4b358f314971de1b01a3082dbc57bd44bb3508ffb14c933475a6a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747397686, "uuid": "cc49c69f-47cb-461f-8835-95de64c93857", "comment": "Malware payload (Mirai)", "value": "ee9a80a87d59b46c6e7cafe32f0a157cf423561b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747397686, "uuid": "531cf844-4c0a-41dd-b259-8aa51cfdfdd2", "comment": "Malware payload (Mirai)", "value": "30b25c5627f8a4a58cad73d2330f0b50d02f0a35976555a85fbc9825c91e8f97438417b8abbf215681ea2b5985ddea0d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747397686, "uuid": "54b71e2b-d602-4cc5-8e1b-25491cb32744", "value": "T1A7A32981BC816A2AC2D4237BFAAF158D3310A7E8D1DB3217CC550F64BAC991F0D66F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747397686, "uuid": "a01f62e0-75a4-4b82-a8dc-a20c2f4357b8", "value": "1536:2aSjdlBbXzUPcv+QvbEGLt0yCquJYGduXzS3m49FjMAIQZhWJ5n38DRt5Q:2aSjdldzUu+QDZLMj145sNt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747397686, "uuid": "e79b0460-150c-4973-8311-9de5d3b8d1aa", "value": 99568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747397686, "uuid": "bd4d8863-390e-4dd3-9954-af51e4b49237", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747397686, "uuid": "d594c29c-d05f-4424-853f-86c7df2fd9c9", "value": "Tsun.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d3360ec-3236-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747386817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386817, "uuid": "db34a7d9-3926-4a09-8064-6e94a7e5c24a", "comment": "Malware payload (Mirai)", "value": "49bf0e37b08a1f33df8ba9616b600c62", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386817, "uuid": "97682d54-17e7-48d3-b93d-4039df58bd8c", "comment": "Malware payload (Mirai)", "value": "24b4361da2d65434a46d37b6c8f7f748795a733d29c936bb5315e670d82ab36c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386817, "uuid": "fabf0793-1b97-4431-b312-edcc2a7b0d3e", "comment": "Malware payload (Mirai)", "value": "4ed44f01f585e83e78fab3f00ac7be1385c2a6e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386817, "uuid": "d3ff60dc-9d9c-417f-a262-1201df730e09", "comment": "Malware payload (Mirai)", "value": "c2ff4819f6092cd5d43c046563d8700ff3dce10260feefc95ac2436efcd3b761090e9ce97c325b91095c1416565463e9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386817, "uuid": "ca07703a-4438-42d6-8a87-d3b0bfa9914c", "value": "T118B3AEEBB35B6151C86047F807D34BEC3B2731426E2BA9E37D2D24B94C759CA190B396", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386817, "uuid": "5aec2b48-0aec-4e40-bfb2-81d47a74de80", "value": "3072:ocqaT2ZuNJuFZT82EMN2TpdBlphh2XpmueAVJ5WSgRDq:oUpgmb64Dq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747386817, "uuid": "235446f6-0b2c-4539-a4ce-fa569f7cd3e5", "value": 115996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747386817, "uuid": "389542ee-2cb1-4157-bb1b-9643fc0b78d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386817, "uuid": "05e05036-1ebe-4985-93ca-cedcff54c330", "value": "Mozi.Arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "478c377a-3244-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1747392928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747392928, "uuid": "a687a9dd-7306-4706-8c30-e2e4de291070", "comment": "Malware payload (Gafgyt)", "value": "eab0b3c47cac96457c12ef81e7ded343", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747392928, "uuid": "6cb92696-30c6-442f-b0b8-d8c1c60f1900", "comment": "Malware payload (Gafgyt)", "value": "25097c9d646d45da14a97d03d8a2dfbecad9044844e883dec19faa2a4d33a9dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747392928, "uuid": "33e426ae-2378-47d2-9946-116df5cfbdaa", "comment": "Malware payload (Gafgyt)", "value": "0958a36e20cd395b971ded3f2be353f4aee149e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747392928, "uuid": "da0fa2b8-52ee-43a3-9408-49bfbdb718c6", "comment": "Malware payload (Gafgyt)", "value": "20a04b944824fcd5275d2b308f22b4de6631bcdb8fd3fecfe845525a166a788afa15ff2d6c9e765a1af3362e0048905b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747392928, "uuid": "903b0e42-5d3b-4314-8620-20a7c74189f6", "value": "T124E34905D7408B57C1E2277AEBDB424933339B54A3D733099A38ABF43FC27995E26116", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747392928, "uuid": "7057fa02-5341-4c26-a955-11a57a03d090", "value": "3072:ut8iFDKEfFN+Fa+1sWoh7n1erM/9pUMbmQwfCMQiGW:s8iFDLf/+FaNBh7nsrM/9p5mQwfCDiGW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747392928, "uuid": "e7ef5c73-24b4-4a76-9416-cbdaafc0ad27", "value": 150049, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747392928, "uuid": "33854cbe-6e6a-4d5d-85fc-b656c3731bd2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747392928, "uuid": "8cccec38-19a9-4be2-b2db-11f60db4e79c", "value": "rebirth.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e22833d6-322f-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747384168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747384168, "uuid": "8a54af97-3e35-4835-ab81-668e91418851", "comment": "Malware payload", "value": "984f4bd2fb821583a9af79a26d091d56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747384168, "uuid": "a49e41a5-5b4b-4ed6-b579-f73bbb9b0100", "comment": "Malware payload", "value": "25171039cb6453f0bec289800c09858baf1d496bad4647ad0dd1984b97e3792e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747384168, "uuid": "32b1d2c5-e4d8-43d8-868e-8804dc3a8c0e", "comment": "Malware payload", "value": "a374a7a3e4faf1ee5fa15ef10430866821e62383", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747384168, "uuid": "f4364339-2362-49fc-a43f-7505f136c1fb", "comment": "Malware payload", "value": "3a172df4b07904061ddabb443ae7bd7b232d2d5edbf2311316c056acfcc35261129b388b77663aa74a5d69c40c101243", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747384168, "uuid": "70ff79a3-1957-4ce2-8c17-c63b303ae3b0", "value": "T109D2E09023FE9BE5F1FF13B5555B48302668B8E5CBE9C36A0F5052B83800094DEB63B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747384168, "uuid": "213abbbe-33ba-4467-a3bd-5b5273e00b91", "value": "4b2df774f65211b4962a056c4da67248", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747384168, "uuid": "bfe696ea-3fec-4f85-9698-bea4bd8bda5c", "value": "768:FIRWpszd/rGZ2aWmj0tpGkAp9zsg+ll+nXGQlEssMm:OWOe2aCtskcsX8XG4Emm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747384168, "uuid": "ff9468d0-706e-4340-844a-de4586618b3c", "value": 29696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747384168, "uuid": "74afa595-5b66-4af4-ae09-5f4fbe7dad7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747384168, "uuid": "513d7f96-bb81-415c-a5ea-73d1f828fe22", "value": "SecuriteInfo.com.Win64.Evo-gen.13832.15729", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "053fca8d-325a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AsyncRAT)", "timestamp": 1747402266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747402266, "uuid": "20ea90f9-f4b3-4a0e-aab9-efa20424f1f8", "comment": "Malware payload (AsyncRAT)", "value": "8d0910afbff82b148d4c2dba825ab5c1", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747402266, "uuid": "e3a98325-1857-4ed8-8b6e-3e10ed1168a9", "comment": "Malware payload (AsyncRAT)", "value": "252d5b8ebf7ccf2d8221ae09bbbcefce90c3c2b384f5fc57bebfe11298d181f4", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747402266, "uuid": "e9feba2a-400f-48f3-a941-8eaf4f8a8a9b", "comment": "Malware payload (AsyncRAT)", "value": "bfb199551172d881d6b17585df8e15899e068363", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747402266, "uuid": "4da8dadb-4dc4-4c3f-a9cd-32617e6c4c79", "comment": "Malware payload (AsyncRAT)", "value": "85197d7fb7dedb0cb9104717e7046aee79b0b47c6168d375b88b64824f9edc50890bd1417146af9ca7d95b919e401f55", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747402266, "uuid": "57191525-8ad0-491d-9a29-e2c1747b0d1d", "value": "T160F26D083BE4822AC9FF2BFA6973E6020371E5075A13EB4E5CC4456A6F37B8149457D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747402266, "uuid": "dea8735d-91f3-41d1-aa1f-a18deceb6396", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747402266, "uuid": "9cd5c15e-6312-456e-a932-7237b7a36a30", "value": "768:bmKQNgx0n6sr1R508SbvCyzC+5WDWVFq9JcWOMhiulG:bqFnXEZdeHDGFq9JpOMQ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747402266, "uuid": "54022ef6-e54d-4beb-af73-544fb854f366", "value": 36352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747402266, "uuid": "7e39982f-d93d-44e3-aff4-6b3c6078671a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747402266, "uuid": "b0615147-fa63-4d25-8103-c71f7603011b", "value": "1747402264fcf2f797eb6a40eb0fcb91171ce124cf1e68eac4ee6f537b2993fdf515b094ed665.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbbb1abb-3228-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747381097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381097, "uuid": "2e8ffcea-f49a-4538-8c5f-d943002c2696", "comment": "Malware payload (Mirai)", "value": "42d729caf56b17015a658b88f2c9c85a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381097, "uuid": "95dde4a5-0b85-4870-a7e9-15920bbd6463", "comment": "Malware payload (Mirai)", "value": "2568fcb80e3ad6a7b7f81d4aa46d996630883ee4489182af86be67d8872b4d47", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381097, "uuid": "853dcdc2-550d-4898-9a1e-63b2c675350e", "comment": "Malware payload (Mirai)", "value": "f0ef26c52b35a66d65183904fc4a67bac2de9023", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381097, "uuid": "ddc19db7-72ee-45ad-9c7a-34bb3a02405b", "comment": "Malware payload (Mirai)", "value": "d1d12f9e627b895f9c7660a4b314bc1f95704efb558c1e4b98d1ab5f18efaf4d7786f228d7e2d93f72677ffd14df0158", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381097, "uuid": "4d6c82a0-ee50-4d58-b7f7-051aa9f33649", "value": "T1CFE30B46F8814B12D5D111BAFE1E128E37131BB8E2DE73029D246F647B8A97F0E3B915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381097, "uuid": "b1126f7b-edba-427d-ae0e-e76380e98024", "value": "3072:DHea4CHoUjnwJIXMb6Azz1az/AWdYV8P4KLJ:zePCHoQ6IXufzhakr8P4KLJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747381097, "uuid": "10d5f13e-f274-40ab-8f18-4ec830d8818c", "value": 144156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747381097, "uuid": "abf3e0d6-b19e-4799-8703-eaf685f2a1c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381097, "uuid": "6201da45-4937-4bbd-a7db-da191d121936", "value": "main_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17168c23-3251-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747398430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747398430, "uuid": "2b0a4ab7-a977-45d8-8849-590701c8cfcc", "comment": "Malware payload", "value": "31c4d7f2426c472d06187f92fa239932", "object_relation": "md5", "Tag": [ { "name": "1po56mdxc-localto-net", "colour": "#E5C76C", "exportable": true, "hide_tag": false }, { "name": "AgidCert", "colour": "#56D604", "exportable": true, "hide_tag": false }, { "name": "InvoiceXpress-zip", "colour": "#B98988", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747398430, "uuid": "4cbbed26-70c6-4578-b1cd-73a09935cd1a", "comment": "Malware payload", "value": "257c918b25bca5ada14f5022e488899087333e3c4dcc96a4326642d123526a35", "object_relation": "sha256", "Tag": [ { "name": "1po56mdxc-localto-net", "colour": "#E5C76C", "exportable": true, "hide_tag": false }, { "name": "AgidCert", "colour": "#56D604", "exportable": true, "hide_tag": false }, { "name": "InvoiceXpress-zip", "colour": "#B98988", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747398430, "uuid": "833ae6fa-bf93-481c-842d-2a6d24c641cd", "comment": "Malware payload", "value": "180bfbb1ca505dd3785c3f60b3bf1bc2d7bb4fc2", "object_relation": "sha1", "Tag": [ { "name": "1po56mdxc-localto-net", "colour": "#E5C76C", "exportable": true, "hide_tag": false }, { "name": "AgidCert", "colour": "#56D604", "exportable": true, "hide_tag": false }, { "name": "InvoiceXpress-zip", "colour": "#B98988", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747398430, "uuid": "f62bddf4-e03a-4286-88d3-1564c5da504a", "comment": "Malware payload", "value": "1626c617c09ac9a9c3624e51d44ce4c45b477350613c7e3a66b750da97b7bd9e12de9eec0c4b7d96d841f8cb7ea6df38", "object_relation": "sha3-384", "Tag": [ { "name": "1po56mdxc-localto-net", "colour": "#E5C76C", "exportable": true, "hide_tag": false }, { "name": "AgidCert", "colour": "#56D604", "exportable": true, "hide_tag": false }, { "name": "InvoiceXpress-zip", "colour": "#B98988", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747398430, "uuid": "bc5c6ba4-929a-404f-a0f4-2c9b6739952a", "value": "T177460137AEDBC568DA678CB791C2C282742E1568BC4B907F03E45D858B64C8F0752FE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747398430, "uuid": "c30ab758-26d9-4390-8967-07d3b3c10396", "value": "98304:ZraG2ElJPpEZ+gNs3YfJlcun/67yswnlqDgIsBwvglvMhaJ6WIlcncltRiPhtlNp:JaG2GE0Ks3YfJSun/67ys8PIswvWX6JW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747398430, "uuid": "e46b551b-7297-44ca-916d-650469639a4e", "value": 5582774, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747398430, "uuid": "2c3b5f39-465c-4b42-8704-6fa85c24ed7f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747398430, "uuid": "fb3d220a-9fcc-4e97-8528-3e06ff221757", "value": "InvoiceXpress (2).jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abe5e7f6-3228-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747381071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381071, "uuid": "9b77f69d-a67e-47b9-a555-3ce81fe3f70e", "comment": "Malware payload (Mirai)", "value": "ce3ea3858f3be0f42c2dd44ab5c055ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381071, "uuid": "d1bf581d-a2bb-48db-aa38-5516b141261b", "comment": "Malware payload (Mirai)", "value": "25ee8136b95d768c2e9b940d63b9302734bfc2e4580b4f9cab1ab8efcf5f724b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381071, "uuid": "849e97a2-d62f-49c4-8ecc-6ee955e4a066", "comment": "Malware payload (Mirai)", "value": "745e242edc6b6878b4a3e20307ef9776d96413ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381071, "uuid": "362437b3-74dc-463f-9069-6b03873483fc", "comment": "Malware payload (Mirai)", "value": "59b707a949566cae688cf0de637a66375ec869058f0c494be63a83753926888a2dffed7685f5651babed493c248e5b15", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381071, "uuid": "5dba5a97-f3d8-42e0-b2a6-2d77b984c3c7", "value": "T14F04B719AB510FBBDCAFDD3702E90B0139CC955B22A93B363674D528F54E50B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381071, "uuid": "0446559e-7ff7-4b71-a920-ad63e61633f0", "value": "3072:nKpzGjeNkSfcQqmav8SqaRVlnYz65lVt:nKYjeNYQqmeqavlg65l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747381071, "uuid": "a8d97ecd-0445-4716-bbc9-5efa45079e64", "value": 177760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747381071, "uuid": "aaf750c9-98ab-4c37-9325-cf51295d0b5d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381071, "uuid": "9a8e41c1-ab0a-484f-b979-82e0cff23d0d", "value": "main_mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c33fceea-3228-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747381110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381110, "uuid": "51851caf-6565-44ba-9164-9ebd3a669fe7", "comment": "Malware payload (Mirai)", "value": "a227268f9f79c88f46890422219a7c8f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381110, "uuid": "a0517aff-575b-4d79-a0f2-681bc9a48ca5", "comment": "Malware payload (Mirai)", "value": "26bb82e5b22c1cbfa8ee5820b45bdda80869b6ca6a1ef5a1910203f8a2cbae1c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381110, "uuid": "0ff4aa8d-233d-4711-94aa-bd08055917ca", "comment": "Malware payload (Mirai)", "value": "d3d431ed3c9215633f78cd4d508baa0a8c9ab206", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381110, "uuid": "d1040bdb-bec8-4c38-91d1-5d5715c98521", "comment": "Malware payload (Mirai)", "value": "bc4379198689eef2629f8238f7bca390e9ced3cd03d488ec0013c507b87c96d5cfb02dc2400d57a3f245eb20330b295a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381110, "uuid": "6e1eed86-20ba-41ef-b277-c69a91f811c9", "value": "T1D0D2F139BA1704B256A13E37DEFC034427E80B7694D9352669084C34DFE58C64DBEB97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381110, "uuid": "f5054068-142c-48b3-81e4-055a618e7470", "value": "768:kZ43GNvMzLp9Pd1DOstPUrmHlK3+DlV+YJ9q3UELW2t:kZ3FMzdzKv+ZVYLp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747381110, "uuid": "39892cbd-50ff-484e-a158-5579a0c74bf8", "value": 29164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747381110, "uuid": "69da1d66-f9ee-4228-bb39-47863e3a5e10", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381110, "uuid": "22285c9e-b611-4c13-8f5f-c6466333d3ea", "value": "kwari.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f560d67e-3256-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AgentTesla)", "timestamp": 1747400951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747400951, "uuid": "055e1911-9c8c-4e29-a99f-953047508194", "comment": "Malware payload (AgentTesla)", "value": "e532e1d42f611d172b9b752ea92b7110", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747400951, "uuid": "2dc5cede-a6bf-44a9-87aa-751c39201978", "comment": "Malware payload (AgentTesla)", "value": "2712b0ded9f7c020d89e79c93f5e8b9fc9058fc1eabe9ac801c166ea007fe2dd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747400951, "uuid": "8dc7e321-74f8-4c09-8151-390e7037dac5", "comment": "Malware payload (AgentTesla)", "value": "752f979ee4a3c98164244e15fd15f99262878b16", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747400951, "uuid": "5ac8b26a-cb4a-431a-8f3b-1a24d0de5a25", "comment": "Malware payload (AgentTesla)", "value": "00bce9f7349765492ef1fe3b710717660438b8e9c92d5934d367ed97fc53450c2b1ab4c18b7625e57dcb614794e4a279", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747400951, "uuid": "9c0b00fa-7d37-4a72-9f6c-78650fbadbb9", "value": "T1C265915DA0709E916424FDB4F951BB938CD917851A378E410FD1B1AA2316883FFAF3B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747400951, "uuid": "e929c456-c7ae-430c-920f-67cfc1d77d63", "value": "24576:fg7PMxeOjCVj4o64WsYHc8hr031BTQqrCnO/s:9zHc1BC/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747400951, "uuid": "b4a76f98-0f1d-4c0c-ab43-dcf5248f9760", "value": 1485208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747400951, "uuid": "8d109743-7dd6-4ede-9803-572151d7bba5", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747400951, "uuid": "a20359f0-4527-4ec3-8c66-c765cb08aeaa", "value": "DHL64742025PDF.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e983685-326e-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747410952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747410952, "uuid": "0fcf3b55-faaf-458f-8d24-a4049e56d986", "comment": "Malware payload", "value": "c40cc4edbc2e9cca6e76ebf4b395a55e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747410952, "uuid": "b6fdfab8-7454-410f-a46b-c7956174402b", "comment": "Malware payload", "value": "27f12aba29935f8a06182f8e7d7263dc7d01280fc2a1cc70aafecb2c87079be9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747410952, "uuid": "3c2fa2c4-4d09-4383-82ee-7a60414835b4", "comment": "Malware payload", "value": "effc51d0f70077afb3c1254310695c61ba1e830b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747410952, "uuid": "18ea2b8d-7307-4d18-9300-1155d093b17e", "comment": "Malware payload", "value": "776173db7ae60b5268a46a6581b9a7e559585b788d659f27b7da782a438d94d478b257673f535db93c8d093b14cb46d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747410952, "uuid": "2916ac62-3fa2-4a28-b91f-cb7cf4cf50e4", "value": "T1B364D41766D86E85E5BC37F227B2568043B9EC0A9612D31D3EF874584DB6283EC5338E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747410952, "uuid": "7f54c0dc-e36c-4e60-86ac-a50790d40bfb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747410952, "uuid": "46e7d624-5104-446f-9923-4f400f3e3be1", "value": "3072:BKRcGyDZx4bBQUt9yMI9UBHY8E9deIet/6TVzLv4NTni/7NA6CLQ/EXuhYTKdU/4:A0iaUt9yvOVE9yazYXuhYTKdU/O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747410952, "uuid": "42151954-ca3b-4a75-83f2-3606584eb4a3", "value": 330240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747410952, "uuid": "7714c13b-77df-4510-b9d2-48d352926d26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747410952, "uuid": "db29fac3-c9f4-45ff-bf9c-b2d88f5c7674", "value": "A7m3d Rat V.2.0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f614dcb1-3272-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747412978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412978, "uuid": "d9485bb2-fdc8-459e-adcd-361dd70eeccc", "comment": "Malware payload (Mirai)", "value": "bbb9812d17d16cb8b38844f1b4ee5375", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412978, "uuid": "60fc4c4b-b18a-4616-ae24-cbbffc44f4e3", "comment": "Malware payload (Mirai)", "value": "280f5a765fda31636290b242db98d4ca3cf1db4cbd37a16e63b2a7bd987bfba3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412978, "uuid": "ce57c555-1b74-44c5-aafc-cc01c0c3c493", "comment": "Malware payload (Mirai)", "value": "0fb3c6f4e0fcfa9bcc4cd68639e180c42aaa83f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412978, "uuid": "1440736f-78ca-4292-9674-56227be26ec4", "comment": "Malware payload (Mirai)", "value": "fe9fb3d00741af4e10b0c193537d7210abeab037c6cf51ba2f60383928495920bdebc17ecf69e1a10828f1f86f99b54b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747412978, "uuid": "b5c29a18-68b7-4deb-a656-23e4cba7d7a3", "value": "T150233AC4B583F8F9EC15457C307B97729EB7F43A603AEDABC39994239815601AA072DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747412978, "uuid": "b1ddefce-161a-46ea-a260-a93f14cb8393", "value": "1536:4LInPCqAAXJLE7cxtdG8NCqBNM7vk9YXPSP0Hoa:FCqxpE7cxtdG0Cqvsvk9sSMHz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747412978, "uuid": "58580e39-2ace-4922-b7ce-f4b0e9ca9a95", "value": 49752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747412978, "uuid": "c5adee4d-a7aa-47df-b87d-bf4d170c4da4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747412978, "uuid": "182695f1-7f66-41d2-baeb-b68c1337182c", "value": "Josho.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f615c50c-325e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1747404388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747404388, "uuid": "8c90b0b0-978f-40a2-b3dd-cd7538be80f6", "comment": "Malware payload (LummaStealer)", "value": "51d9b3de09fe1c17612722698d6d4e4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747404388, "uuid": "e911a1be-02c0-482d-b30c-6b3336e277ac", "comment": "Malware payload (LummaStealer)", "value": "2871df2b1ffcf8b30a42cace024a0a85a90fc3a5f3b2be985cb00cc6eee0cc05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747404388, "uuid": "5128ab93-8e24-4793-9dfe-a7ece3804351", "comment": "Malware payload (LummaStealer)", "value": "86b5b70b9c0a4514cd078b31552025580f9ed0c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747404388, "uuid": "3161ca10-9014-4490-897a-b53b74065c7b", "comment": "Malware payload (LummaStealer)", "value": "3dda2689a483171f011a4a19dcde8eda7a718f77521ee0c911fa24b74e5feeda2f25dbf689fbcf18dcbeb7904d06ee87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747404388, "uuid": "19e20f31-1183-46bb-8386-733d8c70e36f", "value": "T1AA953353B4C253FDC705473041B89B0836725EB0F1AB86127D02CB7AB9AF799E274DA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747404388, "uuid": "cf3324f3-c825-457d-88c4-6d6a21991648", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747404388, "uuid": "173a644f-a227-4797-8b4c-0bc9db8553a7", "value": "49152:ZF7HCwimrt9dWqHR163gyo+jfN1lUJu6KU6N:Z1HCwimB9bYwyo+jF1Euo0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747404388, "uuid": "bd72c4de-8145-4d6d-bfb0-571fc01f6dfd", "value": 1889280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747404388, "uuid": "bf40055d-c211-4dcd-8ba4-37a27c569e21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747404388, "uuid": "bd887935-48b4-4a4e-b35b-1ba7dd5bc687", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18cea05d-324f-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747397574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747397574, "uuid": "93c0f5a8-d932-4140-9224-0909aa15902e", "comment": "Malware payload", "value": "35a8c0732e0087922bab626b499079a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747397574, "uuid": "9c1d57a4-f31e-477c-a59f-4830b56fe511", "comment": "Malware payload", "value": "28e993bda232c779d91eb15f9be355d9150016e9d3b57435c09ce0a7f33e3c37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747397574, "uuid": "35e9b831-33bf-4673-974d-b637075868b3", "comment": "Malware payload", "value": "c73cb71d68b6c39f2a5e6f4622c0cfe886ff8b61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747397574, "uuid": "6f253f5c-6dcc-4500-a6c8-b157ae9e93af", "comment": "Malware payload", "value": "c2183b386cd5ecacb6392abc8402a32efe2e83878db526f363032b28a5162e5bf020832b4c441eca8753836c3cc3126f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747397574, "uuid": "73cddf36-8f52-47c6-a1e9-678465433c16", "value": "T1C53409447E34C4A3F59EC47BF508B2E02CA52FB10D1296CB7E794E1ABEB66F14066364", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747397574, "uuid": "e196589b-129a-4bf8-8538-0cbcecb2f999", "value": "2ca53fefee819fb338d7a7a06e21cce5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747397574, "uuid": "2077e36c-fd7d-4658-ac25-c202645c4a5b", "value": "3072:d6kDFFbAv7945pWZZjNt6omY/vkL+iYb9QjuYy+7RwtQzkHh+5rWjOAa97:d6k5FC65pWrj+XTYbgnP7dz6w7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747397574, "uuid": "08e3a2db-581a-4607-8410-d5c9df26423f", "value": 230912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747397574, "uuid": "f2f423bd-ef85-4232-946c-ffa2a8d35f92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747397574, "uuid": "c75a71c5-497e-4b9c-b9c2-1f6b44102177", "value": "Panel.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca79b251-3228-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747381122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381122, "uuid": "c692ad3a-82ad-4b94-afcc-0cbfdacbd16b", "comment": "Malware payload (Mirai)", "value": "66f09edf3cc662895f41ad0585da0b58", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381122, "uuid": "34ce9d22-1290-4030-931b-ae31fef2cad5", "comment": "Malware payload (Mirai)", "value": "2944921dd7bb0a92c8a9ba27524bd7abb403a4412d938c2ca5b1833fabe64d07", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381122, "uuid": "4a15813b-0cf7-40d8-afb3-496ee818d0ab", "comment": "Malware payload (Mirai)", "value": "1444309b9efaca561b60411ea26005147d32319f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381122, "uuid": "bdb41c82-1bd2-458c-b506-87f1b3d9ddf1", "comment": "Malware payload (Mirai)", "value": "51c2281eb60b86b409017953c82a1c313199ee335cbe15f7ecdba319f678e06c4612d5ececbd121a0a062e6360e5b943", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381122, "uuid": "34036aa9-855c-43e1-b150-6e61db23da00", "value": "T17B1491192F244F7CEEC5833983F26D97459D02DA59A2C5A0CBAF96406E307497C3EB6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381122, "uuid": "d555b8d8-e362-4da1-aa90-fb1060f2292b", "value": "1536:pZZmWuutdFlmiQLwJ4KmgoNLwMhQp19eL9YZ1MzbV7b5Crd4BmfOV0jGNzjTPM42:cSrDJgzNLwMhQp1JMZ5BmYTPha/6d9nG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747381122, "uuid": "ae8c38cc-f4ed-45a4-9cff-5d61df03bd4d", "value": 192068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747381122, "uuid": "2253ee48-97e9-4fa6-8576-610315b44d27", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381122, "uuid": "d5b10a7a-721b-4db6-90c1-317e50512f36", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14669727-322f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747383823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747383823, "uuid": "0edae6dd-3d22-4964-bc66-5fa733ea0d84", "comment": "Malware payload (Mirai)", "value": "48301329492125b7181e75091772ee58", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747383823, "uuid": "f0ef9863-42fb-4b0b-8f44-a26783143973", "comment": "Malware payload (Mirai)", "value": "29461434aa1c9bc98bfa946d65c7f353b39989be4a7347b732b99490f294d262", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747383823, "uuid": "7a166d5e-4e50-4866-af80-67190251cb19", "comment": "Malware payload (Mirai)", "value": "a29530a4aeefa24700d1739d34cf570d6eae6f24", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747383823, "uuid": "7c2630e3-304c-49de-9479-32afa0fa2304", "comment": "Malware payload (Mirai)", "value": "f113961dd1d9ec5fcfd4a34725ed38dc7a5d73566212588ef13ce64cf683d11c6c2616ca5855bbd066ed61fc4aeee169", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747383823, "uuid": "a2e358b6-efe7-4d38-b1fb-7ed1e8f72602", "value": "T16983F79278C29A16C6E423BBFA7E018D332567A8D2DF32179C212F1577C981F0DB7691", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747383823, "uuid": "0f0fd060-febd-4559-a3bd-2eef14b1e8ba", "value": "1536:ssCvlPf6NDyL9Jb0+pHXlzPhha0xT8dQn6ahWNrrRKW57nHM35XPC:ssCvlPCuTxCQn1hicWC3B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747383823, "uuid": "b6f66e8c-cc54-4e7f-a26e-4b4d8510d8d5", "value": 82940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747383823, "uuid": "ed6612c0-feaf-46cf-a740-17bf38f7f295", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747383823, "uuid": "a7001239-df0b-4057-b013-e09a6a2fe22a", "value": "UnHAnaAW.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "972658ec-31f5-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747359132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747359132, "uuid": "85b38c25-b24d-4cc7-b406-2c9ff89d9487", "comment": "Malware payload", "value": "841fd255a33af91e23d9e50b0724ec35", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747359132, "uuid": "8beb9625-58e3-4b17-bebf-1343a0e021c1", "comment": "Malware payload", "value": "29767cbe20ec2c3336e18ad690fc4ce80b3d8d724ccff19933c2a1820a01a828", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747359132, "uuid": "a29e7041-9635-4c66-ad6c-93a138412bea", "comment": "Malware payload", "value": "c8df193223a75a2f740cc5e77bc4fe34aa97bd1b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747359132, "uuid": "0dd5da2a-d612-42cc-bdd1-da2a1114e88c", "comment": "Malware payload", "value": "e5209d457d79a0c0bc7ebfa093eddff188f50529e2b2e686450e9f6231fc2eab09c01fdd3585cf24a5423d0290f4dcf2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747359132, "uuid": "d43ad3aa-6d06-4909-9949-604719fcbbb7", "value": "T1FC155A5AB2B374ECC0A3C030479FDBB2AD3AB4790112AD7B31C099353956EA15F19B67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747359132, "uuid": "9f1a901c-a29f-4603-98c3-1ee9eff792d6", "value": "12288:swck8ZX2j3IUhfu2wz4Fdku0URggsqz5F7e:s3kEXCt9u9+kjUXNF7e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747359132, "uuid": "429983e6-7299-45a0-af74-8525ef363e5d", "value": 959000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747359132, "uuid": "679ad89e-faa8-47f3-a6f7-d428496daece", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747359132, "uuid": "de3156e8-e159-4116-8b6b-2339aceb0181", "value": "biosetd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ec27022-325d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747403651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403651, "uuid": "46aec02c-74bd-4dbb-8410-2726ad7a01d1", "comment": "Malware payload (Mirai)", "value": "c97c386e949a7b7f4f87cbfbbd3a4049", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403651, "uuid": "eb91dfc0-854b-4cde-a7a7-aa4c381b6e58", "comment": "Malware payload (Mirai)", "value": "297f5282869b4cb52f1748fa629b6856f56861ea561bb6e51b0aa2c771955994", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403651, "uuid": "7a02f584-cf13-43e0-9a29-be5ec32de410", "comment": "Malware payload (Mirai)", "value": "4a2f20114720f0f2af1fa745d03cb6a477eba585", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403651, "uuid": "1cce4f02-dfd8-48a8-bab6-d1031484b538", "comment": "Malware payload (Mirai)", "value": "bb33c142dc7a6748d35b8c4c18be0ac47cb83d3765dda3b6cf4739d1fb65379736dbc777d68ff0a2f35504395a9fa1e9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403651, "uuid": "646ec7c6-b4cc-462f-b57f-5713fac159fb", "value": "T1855148C622D7913138629A67B6BA4D0D32C0D09B9FC5EE48ADDC3CF9869CE593440B57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403651, "uuid": "10fc6890-c6fe-4dfe-943f-9c2042c40981", "value": "24:vfnKnbfnA8nA2hikfnsneyfnvnpfnVn9fnWenWCnfnTNKnTuwhfn2n7fnFnJfnNv:vmIn2h0JfT7N6xh6zFy3hBT4k0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747403651, "uuid": "6b097680-f9a2-4d65-8dee-113e1b663d3e", "value": 2790, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747403651, "uuid": "26f01759-043b-4f22-b1f6-c8e2b6d3b6d9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403651, "uuid": "11df650a-0635-42dc-9aae-ec56e4d7f420", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3b429bb-328a-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747423175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747423175, "uuid": "cdb07375-3016-43dd-9a9c-2f37b41a6b07", "comment": "Malware payload", "value": "31139182490736e7d630543e53200437", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747423175, "uuid": "bb23a625-0128-4e94-b4a5-4eea2b49c017", "comment": "Malware payload", "value": "2a814b1a774c2524bc46d7bb6b5f0f57b28eb51666487e356d8907e1a7ca1a97", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747423175, "uuid": "d948d161-c0d0-4494-a1f6-b8ec06a2b035", "comment": "Malware payload", "value": "63f70485514e0d9e4aa6ea71410a86bbe7192a27", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747423175, "uuid": "a9674f0f-6319-42c2-ad2f-9ff4c489d061", "comment": "Malware payload", "value": "6255be8f85f972106508ce98cb3520c9a9c8fbb5bc5552dfe423956a44518c2f39034049524ffe6aed144ad067160569", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747423175, "uuid": "890996f6-d526-4c6d-b35f-611fe8a77350", "value": "T1C3F4D0358644BFE9CF9C4E09E07C190D6FE48A8B864EF24DFB55A1536AE7508CB1E0E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747423175, "uuid": "fd8a3ef4-cce8-4813-9f98-d3113d74c8c3", "value": "12288:6rBTp0u9d4ksTdu6wGA7H7tBamOufr075JaYSj6a6jyKTO:6rT0o4k9TzH47vaqyKTO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747423175, "uuid": "7a77abab-da16-4ec0-98d0-7f488afb93e9", "value": 777744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747423175, "uuid": "ae054f90-ca45-4106-9c73-035554bbe605", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747423175, "uuid": "0c95fdf6-5715-4398-8af1-05f381ce9af4", "value": "SKM_750i25051513461.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49845ad4-3262-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Amadey)", "timestamp": 1747405817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747405817, "uuid": "459b277e-d1c8-44f4-956e-ee058468ddee", "comment": "Malware payload (Amadey)", "value": "0bb9a76cc29185477e69fccb0a60a348", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747405817, "uuid": "5f346c92-34d9-48c7-900f-f07e4d7ac37b", "comment": "Malware payload (Amadey)", "value": "2abb588a9e421c7e2da7f58231de94a990a89251957d1d71c8098cea1709b0f1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747405817, "uuid": "8d9e3385-297d-4011-8ee0-de515a0bd41c", "comment": "Malware payload (Amadey)", "value": "41becdc40f12c56b4d33f65eb9fcfdec44b54e39", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747405817, "uuid": "960da0ad-091d-4be6-95b3-833048423721", "comment": "Malware payload (Amadey)", "value": "fc8d90ce8287973ca383de17b1e35c8bd48db63b55f61dd8f78306cc4641e1cc5d806f774a2fd75b7e1e940c5640eae5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747405817, "uuid": "cf6da886-9d2e-44a7-b029-077be9e68769", "value": "T153159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747405817, "uuid": "70f0cbaf-a85e-4422-82ba-e3513e7c2cda", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747405817, "uuid": "5b0bc593-f61c-47fb-bdad-43ed49dd0586", "value": "24576:dqDEvCTbMWu7rQYlBQcBiT6rprG8aMTb:dTvC/MTQYxsWR7aMT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747405817, "uuid": "a1e419ad-ba5d-4fa3-88e2-a0568b75bb28", "value": 961024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747405817, "uuid": "d496b0c6-077d-4da8-ad5d-aad48fde43d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747405817, "uuid": "c7239478-97ec-4c07-9bfa-46daa979e6dd", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b86a796c-321c-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747375938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747375938, "uuid": "70354913-baec-46bf-9594-dd6321d3ddb6", "comment": "Malware payload (Mirai)", "value": "affef718427ed579d376f62fec1417ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747375938, "uuid": "6e5b237e-9703-4580-a011-9ad20a3415f0", "comment": "Malware payload (Mirai)", "value": "2ad129fcede4485155f2a76d9cb0f48f83b438e94e40e73f803d4f5b30277d2c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747375938, "uuid": "aa7d1cf4-8b53-4e63-98e5-9a765ac4fe07", "comment": "Malware payload (Mirai)", "value": "4d1c297bce92bb28d653823f2a927b4a1d7620bd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747375938, "uuid": "8e9857b0-727c-4514-be46-c9cdfe782c9f", "comment": "Malware payload (Mirai)", "value": "240a7d8157ffd56f7eb315a383490d622c2eaba9048131ef0dc35b4e63e6aec745fb3006c88601eb585991d1393763a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747375938, "uuid": "1720fba7-30eb-4d2f-9f28-55cf7de5dab3", "value": "T13EE2F171C4DD8A53D446D0B8C5FD1C9E8826BD513B27E3E136C4CBA6983E0506E782F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747375938, "uuid": "d10ca71d-3b77-4027-8499-c4319c263462", "value": "768:6/r6E+vryKUBLAD34tBEtX7SJIoy2hZLRBPljNDNbfdX:wrR+vryKl34itX7SJIo5ZVBtNT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747375938, "uuid": "a5a57992-f981-4e47-9bda-5c1e5c3635ae", "value": 32836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747375938, "uuid": "96093ff7-ce73-4669-a498-8ed2be2f6159", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747375938, "uuid": "8bd1ffc7-aa0e-425f-a80c-a7ad96aad141", "value": "neon.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20be45d1-3262-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747405748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747405748, "uuid": "93f26fb0-cac3-469c-bf2b-4b6e7cdf7bf6", "comment": "Malware payload (Mirai)", "value": "58f42d825c97d984eef882092bfbf61e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747405748, "uuid": "e90ba949-44f4-41e6-9894-10e679d283cb", "comment": "Malware payload (Mirai)", "value": "2b0513a23bf42f49370d22606e6ffab38ef2e360a750b70b262b795c1765274f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747405748, "uuid": "18b1b0e0-e41d-4035-af55-6c206a57cd9d", "comment": "Malware payload (Mirai)", "value": "ebdb2f7cf1f58192f4c44433b8821a4e6b98f1d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747405748, "uuid": "35b42f73-9f9a-4189-876e-7190ff607956", "comment": "Malware payload (Mirai)", "value": "7319987ad9c77bb9ee7f98eac69458055d49206e7965802200cc1e4b774f83d4718f8a91f4a7710a7ef83432d2be16d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747405748, "uuid": "d1c31a41-3b8d-4daf-af9d-c398cb41720f", "value": "T11D03E16D8F089C729F306C79FE794D8EEB0855B4BA5E2A87D6460712131B9049BB14CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747405748, "uuid": "c0be20b5-b6c7-4c4d-887c-bb847cae7206", "value": "768:JBim7CZp6a28NsyeOU71NnTFuLQ9SxOZTWt3geW4ZT9q3UELjp:JL7WHTkPPRuk9wOAJgMSLF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747405748, "uuid": "3926f104-ddae-44bf-bfb1-61b59be4da67", "value": 37892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747405748, "uuid": "2fdf0ffc-81bc-4d5d-820f-7fac756711e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747405748, "uuid": "7b7dc4df-b6ee-4d1b-a506-7523de221c59", "value": "neon.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c1245af-3281-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747419162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747419162, "uuid": "9cdc8373-85de-44cd-b8e6-4c7da6ca0081", "comment": "Malware payload", "value": "d03e15b6ac4fd369eca7fafb61831ac0", "object_relation": "md5", "Tag": [ { "name": "contactcneiva-com", "colour": "#85C24D", "exportable": true, "hide_tag": false }, { "name": "notificacao-intimacao-eletronica-com", "colour": "#32DFF2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747419162, "uuid": "a7c8aa16-0b78-4937-b475-7bbaf525106f", "comment": "Malware payload", "value": "2b0850a43518eeb861f6efb5d55ecff38bd5776e7b96f929afe65ed31b8c3a1f", "object_relation": "sha256", "Tag": [ { "name": "contactcneiva-com", "colour": "#85C24D", "exportable": true, "hide_tag": false }, { "name": "notificacao-intimacao-eletronica-com", "colour": "#32DFF2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747419162, "uuid": "71b8307d-1649-4a2b-81b1-77334d9713c6", "comment": "Malware payload", "value": "faa70076813e057614385d840f7d941665d4a58d", "object_relation": "sha1", "Tag": [ { "name": "contactcneiva-com", "colour": "#85C24D", "exportable": true, "hide_tag": false }, { "name": "notificacao-intimacao-eletronica-com", "colour": "#32DFF2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747419162, "uuid": "ffe97cd9-728d-4e04-9fa8-1341a0389b48", "comment": "Malware payload", "value": "e748cb63ccad65ac06ba10374dc35fb7027e2cb1b7b6cd71fb7a0ae594ebb3c9e61f8573d89047a2c07f9d1943ed0763", "object_relation": "sha3-384", "Tag": [ { "name": "contactcneiva-com", "colour": "#85C24D", "exportable": true, "hide_tag": false }, { "name": "notificacao-intimacao-eletronica-com", "colour": "#32DFF2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747419162, "uuid": "c7d658df-3654-4f83-9bc3-07c600b90754", "value": "T1ED3733E25AD8B3C88EC351A9997FB0781CB86725748A77B4375CE4478B2D1B2F0314E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747419162, "uuid": "f83b08e9-ad31-4e8c-b80a-2656bc16f7ca", "value": "393216:rRwvTLqzt8c5nq5+gAgHPaNW9kXCwQJ+DpQS0k/lg8qjh+EayhsPsvaxJJ/I:qnqzRnczLCNKkq+DpQS0ii8qN7ayhsEl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747419162, "uuid": "947f5fec-d8f6-4e9e-a98c-18ac51584a5f", "value": 23864250, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747419162, "uuid": "71464202-a7ce-4ba3-8c68-58abac23de27", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747419162, "uuid": "e3a6cf05-feb1-404e-8a0c-e09da054bd9c", "value": "veneno2025.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c12398fa-322b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747382395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382395, "uuid": "96f94ff3-e8c6-40b2-b716-aaa88fa53148", "comment": "Malware payload (Mirai)", "value": "df7aafd0007ac67fd06e5ad23703bcf1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382395, "uuid": "6cd93bd0-fb0a-47c6-beec-7fe07ea8b039", "comment": "Malware payload (Mirai)", "value": "2bbf8b8ef08ffd01d747fc1f7afed73377178376504c493004c07d5598fb8bd9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382395, "uuid": "7f14013c-ef1d-4f33-9493-76f616910f1c", "comment": "Malware payload (Mirai)", "value": "9dfe07906a612f6eb7ee15c631dfa05951c42712", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382395, "uuid": "38f90001-19d4-429a-b1ad-66cdbcfa6da5", "comment": "Malware payload (Mirai)", "value": "87876e40969934b2ef1e30a3bb1b9b071ba5657301b319c8d1fa48e784c2135f4c2ec53637949bb97a27f073047d42fa", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382395, "uuid": "faf325ee-0877-4635-a842-7c37a18932be", "value": "T193518CC5206D31B5BD96456B2DBB051FB6C08065A4DF2E1457AC38E2E3AEC8FF842DD2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382395, "uuid": "97097438-2720-4290-b5da-4ca8b457ea0f", "value": "48:vhe+X3htY3hVy+3hy23h3g3h223hx03hti3hk23hZa3hQ23hsG3hfx:vLX3Y3F3H3a3b3s323B3q3J3d3b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747382395, "uuid": "c2e855d3-05d1-42e1-982a-c37c37c70385", "value": 3081, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747382395, "uuid": "1f345791-2608-427c-bc86-ae260ef91ec3", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382395, "uuid": "70525e08-a3b6-46b3-b6d2-772cfb449c29", "value": "GuruITDDoS3.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf65db76-31f9-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747360944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747360944, "uuid": "dc35df3c-6684-4518-ba9a-a2a307eff2b0", "comment": "Malware payload (Mirai)", "value": "5f944e5dd7235ebfea869949eac6ce6e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747360944, "uuid": "7f15cdc8-48b1-41e9-9164-122a05d992b4", "comment": "Malware payload (Mirai)", "value": "2bd19e18a32e2f64acc470a606152d4b09471aab4043be76eda083e15814a9b4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747360944, "uuid": "1875bf20-333e-48ff-b1aa-4cd19aaa8d68", "comment": "Malware payload (Mirai)", "value": "3d39d54fe8aea8dbbf1df71fdfc1392349b3e304", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747360944, "uuid": "880ae1cf-6d7e-4993-ac3a-9c84c95687cf", "comment": "Malware payload (Mirai)", "value": "20dae2b8a6c7dd02714e273a886b63c90f87bb06d7424175f71b8cc59fd12882e55ed8e142a4625da641a94a7b3fb773", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747360944, "uuid": "2cefe57d-6f23-4190-9a8d-0b00a2889f1c", "value": "T10572BF564482A8F0C2B08978DA6C4553BB6B24FDA1F2343600185B7CBBC29436BF57CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747360944, "uuid": "2b6f6708-4b6e-40e4-811c-aabb374131d4", "value": "384:U0rptVwGE6PVaXQdhNkrN1v+zCwXeIW+Lszu+3hymdGUop5h4X60:xpRVTdrAEMyWu+3s3UozI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747360944, "uuid": "b3523ca1-aefc-4fd3-9a85-a5f002f305fd", "value": 17496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747360944, "uuid": "23de8081-f958-40ee-9f4a-360e4a7b2647", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747360944, "uuid": "6e5a6bf2-313f-4080-89be-cd6d7322a6fc", "value": "neon.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77e2b21e-322e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747383560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747383560, "uuid": "9217d06f-e943-4786-94d8-9c3f27836c77", "comment": "Malware payload (Mirai)", "value": "407eba3cb458a1b5b4651679bb4c0b02", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747383560, "uuid": "67f32a1b-29b5-4991-b2db-26e08a33b9d5", "comment": "Malware payload (Mirai)", "value": "2be3b9132952e2b6e353064ed587937aa8757bf73f0c71f44ffffa9b50e04260", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747383560, "uuid": "8c904f6e-22b9-450e-9dd7-ddff77328c4f", "comment": "Malware payload (Mirai)", "value": "fd234f2bd15e8198c11849c7ae10b8b134c1cc1d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747383560, "uuid": "a926981f-bc28-45eb-a74a-24f9c24a22b3", "comment": "Malware payload (Mirai)", "value": "abc2a0e2aad5794a9094c5e7a9dd892ac6e6747a69506df12bd7be50748769f36d4fbd2978b200f9d155b48f94a2037c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747383560, "uuid": "08bb5307-70b1-4448-86e4-87d717167c14", "value": "T12D732981B9819B13C6D1127BFB5E428D772613A8E3EA7303DE256F20778B82B0E77545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747383560, "uuid": "392eb29a-1c60-4195-983c-6f17f58a6603", "value": "1536:zHOlXxh+q/bpGnZuPDJ0HLqc182dOnEEm43qW9mv33:zHo3/dGnyV0HLqheoSn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747383560, "uuid": "9ade486e-d4d6-47fd-a15b-c0c3304baa6c", "value": 74028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747383560, "uuid": "d7ab59d9-e08c-4e48-b6e7-090fd5c74bdb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747383560, "uuid": "45695c00-48dc-4b5a-910e-0ee992e937e9", "value": "harm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93098040-325e-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747404222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747404222, "uuid": "6d496fb8-bbfa-4bfa-9684-177064844914", "comment": "Malware payload", "value": "5f27c66a5f24285f45fd23d1a5d8d447", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747404222, "uuid": "daf1b10f-0221-4b01-8697-2e95ec4e3653", "comment": "Malware payload", "value": "2c30a39f54397ac5f05809e0869d75bb71f1aa050bbc3de99c7e7ca0757688f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747404222, "uuid": "5d6cbd24-d060-418c-93b2-a42c3f5ea76f", "comment": "Malware payload", "value": "4e4c05d747d56b1dea50276a7385242abea7b4d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747404222, "uuid": "85dc7196-efa2-4ae8-a9e5-17589b41a1a0", "comment": "Malware payload", "value": "271051c795c90e50434fc2cb0ffb4e753d5a70bded52e47b3286e3944f4c97209cfc5dbd7df45708af2bc2627edd79c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747404222, "uuid": "b87a3679-b2a3-4782-b61b-bd728b831a19", "value": "T1F3A52342F6C648B1E17228326B7867216A7CBD305F758EDF67D03A1DE9605C0EB20B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747404222, "uuid": "58a03a92-056e-4f48-b422-670143408274", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747404222, "uuid": "79a815a8-9843-4605-864f-c26ff90df2cd", "value": "49152:IBJVTpc8iYMljoCIrtufFEUPtPSfdjh/SXjlV:yTTFMlFIQDP4fdj4j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747404222, "uuid": "5d6c28eb-ce83-4fc6-b627-391f445f3f0d", "value": 2230224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747404222, "uuid": "4aaf5c83-396d-405c-bc71-7d4b23cf91b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747404222, "uuid": "a32fc52d-f732-4197-aeff-c2c6dd6419bf", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2157df8-3225-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1747379846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747379846, "uuid": "16da8c6c-4be6-484f-b75a-ba6dab87ecfa", "comment": "Malware payload (Prometei)", "value": "d9750e671e073e60123c34b829e2f22c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747379846, "uuid": "63efebe6-7eed-43e4-a01c-2d22f91d0e14", "comment": "Malware payload (Prometei)", "value": "2c688c1eee73419ab94b91468b70f11d3e6a668b6d05465687bfbbef39ee33ee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747379846, "uuid": "ddcc84ca-a7d9-4d4b-abcd-a7ba87b1d088", "comment": "Malware payload (Prometei)", "value": "615a95da81b1174ee7aa02f0e03fffcbbf42659a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747379846, "uuid": "0dfd23b3-49ab-4779-a5cb-70e1481ac5ea", "comment": "Malware payload (Prometei)", "value": "a0332af00220197f3a97a065f09b7045c93316c03bffeb22e42bd196f636ea6ff408382ca75182bf18c06b63cbc4c6ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747379846, "uuid": "2e3ed4dc-91cd-44f7-bf7f-39689660202b", "value": "T1239423F8C83D2E30D8169B3CBB5A826CF0A15772D9562F6AB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747379846, "uuid": "48081271-6087-4d2a-9e4b-7b2796b4f36c", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgn:25WOSACZSV6eKRH5EPiamb4DsDwwcX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747379846, "uuid": "9d5f462d-e871-466f-a813-1aa0da2fe3d9", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747379846, "uuid": "41ec646d-ace7-4e11-a528-2c1d800fe7dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747379846, "uuid": "ca56a746-94a1-446b-8afc-6cd1286aed73", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5064109-322b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1747382348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382348, "uuid": "9dc5c9ee-6510-4c38-b3eb-f4d46a3dd912", "comment": "Malware payload (Gafgyt)", "value": "63f04c83237fdeef030599406f867645", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382348, "uuid": "825dbf0e-3010-4511-8dda-65f416bd78d2", "comment": "Malware payload (Gafgyt)", "value": "2c956347a08169f88a0a985c94885a50fc54b810bf9d66082b102bed42a5e3a9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382348, "uuid": "a16abbd4-de31-4ab5-9506-026abb531bf7", "comment": "Malware payload (Gafgyt)", "value": "798e6cbb2e93beb739f0fa78901b1ef4784c5b98", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382348, "uuid": "48121dc7-76a3-4df7-93aa-7495fb4d3c9e", "comment": "Malware payload (Gafgyt)", "value": "ab7189654f94995bf7bc672726d0f1ad9b566ca845b76b0cede99abdd30f28c763120eaf7151f7a27820ea7b1c90fb95", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382348, "uuid": "1bcc9f16-f465-4570-923c-dc6c987182ec", "value": "T1B3E308938B66C636E7035AB9126FEF1143B390FF28C78A94F3499B7445C24CBA190B5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382348, "uuid": "1b4131fd-2688-4332-9dd6-6fc3a68e0d22", "value": "3072:HE9rx5elUUrxwVVpSE8JqMrOltGralhWpRwWriH90PfNatph1:MxPaYx9Mil6esiH90PfNatph1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747382348, "uuid": "f4d773f3-88ec-4e3e-b6c4-391458cf93a9", "value": 152241, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747382348, "uuid": "166181d5-d17e-46f2-8773-28515782114e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382348, "uuid": "7c4a4e5b-07dc-4995-863f-3866f0b67356", "value": "qvmxvl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1fd4476-322f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747384114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747384114, "uuid": "7b7a3d62-ce18-49fb-83da-4580eb3d17bb", "comment": "Malware payload (Mirai)", "value": "c87ef614a7cccf8c4570f313a1f68293", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747384114, "uuid": "077716a1-74a6-458e-8096-6f52a4a65a27", "comment": "Malware payload (Mirai)", "value": "2c9a764180dffe9ee9db4655ec34606b85b93bd8546a34267ea46f4451252f33", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747384114, "uuid": "37d304b8-4a40-415f-8432-4072dec85744", "comment": "Malware payload (Mirai)", "value": "201e76a72694925a0427c0b299eb09cf0e18ed96", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747384114, "uuid": "dd0dbf39-0dcb-478f-aa92-d7064b125933", "comment": "Malware payload (Mirai)", "value": "ae15d2ccdd42600446661dcc2bbe3fe69d25eedeaae6c4ec52b01af9a9d104b8ecf209f9160a5c243b78ff6212875355", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747384114, "uuid": "e184761d-e20f-46a4-a7d7-ff696ab835b1", "value": "T18B7329DAF801D87DF80FD77B0467090AB931A3D216830B277367FDA7AC721A54826E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747384114, "uuid": "7177ecf4-17ef-4eb2-8d34-ebda769be3da", "value": "1536:IV4cFHukRqW0CXAgtOl/534Zb28UCaFAAX/6C/gJFnrTVczGTNht9y:IacxXX495IZb8ppyWgf0GTN39y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747384114, "uuid": "42e8031f-4b3d-4e0c-90bc-9c043d33e079", "value": 78072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747384114, "uuid": "951133be-27f1-486d-8f5c-a1472ee6f03e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747384114, "uuid": "5b2ec2e4-f2b4-4507-8d1e-3f9c3ae28d75", "value": "neon.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a08adbc0-322b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1747382340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382340, "uuid": "47789933-e5ea-436c-a902-165f0974f049", "comment": "Malware payload (Gafgyt)", "value": "e0d9aa0db2f8a27214bf89c947294b62", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382340, "uuid": "2b6d40be-99a5-4156-89b6-f99db83af0da", "comment": "Malware payload (Gafgyt)", "value": "2d2cc6ae782bc2e9a59bb1063034816dd7e88490beec42ea2ff04509ff9c1efe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382340, "uuid": "e9eac0f7-e622-4aef-8523-1fc494efa380", "comment": "Malware payload (Gafgyt)", "value": "2ba432de5832cd1a757de58eb831a561a3f33fd7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382340, "uuid": "30dcd2a6-7d6c-41f4-9cbf-71d0cd05c511", "comment": "Malware payload (Gafgyt)", "value": "fd659ce963fa93b61acc8121f273a12368c2b10a22bbaaee3cd248b4d4d42e3c6d375d7b26a4a95ed3cc991b15c41578", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382340, "uuid": "cb10e5ea-9e5b-403e-8c2e-894ab2cf2062", "value": "T13B04D687A412DF1BD45B263A16D70131FAF5A3DD6A8702327723BC927F630D159BAAC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382340, "uuid": "55993dc6-a097-4483-be14-b560e4381577", "value": "3072:KyWKJj+PxOAPsIYKuAFXU58eE/wyzAUZOlV7jUTsmPs0ao8UtKFX:KyWSj1IY1AFXU5Byz3AlNUTsmPs0ao8X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747382340, "uuid": "7c75d051-e5a1-41ba-b41d-0a4433b48447", "value": 176573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747382340, "uuid": "35aeb1e8-a278-4565-859d-cf561d901927", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382340, "uuid": "825a3468-83ae-4189-af40-62e8462a1025", "value": "ajoomk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbaae9a1-326a-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747409498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747409498, "uuid": "21c9269f-2547-488e-9f46-97915af0e470", "comment": "Malware payload", "value": "49cccd30a564410d1f9bbce89fa15890", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747409498, "uuid": "1b21e13d-1205-412b-9ee5-d30912838eeb", "comment": "Malware payload", "value": "2dc0f0286e2fadda2881a1dd767d065493af87c6528e563804fa39e8618bf447", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747409498, "uuid": "08a19ab5-9294-4a36-bbac-fe3e6d49b099", "comment": "Malware payload", "value": "cc1bfc5f395dcb3241058bec5c656045ee17c944", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747409498, "uuid": "57bac28f-240d-4e21-8062-88d0377c7407", "comment": "Malware payload", "value": "317e6722d196fb81dcae702aace9931c419dcb8c3a5f14d996dbc55afe15f37f2374f64ed6cf2d78dd837d2863d6c5d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747409498, "uuid": "e2ba214a-8a26-4f27-be0e-678f0c34d365", "value": "T18533D06FC468F8F4DDA377388672C36EF52ABC9604E300A937E452C9EC9511CAB591C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747409498, "uuid": "24a22fd6-af7d-4140-8e7e-95c155a6efce", "value": "87bed5a7cba00c7e1f4015f1bdae2183", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747409498, "uuid": "f56ad2ff-511e-4730-b341-e4175e04914a", "value": "1536:iTdytmznUkJTbcBPQtXCUP5rKdQz4nBxP5lm:sdy0znnbpDlszC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747409498, "uuid": "2fc98bf4-4e3d-4f88-a418-a1aa292e936a", "value": 50176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747409498, "uuid": "5f9baaa8-70c4-4970-be29-95ca2adbf2e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747409498, "uuid": "b76d871f-1032-420d-89dd-7dbdc2bf4a1d", "value": "49cccd30a564410d1f9bbce89fa15890.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "316a0376-324f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747397616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747397616, "uuid": "2132a790-92a1-450d-8546-b64653e93b63", "comment": "Malware payload (Mirai)", "value": "64dceb1b89acc21859cc9cd49824cd2e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747397616, "uuid": "db362180-879e-4951-bae5-76e8a6b416f6", "comment": "Malware payload (Mirai)", "value": "2de4873705e1e8d4476b6d9a7b45f15d9974d0c48a422c5a16f6d2d6ab3a0ba8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747397616, "uuid": "fbfc47f6-12b8-4e1e-8d6f-13772a4586ed", "comment": "Malware payload (Mirai)", "value": "4b7a615191cc590a2e020c97e20c6b2e5f5e73af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747397616, "uuid": "2f3f573f-ab82-456a-9a1e-ae7598346344", "comment": "Malware payload (Mirai)", "value": "b3a3ed1e7c15c0cbc20aa5f4d7a7d1b6fd3954dad33fdfe09860ab9ff3418e1f0d642db30f100609846b0c2ec1a1c5fa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747397616, "uuid": "eda1c110-3e72-41f0-8275-87c462d2a4d2", "value": "T152141A42F8819F16C5D012BBFE2E018E331327A8E1DE72129D245F707BCA96F0D7AA55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747397616, "uuid": "499c0205-0c00-4b61-b224-50f0a320ac27", "value": "6144:Ez06pxIKThJ66EcfIYdvzC5c0X/9cZoF/s2beXaOzpnPL7:O04xIKThJZdhzcc0XtF/vKaORL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747397616, "uuid": "256247a3-e3b5-4b15-8be2-b1cc45fb87ff", "value": 205020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747397616, "uuid": "bbc8360d-557a-4918-a489-a7c92172ea4f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747397616, "uuid": "aff3f33d-1a7b-41c1-8539-7afd696a9fb5", "value": "Tsun.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a39a2f7c-3228-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747381057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381057, "uuid": "6bb7d0a3-7d38-411d-a6e4-03e960bf3954", "comment": "Malware payload (Mirai)", "value": "bf2f3702303dc24373262ed9229ba779", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381057, "uuid": "a824edca-8436-4a49-a60c-118218fd91bc", "comment": "Malware payload (Mirai)", "value": "2e1f9a6efb611230a87e903335239caa118e5d26ac7c7be08aff5a1863e90fed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381057, "uuid": "e355409b-589a-4f96-b32f-528eb6deb966", "comment": "Malware payload (Mirai)", "value": "6e707fe88f9512df32f8dee0f40fa9efd5a998c0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381057, "uuid": "aefca764-b62e-4169-be93-d1d1cb715857", "comment": "Malware payload (Mirai)", "value": "f8fe1f600734209cc6f095b031cb7e6368c60403bc0ca78fdb1dc4aafd9bd332cc37af66fa60c5b415488bccc2d7b2d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381057, "uuid": "daf71ef8-d53b-4e95-b97e-17cf96ac4418", "value": "T10533F1B5929BAD71C17056F7162D549D641A2338E3E6F00356260470EACB1F35AFE7C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381057, "uuid": "050579fc-d0e9-434e-959f-e241c37c6408", "value": "1536:uCoqsGR4eB3g0Vmh1IxIpC8J41L9VE8amFZP7R3b:Xoqs2Twh6P8J+LJ9ZP7R3b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747381057, "uuid": "825aac54-30bb-47c1-8043-74b2ba4b9fcc", "value": 51444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747381057, "uuid": "bb67aeb1-1086-4841-9912-d8095df86914", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381057, "uuid": "9c011054-5663-412b-84a0-2ddd0823c872", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0cd7bb7-323a-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747388917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747388917, "uuid": "854d6500-42f7-4d53-a1c8-79f2437dd86c", "comment": "Malware payload", "value": "0945d7aaf0a18f0b2f72ea396922654b", "object_relation": "md5", "Tag": [ { "name": "dsh-fvsrchps-cn", "colour": "#DE3429", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747388917, "uuid": "10b56aae-32a0-4ab4-8ec0-6d5df651916f", "comment": "Malware payload", "value": "2e3170dc69e8f1c2ebded1380d0b7a1a348d256ceff8bbbf5c8cd71f7cbacb2b", "object_relation": "sha256", "Tag": [ { "name": "dsh-fvsrchps-cn", "colour": "#DE3429", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747388917, "uuid": "38d6bf19-9dc0-4b7f-b9da-3664edee448b", "comment": "Malware payload", "value": "a343691ae1a630b82446d73984c1bcb477d261e8", "object_relation": "sha1", "Tag": [ { "name": "dsh-fvsrchps-cn", "colour": "#DE3429", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747388917, "uuid": "8ddf6d0e-98bd-4cc2-b152-e72550968c4a", "comment": "Malware payload", "value": "cea136b5e5b34ddb9e3dbd4db557fba27cb4cd7fb6ab35626682df5271fa76f6d4ef763d98021a24dd84f85829e74a63", "object_relation": "sha3-384", "Tag": [ { "name": "dsh-fvsrchps-cn", "colour": "#DE3429", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747388917, "uuid": "d454b154-12f8-41ad-9ece-491264b9959c", "value": "T14DC633A6C36442EBC23A1B3504D39B707BB6C86A27A752231E35413D7C777647E2AF90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747388917, "uuid": "16925447-7c37-42e9-a3ac-2eff07a1c913", "value": "196608:S2Gx6YWFJM+hBRGgu9DJn7d6XbZc6e+r6f95kiQk5P6bKtG8exwi/0ju5/p0/X8:S2e6YWc+higu9DJ7d2af92iX9QK8IU/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747388917, "uuid": "6235e0bd-6928-40a5-9ef2-a7d84c560b68", "value": 11838209, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747388917, "uuid": "eed16388-fa01-4d2a-b703-ebe2c441e284", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747388917, "uuid": "9f6630bd-2e2a-4055-8264-384b44579fde", "value": "2e3170dc69e8f1c2ebded1380d0b7a1a348d256ceff8bbbf5c8cd71f7cbacb2b.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cd26f78-3255-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AgentTesla)", "timestamp": 1747400373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747400373, "uuid": "d7544136-b967-48c3-90b1-4e8a2459f3f0", "comment": "Malware payload (AgentTesla)", "value": "aac17e5fb5b67be7d8f131cb0aed10c7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747400373, "uuid": "d1795860-9bdc-44be-a00d-6273cdb8b942", "comment": "Malware payload (AgentTesla)", "value": "2e454d9491d482daf95954ea07d4a19600bf6af6334ef1d7fc53b949dfa92911", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747400373, "uuid": "c42a7e33-0c7b-40dc-9496-0c44936867b3", "comment": "Malware payload (AgentTesla)", "value": "da2115bdcc1211deadc24f2c580fedac2cbf9fd9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747400373, "uuid": "976c378d-0762-4d5e-9d20-a3904a0abdf5", "comment": "Malware payload (AgentTesla)", "value": "cd46e48b3786d4a9e8cfe9c0b2591c96235743e9fd1655e706ae6f0589411470906519db1b9d88ba9440b360e1a4fd0a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747400373, "uuid": "b6c0ba04-d240-457b-b21f-9685ca6a68a4", "value": "T1F865705DE0B09D822024FD74EA51BB9388DA17951A378E411FD571BA2316883FFAF3B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747400373, "uuid": "6ccd1d3b-6fbb-4ce2-97d0-12439a57ce84", "value": "24576://FIrsSu8ZYIhf+p84tqN1n8S2stEZoKn8VZJVRer9ffdiug68T1SQC:FLU2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747400373, "uuid": "37ad58bd-bd48-4156-9675-350c267113d5", "value": 1485208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747400373, "uuid": "770a9e98-5b1b-4bce-9083-6dc8f6b2be42", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747400373, "uuid": "acb1f5b3-de53-4e3a-b9ea-ed1f0bbbc5d1", "value": "DHL6400742025PDF.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52ab2949-322c-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747382639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382639, "uuid": "10d421c0-6270-4db9-ba85-ac3fc9bc36d6", "comment": "Malware payload (Mirai)", "value": "8c53553a9972542b4686542417cd902d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382639, "uuid": "f3ee94df-a842-45e9-bbe3-72e25f5235df", "comment": "Malware payload (Mirai)", "value": "2ee650b3c61c683abe5782f512e199cf26e10987febdd221c6ab3b86d87d77e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382639, "uuid": "490670c5-7023-4af9-a0df-f7b1f6bc1268", "comment": "Malware payload (Mirai)", "value": "f83ce57fc23808ab3ebbda0cd6f0a0a0add33416", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382639, "uuid": "34507487-2b94-4b58-b713-ec50730a1210", "comment": "Malware payload (Mirai)", "value": "1f9b2e160dc7178af610be00807393ac51db5963277dda825d26a36413630f10c435a11562a9e5f215a14001e081c390", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382639, "uuid": "3d4430fb-05b4-42c7-a627-5215c7a4d1f0", "value": "T15DE2E0BF905AB5B8D03549F2101DAAC2FC336507EAD35BA7486E92F58EF7E0A4111F81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382639, "uuid": "4c3625b7-2006-4395-9eef-dfa02a9e367f", "value": "768:Z/p1ZWauH+yF8qceWYlPxPzaZ0LM4boQcdG2COmgLbcpeQx0sc:ZkH/W4aoMq/cXmgH8tc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747382639, "uuid": "76f193d7-85eb-41b0-975d-701831e06bdf", "value": 34088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747382639, "uuid": "55e4cacb-8a7f-408e-8308-4965b6111df0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382639, "uuid": "46fe2fc7-44f0-4edb-b064-0e90ae6a75d3", "value": "neon.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a1cb2fc-31f5-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747359137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747359137, "uuid": "65d65e00-b899-4a1b-8a0d-f06686aa0286", "comment": "Malware payload (Mirai)", "value": "33c8d82a76acd4666416517516b69931", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747359137, "uuid": "9c417e8a-c623-44e2-936f-7b98503b8cf0", "comment": "Malware payload (Mirai)", "value": "2f1b1b59c4f4d73398fc009787e1fcf3460b8ac1fd07bfa6a1859b66e4a96dd1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747359137, "uuid": "52e282bf-3a3e-4b9c-8641-8f0951e4806f", "comment": "Malware payload (Mirai)", "value": "6a29538221187df4117f136d7beb3317ceacf49f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747359137, "uuid": "a306a446-6f48-4b30-89dd-382abc1e6f39", "comment": "Malware payload (Mirai)", "value": "16eabf923dd01a6f572a089056ef766f6499bbcc0521bf60162eab3923d17cf1ff15c74763fb88d17aba346454bc7a57", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747359137, "uuid": "720602d5-9f32-46de-89bd-2b39525c9450", "value": "T1A8635B35F935092BC0D5543A61FB4B26F5F287CA20A8861F3DB10E9DBF616503643EB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747359137, "uuid": "bfb6a372-d340-49e1-8cda-5fae819fdc3e", "value": "768:3xob2ZIim+ZuNTffPMyj84LMhQP7KtudM1KO+YHG5VCdGaa7vsR0Y+/lxYttlfJJ:3xA2CfRHkK8g7KtIwYYm5M0Y2l4tqW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747359137, "uuid": "c95ed51c-474e-4325-889e-7604e7001e93", "value": 72000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747359137, "uuid": "07eccb23-dc3a-42f5-8af2-073b8d8e0495", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747359137, "uuid": "f58a7dd5-77e8-471f-832e-00da2a8c610a", "value": "neon.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f886090d-3272-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1747412982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412982, "uuid": "7238d762-3be1-49e0-bf72-e9474969699f", "comment": "Malware payload (Gafgyt)", "value": "862a2a9227383beece29f0c1f98d85bb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412982, "uuid": "37584e07-704b-4350-80e8-71712ee1e5fd", "comment": "Malware payload (Gafgyt)", "value": "2fabdf1072a814a8a47121894983ec9458a92191fdb41c7f0a2bfff31d01d855", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412982, "uuid": "156d887d-51b9-4f3b-a8cb-b37393cd5ed7", "comment": "Malware payload (Gafgyt)", "value": "beab5815892be51c3358bb85e25c01c52ef1dad2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412982, "uuid": "ce4b4181-bccb-4cc8-98b6-09c61dc969ce", "comment": "Malware payload (Gafgyt)", "value": "244e4cf3e4e27439680279bba58623343c10aefd976386a763e91efa3188022784793f296a1951dee874a4b87ab65b91", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747412982, "uuid": "7f6179a0-b370-4d3b-9151-7ce9240d477b", "value": "T17754846A3E11AF7EE4E9877447F34AB08389749126A2EB55E36CEB185F302CD144F790", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747412982, "uuid": "c9d4ea4a-02a5-4bdd-ab51-148360ccfa5f", "value": "6144:it5ab6ZaIrfZ1dFBbr1mT+rL6uYcGOkq8WEDv:VbW5Rr1mT+rL6uYcGOkq8WEDv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747412982, "uuid": "5241ab17-f272-4c4f-9168-121382d69224", "value": 288345, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747412982, "uuid": "db755c8c-eaea-4fa1-857f-d08fb6d60c8a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747412982, "uuid": "e913c720-b875-44db-8d39-f56cc54dc3e1", "value": "jackmymips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4b34c8a-3227-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747380656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747380656, "uuid": "ac6728f6-3af6-44ce-bdc3-6334e86d7a83", "comment": "Malware payload", "value": "7ef7fcfdf9938fafa37babc36601e7dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747380656, "uuid": "96674523-6b1e-4707-a20d-9b79e14612e4", "comment": "Malware payload", "value": "2fb4eb0304ef4de81d8cd1d9beb301f83a4190eb30924ad38e526160cb852d6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747380656, "uuid": "19fc1f7c-40ef-43b9-89f1-9349279309d2", "comment": "Malware payload", "value": "09b34450cc82ca0db156c7fb337d0e3acf2b843c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747380656, "uuid": "8d25c3fb-a3fb-4317-81fd-562393bfdc11", "comment": "Malware payload", "value": "da15ba968343711abc5f9c52050b672479eedef2cde1daa3432a458b6123b60dfefc9f8476bbf2266b59b96a33daaa2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747380656, "uuid": "f5919d90-b5b7-4b1e-8153-18a2594d7f47", "value": "T1F784238BEA7D8621C5B4F7BE91C4B564DBEA85044583DF3D8C85834253422DAFE36CE8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747380656, "uuid": "4b0cab84-35ef-4794-8c02-0db0257198b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747380656, "uuid": "10659ce4-057b-42b7-95cf-80ad8a98f455", "value": "6144:3g/G7HWsg5CkowrmnAR+BjwAiaAUdMAzfXC/VhDu8SnFqEdmJHxSfzTywwQ:3geS5CkowqUU0o+ADy7SnFqEdCSfyw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747380656, "uuid": "186c821b-7370-46ac-b0da-9bcca0d9271a", "value": 378880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747380656, "uuid": "b8ab4ec0-56ea-4cad-bb8e-40342addc6dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747380656, "uuid": "e9415756-4da2-44d9-b2d3-da28a9de12ae", "value": "SecuriteInfo.com.Win32.MalwareX-gen.223.402", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f5c190b-3222-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747378339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747378339, "uuid": "7a2f5335-9ebc-419c-9ea9-33a5e842735c", "comment": "Malware payload (Mirai)", "value": "897d2eacb9a8dab78204c277921a455c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747378339, "uuid": "17cff380-71c5-4abf-8287-502ea444d701", "comment": "Malware payload (Mirai)", "value": "2ffb3f8f8d667d1aaa5744d1601fb18eb17411d37940eb6d3e485efe091e7426", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747378339, "uuid": "80790c97-0d64-4400-8eca-b50a39fed73d", "comment": "Malware payload (Mirai)", "value": "2727d6cb911f67439303e5f27aa703dc510aceb2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747378339, "uuid": "f26dab6d-ad59-45ef-a35c-2f36a7dee723", "comment": "Malware payload (Mirai)", "value": "ccc9a1cf501303150ba990704fd8217da30a2b57665242a968b761d93d8cf4ec28a512086f52d648760e7e33e6e9f843", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747378339, "uuid": "b66a6e3f-5593-487f-9ac6-6baa5802e56b", "value": "T144E2E1B392A2573DE42D21F6485B0DC0FD32DD36CB0A5BB708A621F65DBEC286928341", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747378339, "uuid": "27fadc14-53df-4a5f-bbfb-29ade323bc4c", "value": "768:0YbpLS3gj6woRYq2ed207dThFEvs0tBRzEoaEL2YM3x0si:0kpBoRYWphPEvZhoBELVWti", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747378339, "uuid": "76ddbfde-2ede-4ba0-93b1-b6145c1138de", "value": 33464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747378339, "uuid": "4931d9a1-0978-44fb-b395-5663a1d15689", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747378339, "uuid": "45345dbd-4494-4666-89ec-e5335a716c15", "value": "neon.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bc2c4f7-326f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747411296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747411296, "uuid": "bd97b4b8-97f1-42ef-a3ba-f0863cc1cee7", "comment": "Malware payload (Mirai)", "value": "6a1ec4566aa7fac9abdff4ef25e595c9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747411296, "uuid": "837cc4c2-6209-4f1c-823c-69eb4a099fa7", "comment": "Malware payload (Mirai)", "value": "2ffd2cb97f86753b230ab4d56262c85af73696647e912c067c7dd76cefa14484", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747411296, "uuid": "5d98fcbc-97ce-411a-b56b-3ebc2e4cbd05", "comment": "Malware payload (Mirai)", "value": "5b7e11a67580e482e153186364a0209cd6faf527", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747411296, "uuid": "c3a153f7-5be3-4895-bd9b-6e3eb1641cec", "comment": "Malware payload (Mirai)", "value": "de42db0c4550bc4e62e1df33fb3e790851a530ec9f3c0189e620e8b4cb1cd6ec46197a7e1b116193dfde51d25871113a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747411296, "uuid": "4294950a-2ffd-4d4b-b18d-d46f54ee97bc", "value": "T190D33B46FA408A13C4D51776FAEF41493322D759E3EB73068D189FB43F86A9E0E27606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747411296, "uuid": "6c97d01c-6976-400d-8578-a58da6865899", "value": "3072:CmKgAoWKd8qj9mrsplDKZUTQBKXAVanoX+F8JyvgV6hLm8roBu+utx+niUlZlbMt:CmtAoWM3j9mrsplDKZUTQBKXAVanoX+B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747411296, "uuid": "d715ba9c-6c52-4f5b-8ae6-0614b1804719", "value": 142029, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747411296, "uuid": "51303796-0fce-47f6-bd75-b4607c7ca528", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747411296, "uuid": "ed08a91c-1bcc-4d95-af51-e0c3a012066e", "value": "z3hir.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "558f67c2-325e-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747404119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747404119, "uuid": "fac518dc-22da-4287-bb06-d18b61fd0534", "comment": "Malware payload", "value": "bba2ff4902673cfcf29e3bf6bd66ae34", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747404119, "uuid": "f61af0eb-85fa-4ac9-b2fb-d239bdecc3f7", "comment": "Malware payload", "value": "3034cfc18e2e6a0766c9659b6fa5173825b820789962b00492a87051dc60484d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747404119, "uuid": "5e283e0e-0207-4007-90e6-89652a3fe512", "comment": "Malware payload", "value": "89ea5d6112e1cbcb561a5cd7f04e90a62a600e54", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747404119, "uuid": "b13fead8-c815-404a-8635-a9b6752647eb", "comment": "Malware payload", "value": "2068d0fb7ba314373ac1606f53bfe440cf68c09a3f71c28b9ecfa9d8e5983a77cfb4d6014d347b5dce531fd9bc6dd871", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747404119, "uuid": "e74b041b-1c87-4404-89dd-c09e77f0708b", "value": "T1215100153C402E5413060FEB1D3B91E4E66DA9AF3EDA088BE448EE98BD19624F0D7938", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747404119, "uuid": "40602437-769a-4dbc-9eb8-db745db09c2a", "value": "48:a8MB2Bf0wh+g8613jzPYK2rM3ZIVvP9fNt1CTrT1LqdBPauUeG:dtf0wh+g86F/PYrrM3ZIhJha9+7PbUeG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747404119, "uuid": "1ca1c4c9-291b-47ee-bfbf-4bc4191df1c4", "value": 2769, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747404119, "uuid": "716e104c-b200-4cea-b518-f6adbbe7b0a7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747404119, "uuid": "a1ecf5e3-932a-40a1-9b41-44df09963045", "value": "xf_addon.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a100378c-3265-11f0-8bd0-42010a9c0005", "comment": "Malware payload (SSHdKit)", "timestamp": 1747407252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747407252, "uuid": "2738bdfd-9e7b-4fdf-90a6-93082da1e1d5", "comment": "Malware payload (SSHdKit)", "value": "7ee1ef10acc726e8b15225afb310cf55", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747407252, "uuid": "f81b00cd-f1eb-4bb7-882b-362e83478ddf", "comment": "Malware payload (SSHdKit)", "value": "307dd90b193caa2c029e8f5784b33a36157b3acca872a8e4840618cef1e637e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747407252, "uuid": "4fa97873-6512-4cd9-9251-17af09dc7263", "comment": "Malware payload (SSHdKit)", "value": "de95ef7fe37fff23349ddf36748a7ca5a7ecf9c7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747407252, "uuid": "3990f746-852b-419a-b1e2-546afca23bc7", "comment": "Malware payload (SSHdKit)", "value": "8cfeae4467124bb9561ac4d7627c603989dcea5c38aa670ae7c0951918b314b84704d5c99443b39f37f04d0a52c75c80", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747407252, "uuid": "a915236a-83ad-40ab-9ade-f91592f59ac0", "value": "T191356D56F9808EA2C5D8177BF75D835833134B78D7DEB102CD08672877AB95A0E3B982", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747407252, "uuid": "72c6fbda-866d-4d76-8e11-222006274247", "value": "12288:E8dASOYRNCAJump208iJftl7zufSrlcaUxQ5TVFQGl9eLtRajZa6ZTxIVD7bLv:E8dbbsO38+TfgRinIVvv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747407252, "uuid": "fc9f2356-8b39-4c8a-9540-1f768855164d", "value": 1110304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747407252, "uuid": "1940e166-3443-4359-bfe8-9ef75b55b4ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747407252, "uuid": "561725ec-dee1-4fb2-ae87-893216a0c5f7", "value": "sshd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00dbfaae-3223-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747378636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747378636, "uuid": "62f4b7a4-7f35-49e1-8117-c60a27533db6", "comment": "Malware payload (Mirai)", "value": "2455561938255c550f156386feecde20", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747378636, "uuid": "8d13fafb-f04d-44f1-ae50-3b370bef831c", "comment": "Malware payload (Mirai)", "value": "30ff480db8fee1e90230b707817e9496626efd8c3fba2c993728ab8855f5a63e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747378636, "uuid": "5fa11274-1509-4f05-859c-ae5b7023ae80", "comment": "Malware payload (Mirai)", "value": "bb741e16fda68d63073daf84604a0cf708960bf8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747378636, "uuid": "c7e43a8f-da57-4f1e-a578-127e260d3a9d", "comment": "Malware payload (Mirai)", "value": "76e2aa9ee0f32ef5777b1c2e83fc6ac68e0609fc95a51d5a92aec6772b5138b08b663804f1521f63be0edfd1c42ab079", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747378636, "uuid": "0771e47e-27a7-4fbf-b61e-aae941fe6e41", "value": "T108E32A46E7408F13C0D61B79B6DF424633239B9493EB73065A28AFF43F8269E4E67905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747378636, "uuid": "57b54f9f-f9d6-40a5-bc65-f4341f96ef42", "value": "3072:2gM0haIMGh/GmHKnze2PlDOvJnFLcM/95Qdn+:jDhaIMGh/GgKq2NDSJnFgM/9Sdn+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747378636, "uuid": "5c20487f-90d0-4275-ac0c-bae7d4579ecb", "value": 151483, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747378636, "uuid": "4e7fe1ae-c71e-41f4-88e8-b49647e20e41", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747378636, "uuid": "92faf7fa-8909-4e1f-b083-6149607d8d2a", "value": "neon.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ae0cf5c-322f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747383834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747383834, "uuid": "cfb8ec5c-2ccb-48f2-bd02-a14120a5d853", "comment": "Malware payload (Mirai)", "value": "37f5404d242051731dfa7cf7474561c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747383834, "uuid": "7ac728f2-95ab-47e4-8009-cbfc0164f883", "comment": "Malware payload (Mirai)", "value": "31599c426e5fd058ffb2b7797a4217a7c5fcc1db4c7c1d959b6b7884eca176a3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747383834, "uuid": "00345dce-684a-4ae0-a4e0-758b2f0cf5d8", "comment": "Malware payload (Mirai)", "value": "fae4106df915f9831274098a38c2940c8f9724f3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747383834, "uuid": "f1547841-441c-40d7-9755-1c55099a9e82", "comment": "Malware payload (Mirai)", "value": "c7798c0f14b1b13706b11881ab7e5fce7b504e2b21e08a42f0bc2d3932f2008960d2370ac7bf1aeb11902a09bf96aec2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747383834, "uuid": "18ec0417-5a45-4e5c-a47d-27d326fa63ab", "value": "T1DBA3C71E6E158F7CF79D833447B78F219688338B2AE2D145E15CDA015EB028E741FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747383834, "uuid": "b15042e6-5864-41f3-8403-77b2cfeda733", "value": "3072:RucT7B75gVPUbcP67Q6GdzKjqzUNa0jLmCW:Ruc3d5uP6GJKuaa0j2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747383834, "uuid": "fa657d39-bd7a-4a97-a480-761df8414941", "value": 101148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747383834, "uuid": "b9bf297f-9035-49ba-8dbc-8cc9605fe8ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747383834, "uuid": "69709d9b-13df-412e-a173-88dcf7ddddff", "value": "UnHAnaAW.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d8e4b1a-3235-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747386442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386442, "uuid": "b865401b-2efa-4f55-b234-7fc30096f2e3", "comment": "Malware payload", "value": "e015affc040f9ad47040eceda24f940d", "object_relation": "md5", "Tag": [ { "name": "196-251-90-185", "colour": "#01F3BE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386442, "uuid": "4d5b2361-fe32-47d8-a3e5-4213d69b3fa6", "comment": "Malware payload", "value": "3170b588f24d7175df1bcb15b77f5a7b92a21c5dff459cdac68e29fe45ed6ddb", "object_relation": "sha256", "Tag": [ { "name": "196-251-90-185", "colour": "#01F3BE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386442, "uuid": "6f13a181-43bd-4240-ae59-24908b0980c9", "comment": "Malware payload", "value": "81644fe99fd71fe9c1f3f353679c68783db0c95f", "object_relation": "sha1", "Tag": [ { "name": "196-251-90-185", "colour": "#01F3BE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386442, "uuid": "d2ccf52c-453a-44a4-8997-daa5de3a9d6b", "comment": "Malware payload", "value": "f48d3bffc0c450bd3c654e7cc7488081ca25819523ec1df5e716a0ff780b5a54157fbb27f7267c12ab1af18abd34e35c", "object_relation": "sha3-384", "Tag": [ { "name": "196-251-90-185", "colour": "#01F3BE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386442, "uuid": "2a5a7a9d-86b3-44a9-a709-3109ef00d7d0", "value": "T14E11884577119EA7EA17C575B1832BC8534095A028A0C00B784C5D107E02BBACD94D9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386442, "uuid": "5f058948-4c40-4613-97f8-07baf6313899", "value": "24:9c4g9ZJjlmiviHDDiPzixAB0KkCLBZ+5ag9y:9c46miv4/irixpKPLBZ+kB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747386442, "uuid": "fab58820-d05a-4735-a524-749403500829", "value": 943, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747386442, "uuid": "03532dc1-37d1-4eb3-803e-9e19a653dfc2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386442, "uuid": "91922f1f-a17f-4ae9-892a-3c426d634096", "value": "Markus - Kaufvertrag Daten.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "169dd9a8-322f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747383827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747383827, "uuid": "797919b4-c81f-4a6d-99fb-f9ce180e6e07", "comment": "Malware payload (Mirai)", "value": "491dedb7e89601ef8dbd1645c9a0fa03", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747383827, "uuid": "0955fae9-f1ee-45f5-bfc1-c875b8dce108", "comment": "Malware payload (Mirai)", "value": "31817df389392020e311cc9f16e4779e51df75fad57bc25ca4c5b4c8fd1f73dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747383827, "uuid": "30a6e6ed-f134-4df9-82ee-47eec989b639", "comment": "Malware payload (Mirai)", "value": "586ec7b34064575e3da5f1e5b7f32892592103e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747383827, "uuid": "eca475e5-369d-4cab-96d9-fb59a584a26c", "comment": "Malware payload (Mirai)", "value": "038effa3db1560312167b105e504608bf51d1ea53629508c5c25e0f6412c6031e684064d7eb949e6789c77ed8ee10978", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747383827, "uuid": "fd0fb18f-47f2-41bf-ab3c-fc11a26d4538", "value": "T11653E9627C926A2AC5E063BAF6BE518D332167B8D1DF3217CC212B057BC551F0DA7B81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747383827, "uuid": "1235a39e-fe5a-4a85-98e1-ab20be70b7bb", "value": "1536:omHfUXVywKHMIeVOeKSs2KlkaLFgiZu6Kjoh+tTnS:omHfUl1IFM6KEhqT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747383827, "uuid": "4c243be8-8140-4bcc-afb9-2b62b3f4ad9f", "value": 62700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747383827, "uuid": "961beb54-4fb2-434e-b641-d8a0c592e187", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747383827, "uuid": "198aed8b-7a9f-42b3-90a7-3d95d0e731de", "value": "UnHAnaAW.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25778a7f-3238-11f0-8bd0-42010a9c0005", "comment": "Malware payload (SSHdKit)", "timestamp": 1747387717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747387717, "uuid": "b9e17e69-0b87-4f14-9643-bc3d4ae58598", "comment": "Malware payload (SSHdKit)", "value": "4f73b385be8c45e15123898a8fbf81fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747387717, "uuid": "6306de41-03d9-439e-aa0f-d06141fa59d8", "comment": "Malware payload (SSHdKit)", "value": "318d13ea6f7ad7c57c79b90d8b39551e1b4c6b1419ff53fca12a61594990c1df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747387717, "uuid": "b6c93264-dc39-4337-afda-b53e4a8ce0f1", "comment": "Malware payload (SSHdKit)", "value": "8d3fd296cc8f16bc44be39f32766e39dab9d74d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747387717, "uuid": "d2ea6dd8-218c-4a1e-b0be-0b6566461256", "comment": "Malware payload (SSHdKit)", "value": "75fb6cb511b1a5d7de4fd57a6fe126147136cf876cc53ee80038300c9dfd24f89ad50ca717aea2cd21b78a16f1e7f58b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747387717, "uuid": "7a044152-e2d1-4e6c-86c7-30a6059beb80", "value": "T164356C56F9808EA2C5D8177BB75DC35833534B78D7DEB102CD08672877AB94A0E3B982", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747387717, "uuid": "40265851-f97f-4fc8-8af3-01e9577ebdaa", "value": "12288:00Bw2wHeeJgR3asIAksAi0uObzkzOgFr1qwRcFjV1D7a9KbsaKjpeFmz4T28bL9:00BnRED/TwOjX0a5xTd9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747387717, "uuid": "0078b52d-4e4a-450d-af4c-9f1850968742", "value": 1091285, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747387717, "uuid": "8994aae0-7cae-4bf8-bc43-df04ecaa1871", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747387717, "uuid": "3b60976a-94fb-46df-8736-48f8e4eefc25", "value": "sshd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0e8d485-31f4-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1747358826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747358826, "uuid": "19458a6f-4439-4e0a-b314-4498da8d33f7", "comment": "Malware payload (Prometei)", "value": "7b5cfe6f478c3c2b6342260d2f8c2db3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747358826, "uuid": "a8b6cf99-ab98-423b-968b-0b2c957475b6", "comment": "Malware payload (Prometei)", "value": "31dd319f1197c249b994f46beaa29d51400fa8d632e6df6ea4200f455bc2255f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747358826, "uuid": "4f4175cf-5c31-49d0-bf2a-52687dab19a8", "comment": "Malware payload (Prometei)", "value": "677199ba0b8f8761a1b0aa78599f5db816924cf5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747358826, "uuid": "caf961b6-ec91-4470-8ad4-b5a90e16e586", "comment": "Malware payload (Prometei)", "value": "d1d6ca10e30f1417f085197f74d8b7c106dc79a9e3223bd204cecd8697a8ec5e0f6cbdd7b821b80513fff83a34c8c02f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747358826, "uuid": "ba29ef23-e3a1-45f0-977e-137660e01160", "value": "T1239423F8C83D2E3098169B3CBB5A826CF0A15772D9562F6AB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747358826, "uuid": "b7b11e25-ec79-4819-bf16-74f71518840f", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgK:25WOSACZSV6eKRH5EPiamb4DsDwwca", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747358826, "uuid": "4b048de9-4f5a-4b3f-9b15-f273b0cf6c21", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747358826, "uuid": "b6166906-3c46-4a47-8134-e0f219ca27eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747358826, "uuid": "fbdef6aa-2d1e-47b4-bdd7-a2e25bb12ddd", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b955200a-3228-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747381093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381093, "uuid": "b71fdad9-ce0c-42de-8e2a-432f28e448f2", "comment": "Malware payload (Mirai)", "value": "a2418011a0a53962bcc12563c06b318c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381093, "uuid": "f78b45cc-64ff-4ef6-9e36-f84ff6083dd6", "comment": "Malware payload (Mirai)", "value": "31e4c3a6fb88a622529d4ad2c7eccaa13bfcb38b1b83a1f31db1267c81a9dc82", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381093, "uuid": "2de288e5-fbcd-455d-b639-b38ecea8a340", "comment": "Malware payload (Mirai)", "value": "2e598381488002ffc9daa36d1a728dc3ded030ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381093, "uuid": "7cdd6321-d078-4a63-a74b-fab557ca1156", "comment": "Malware payload (Mirai)", "value": "0c6781d447272ac17bdb3db51df9742841ce9fb0ed3e72e24eecfb8c905e6747dc4d2464994e5ed8c9b254b63e1f0047", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381093, "uuid": "bd520939-ee05-4250-83ba-28be6ba97955", "value": "T141D30945F8504B23C6C611BBFB5E428D3B2A17E8D3EF720399256F60378695B0E3B946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381093, "uuid": "2ff5b341-6cbc-4a0b-8245-fb20b7388d9a", "value": "1536:wKdzElm18uZJNb4A4Fa8eAZHk4VB7fzTTfHh+gYSvvqeqZfB20ly+wyw6RNP8TGE:wKp50XU8e947LPHh+zS6thBZ6xKe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747381093, "uuid": "669de857-e144-435c-b89a-bdc9d36136d6", "value": 133920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747381093, "uuid": "64de348c-d283-4a52-9979-2586751d06bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381093, "uuid": "5f50f5ce-0ba4-49c7-9c23-c8ea5581efa8", "value": "main_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a00caa0b-324c-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747396513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747396513, "uuid": "bd9f1a34-e58f-41b0-a523-7fbce8c0fa9e", "comment": "Malware payload", "value": "db91bdd9620c3b656c8351793dae95bd", "object_relation": "md5", "Tag": [ { "name": "1po56mdxc-localto-net", "colour": "#E5C76C", "exportable": true, "hide_tag": false }, { "name": "AgidCert", "colour": "#56D604", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747396513, "uuid": "17757868-c936-49f9-8602-23e25cdb6f5d", "comment": "Malware payload", "value": "31ef1dd3e4265c40bfcdc5fea17f5c9f2a27e9fa9907eff8b89ea2635b11169b", "object_relation": "sha256", "Tag": [ { "name": "1po56mdxc-localto-net", "colour": "#E5C76C", "exportable": true, "hide_tag": false }, { "name": "AgidCert", "colour": "#56D604", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747396513, "uuid": "ed1b0fb9-115e-4be3-8182-d8f8a334f58d", "comment": "Malware payload", "value": "cc6f7768fc3ba2e27e8966028e60c6bfd69f46a2", "object_relation": "sha1", "Tag": [ { "name": "1po56mdxc-localto-net", "colour": "#E5C76C", "exportable": true, "hide_tag": false }, { "name": "AgidCert", "colour": "#56D604", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747396513, "uuid": "b3e68ebb-4056-4937-abd9-fbea4396ace9", "comment": "Malware payload", "value": "34aabe2a84df211df53f6848e8c9ef3557e2fb2adfb059a5cb3e200ebbab3f8e4a6c3ba5bca832be752f68e435e30a89", "object_relation": "sha3-384", "Tag": [ { "name": "1po56mdxc-localto-net", "colour": "#E5C76C", "exportable": true, "hide_tag": false }, { "name": "AgidCert", "colour": "#56D604", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747396513, "uuid": "68871ee0-c5ea-4300-824b-01d6e024d02c", "value": "T1654602A7AE9AC528DE6744F391C28391E43F15E5AC0B907E03A05D85CA20D8BC757FF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747396513, "uuid": "f25d591e-23ac-4290-9eb2-8aee0552e048", "value": "98304:xyl/zNubJnOTdzn0gAjgNFq1DfOYjeq1GlvShaJEAWlCXcl7REPTD1br90DwL:xbbJnOBz0Dj3DW7q1EFE9BdRELdX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747396513, "uuid": "0f33d823-1fab-4c98-bd9a-771312b51023", "value": 5587232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747396513, "uuid": "025482b6-4f78-4ab4-8d3a-1488e710a50e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747396513, "uuid": "dbd42ee6-77a1-4f82-a874-190e4220c15e", "value": "InvoiceXpress.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01e8c7e6-3288-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747422017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747422017, "uuid": "d0d9a5a4-f645-470c-a2f4-cf99ea031ee8", "comment": "Malware payload (Mirai)", "value": "3363ab9906f49289bc8062e27ff31f9e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747422017, "uuid": "9e2827ca-f56b-4fe1-8e3f-07ef0f336e47", "comment": "Malware payload (Mirai)", "value": "320dbdaaaa512c548867ea08ac354ab7479796fc57a741afecabaa2a0d9dbd35", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747422017, "uuid": "d8c0631d-d1e8-45b1-80b2-320b51a0317e", "comment": "Malware payload (Mirai)", "value": "4156714234287f64ac1342e84eaa15475cacbdf6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747422017, "uuid": "e85083f8-a973-4d85-8e99-d8a005376419", "comment": "Malware payload (Mirai)", "value": "50645fd47a31c968a27eccf1461d35f40288c034cba08866f52a440dcbd0acd92b8df6d0dc937a857e088632d7c6737d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747422017, "uuid": "609f3ec3-b954-483e-94bf-131b42e76922", "value": "T1E473AEA2C0652DA0C2684138B5E6ED381B13F50196762EF04E568BE2650FEECF51E7F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747422017, "uuid": "c51a4823-786b-48a5-abe3-b0116e7a5ee8", "value": "1536:E/Dnw/bqTmxwJaFwtO/WlP1Y11OCrQq8xy5ESwMDrBG0NMxCS2Ax:EbnwO6xwJCJu5i1wCJWjMDFGkMx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747422017, "uuid": "6713977c-e20c-4e39-9306-9cd7c9f5e254", "value": 74804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747422017, "uuid": "2f13bc81-3e58-49da-bd8d-f2096ed882f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747422017, "uuid": "b23bdcfc-c150-4054-869e-a19def9255aa", "value": "db0fa4b8db0333367e9bda3ab68b8042.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f87b09c-3236-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747386821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386821, "uuid": "221b385e-8bcf-4c15-8853-d545f9045a14", "comment": "Malware payload (Mirai)", "value": "c76504799b365b7c32771ca7113bf734", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386821, "uuid": "6b2c4f7a-6228-4fd2-8003-7f9fd4eee8d2", "comment": "Malware payload (Mirai)", "value": "3220874a2ed986617d380a0b24196b744e3d541c5ac0e7ee9beb17288cd7b859", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386821, "uuid": "0fa92031-a07e-432b-86d4-edc9f890f4ad", "comment": "Malware payload (Mirai)", "value": "ea7ed6f5171ffc9201e95acbe748914173d4c883", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386821, "uuid": "bceb94af-297e-4a40-8556-a75d84bb3064", "comment": "Malware payload (Mirai)", "value": "3a37f0c4d1fffdcd3aaefb3525567df1527e48acc6a2279d8231ebc0cfe470d238f988ed4602661fd82ccb9f2516cd9f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386821, "uuid": "5c456c79-041e-4759-89fa-90aa92d24d67", "value": "T197A2D15203656660CBB04A36F56BCE466FC706F885F0F13418ACC35DD65A8CEEB14ADB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386821, "uuid": "af865781-8a97-4a64-b6e0-9de9fd829439", "value": "384:C2OSC4utfz7diFRynp5G3Gm7UvGfTHv1OsolhymdGUop5hXU:hO74ulvcynp+7Uv+Olls3UozJU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747386821, "uuid": "22d604c5-ffae-43eb-a2dc-9492797b6184", "value": 22756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747386821, "uuid": "8b8901eb-a8a8-450f-a2e7-57ed5571ffb1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386821, "uuid": "2d316c87-9fad-4c3b-ad1a-5113211e815b", "value": "Mozi.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2666d73a-32b1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1747439688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747439688, "uuid": "44e97ca3-f026-4f51-a09a-d80629369768", "comment": "Malware payload (Prometei)", "value": "3500e805ef9e30cc37fcbe23b13c25b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747439688, "uuid": "b80297c4-b447-42ba-bbaa-e08ae1c07c5d", "comment": "Malware payload (Prometei)", "value": "3221b89af791f7df2cfb75427339bef7028e76b3e889cb2fb5b6ee45f1fba329", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747439688, "uuid": "72084b41-5e2e-4fa4-950b-5b3557276fea", "comment": "Malware payload (Prometei)", "value": "dbb40c5328594c71408f4a672d9ccbc553eb9039", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747439688, "uuid": "ab1da0f7-e853-471c-9843-6af8ca45d871", "comment": "Malware payload (Prometei)", "value": "2386526158a1d0e4c33b02175ecaabe7cf837fc0ea640d8d0c0a17bc6cea2c3f2f7f135059b4e1991cddd62875979419", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747439688, "uuid": "2e0bf944-970d-4443-8478-61f139b676b6", "value": "T1EE9423F8C87D2E3098169F3CBB1A826CF0A15772D9562F6AB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747439688, "uuid": "063feee0-50c1-437f-96f5-e0f2cacefaae", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgN:25WOSACZSV6eKRH5EPiamb4DsDwwcd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747439688, "uuid": "5e4ad606-cbe2-42a4-b30d-2d0b607f201c", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747439688, "uuid": "b0cba661-fa58-467c-8027-696a2c28e1be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747439688, "uuid": "6ea694e8-50a4-473b-be31-53f55d96c663", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0d0cbd3-3283-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1747420163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747420163, "uuid": "d401efb0-0338-458c-93d9-babe13a68911", "comment": "Malware payload (Prometei)", "value": "e5c13327f62df089b936e720d9668503", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747420163, "uuid": "95c5f8d0-7c7d-43ee-8e2d-03454de8cfbb", "comment": "Malware payload (Prometei)", "value": "32931f0cbf6285af314a0273a79e45483b432c1ece83860496257889c33ea0c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747420163, "uuid": "d1676f54-dc42-42b3-ad7d-01dfe32f857b", "comment": "Malware payload (Prometei)", "value": "3bddbe6a96f6f845240f66469323868c81d270d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747420163, "uuid": "2868fc0f-e269-4bd0-be2a-89cb4361cdc7", "comment": "Malware payload (Prometei)", "value": "6d349a80c2aa96db01bd3f9c59af5634b44295e19534e5930f4835b3f925793ad23cf5a74efd67473f396ee2b2ef18dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747420163, "uuid": "643d5e5a-8176-4314-a90a-7296ae50be50", "value": "T1EC9423F8C87D2E3098169B3CBB1A826CF0A15772D9562F6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747420163, "uuid": "85bcf19f-ef38-4624-b878-bd57f978b030", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgp:25WOSACZSV6eKRH5EPiamb4DsDwwc5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747420163, "uuid": "8102502b-3f21-4c89-a336-998d21b83e50", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747420163, "uuid": "c04d58fd-278c-4e1e-b0d8-ad2bfc5789f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747420163, "uuid": "0f9229cd-96d1-4aa9-9174-a412bfa13ae1", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "690350e1-327a-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747416177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747416177, "uuid": "a2299c73-0b3a-47c0-9604-127e9b084ae3", "comment": "Malware payload", "value": "0c5b6d2241d0e6c2a96b73c95469ca6a", "object_relation": "md5", "Tag": [ { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747416177, "uuid": "c70b59b5-30b1-439a-87c4-6019b83ed2e3", "comment": "Malware payload", "value": "3298110eee301919f49b27e9df352427ba0c0f526bb960bec6d7e726d7d18585", "object_relation": "sha256", "Tag": [ { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747416177, "uuid": "1536571d-be27-4b92-8f08-4a1300786a88", "comment": "Malware payload", "value": "d3202951e4f5654838df07a9a568cd320b8271d5", "object_relation": "sha1", "Tag": [ { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747416177, "uuid": "d217d2f1-6e31-4d2f-843d-082c5017d0b8", "comment": "Malware payload", "value": "6bc00c1b01e3c9641af2a2153d3c07c6e28f62814e1f060da48741cc6985948c27930b80736b88062039ae8348c7ab19", "object_relation": "sha3-384", "Tag": [ { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747416177, "uuid": "00ce90fd-5a6d-44bf-80d7-fcf147e54c17", "value": "T1F8C733E3B325BC79A3DD4037865CF8025A62B9D8F4B8F8A89D9042F147F620565B7F12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747416177, "uuid": "0acb3d1b-1217-43fb-a013-d705de63594f", "value": "1572864:iH5T6HdnXFtGCpHg7Xfsq7HHTKHanbQFd9AHg7Xfsqwf:e5T69nXQTHTK6Cu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747416177, "uuid": "cfab361d-4dea-484e-92c1-c86a259b1268", "value": 56730119, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747416177, "uuid": "47085fd1-47f8-4b51-9bd1-8effb20e6f80", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747416177, "uuid": "924868fb-170a-4f37-85a4-c92badaa79ec", "value": "EaseUS_Data_Recovery_Wizard_Portable_13.5.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8482eb2e-3255-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747400332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747400332, "uuid": "4e69576f-9d96-4b4d-89e5-f0bc92d5ecb7", "comment": "Malware payload", "value": "d5051678f8a793dfc15485cb49849786", "object_relation": "md5", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747400332, "uuid": "8381535b-5ce3-4462-8773-a3c624dcef5e", "comment": "Malware payload", "value": "329ed83dfcc089dcdb55badf59b718fcc7b54098ff4d9c16c071cf361dba5430", "object_relation": "sha256", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747400332, "uuid": "6b078085-7fc8-455b-af14-6bdf14bade53", "comment": "Malware payload", "value": "08c3977d9fc18550468086a1c3ab89968f332c8e", "object_relation": "sha1", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747400332, "uuid": "54c80821-b98e-4a05-b78f-d2961b91e821", "comment": "Malware payload", "value": "0c90af6fb5d2bc4738692287fba78bcfd058cc0cdd672bc593bd0392aeb3836cd4d3356cb89d771bb546b68b02e7d951", "object_relation": "sha3-384", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747400332, "uuid": "e4c87265-2b97-42d2-ab54-e4893c12f16e", "value": "T17C853802FFE1FE13D464037A99FB47653275EC81AB53470B1248B71A2DA13D81B9B2E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747400332, "uuid": "fa946c8e-92e1-4d18-baec-c1ef0fdb92e2", "value": "49152:OJx3B9jzWOYUanmdgpOTZC/KjI9hskFd:OJxTaORanmdgI2Ke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747400332, "uuid": "4d8002c1-03e7-49c1-ad97-946d717b261c", "value": 1774592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747400332, "uuid": "937fd270-6990-4b58-ae38-efe1b4386f56", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747400332, "uuid": "c1e0dd3c-0cfd-4534-821a-0f82e12109c3", "value": "RFQ#TLPO15-2025.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfe55d3d-3225-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747379843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747379843, "uuid": "81520ca2-dc73-4afc-a86f-2e3009f6edf3", "comment": "Malware payload", "value": "35a4c68b9566ce7354d2118a33ed70ee", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747379843, "uuid": "875cfcb5-776b-43f6-9451-35e7dce5da2f", "comment": "Malware payload", "value": "32ae4cdf5530ac01c5996f2736bd9b53b6de5936cdeac24ad03b125b24cfe762", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747379843, "uuid": "2eb3f33a-51c3-4570-8357-f8ec16fe957b", "comment": "Malware payload", "value": "2c644ed4f21efeb3642dc36c263c3933a8d0b2e2", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747379843, "uuid": "b4b514db-a5e7-48fa-bba5-4caf449b737f", "comment": "Malware payload", "value": "5bbdfe55c5f743801fad576444f008056030966ed572c2fdc7c0719ae993116e5c6dccd9118c93cd4c1a15186fd7595b", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747379843, "uuid": "0310285e-ae8b-42a0-9a27-7e4bacfef7d6", "value": "T1DCF054F7CCC3D44FE20020448E99527856CC0287089BD99E89F8A8D47D7524ECC1B438", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747379843, "uuid": "93ee87b5-50eb-4b0e-8591-ad976a8aa023", "value": "12:kxvsCk9cE3Mod/XUhJ/TlHy6ahtP+YmDccY0fYI:kbxu/kxy6yEY3dI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747379843, "uuid": "6686c816-50bc-4ac6-9b51-8735c6a7bc05", "value": 497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747379843, "uuid": "43d24a95-c7ac-4e6d-ace1-ce1f200d1b33", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747379843, "uuid": "a967bbf4-b41d-42b0-a940-de40ba7ee6f8", "value": "fuck_niggers_49.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02f90100-327a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RedLineStealer)", "timestamp": 1747416006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747416006, "uuid": "3087d6aa-b645-4f62-987e-b2fe3e908b36", "comment": "Malware payload (RedLineStealer)", "value": "85c0ce17cebc17a4aedcb2cdbdb5e096", "object_relation": "md5", "Tag": [ { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747416006, "uuid": "50320841-c741-44ad-83f9-cffb1000b652", "comment": "Malware payload (RedLineStealer)", "value": "32e8753ae154fe26da1c41c292a0122483f156653e9f9cd510a4b35cfa7e6ab5", "object_relation": "sha256", "Tag": [ { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747416006, "uuid": "2c47dfee-b632-4897-ab9e-519ce69a44c4", "comment": "Malware payload (RedLineStealer)", "value": "4a5c8da7fcf404489ed8341dcc88269741dcf7dd", "object_relation": "sha1", "Tag": [ { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747416006, "uuid": "38e278d7-b7c8-47a6-aa0d-e5c0e48c7b0b", "comment": "Malware payload (RedLineStealer)", "value": "4dc7ce2d8ea65b0187a876e4d6125ad52250813e0de7700cb840819175b3b9e378865190fd677aa66ebab934562a57d0", "object_relation": "sha3-384", "Tag": [ { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747416006, "uuid": "eb35c7ab-b64a-44c4-ba37-bb396369df9b", "value": "T1DF55337F9099B26BAF47083E1DCCE5F59420D7AE14F9444CC938692FE618CD36C4A27A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747416006, "uuid": "38b74a43-9ab7-4495-beb5-7d3f9e3c921c", "value": "24576:PAnYLTzk6dbiE9WPUBD/u0zpe00lZMPvFpPEBCB4k8v/GT+QmcL:PsYL9diEuUBDxe00zivDPEBCBF8v/onz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747416006, "uuid": "c468015c-59d8-45a0-a443-b60a9e50ab08", "value": 1381789, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747416006, "uuid": "1e9d1f39-e6b2-4965-8583-3190b26d4322", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747416006, "uuid": "e73c11e1-fa99-4ea2-b76f-7feef8a3eb66", "value": "DDOS Tool.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "774ff492-320e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (ValleyRAT)", "timestamp": 1747369816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747369816, "uuid": "a5f0d7b2-6740-4b35-a353-fb61ec0c5da5", "comment": "Malware payload (ValleyRAT)", "value": "9ee0e2f06217d37cbece4c47f1c22895", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747369816, "uuid": "43f73da8-21aa-4a1c-b30c-e80864bdb5ab", "comment": "Malware payload (ValleyRAT)", "value": "3382f1e8b4497600245423aa6c45361006509702eb34ce6f37c80acf88b9cc51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747369816, "uuid": "a127bafc-54b0-450a-83c4-1d53ba15ed0a", "comment": "Malware payload (ValleyRAT)", "value": "b195f59aecceed4ee0551d20767f77b252fcdd90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747369816, "uuid": "90c62cdd-5f7a-49f7-ba33-0d5d027daeb0", "comment": "Malware payload (ValleyRAT)", "value": "703593bd0af5da264f5b74f3b78df29f4f542b104ad85fe0bd13e35e7636a46a043719d4b94b3477f50e0df352db62e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747369816, "uuid": "5c3a0758-f705-48ce-91ce-661bba66766c", "value": "T136B37B2172A0C072D092253199F9EBB24E7EF93117B845CBB7E406BA5F603C16E7539B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747369816, "uuid": "3252a25c-1863-4b8d-a99a-d191188ca493", "value": "b8bf08fa843a9ec1ce10d80fbf550c26", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747369816, "uuid": "052a2d85-e098-4b13-bd70-34d43b5f2bb6", "value": "3072:ybWjdIPbcia0NFtwwnILn3py6D268XEPKH2:ybWjMbcCtwwnchx1y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747369816, "uuid": "aa76e534-268c-4d9b-b4e5-0565dd8321d6", "value": 111104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747369816, "uuid": "af749573-e56a-49d1-8b4c-8b410ddc5aca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747369816, "uuid": "357930d6-b394-43e8-9eef-27cea58f3c6a", "value": "9EE0E2F06217D37CBECE4C47F1C22895.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06ee92c4-328a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1747422885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747422885, "uuid": "5ae211cf-85a4-48c3-bd4d-58656d3ba901", "comment": "Malware payload (Prometei)", "value": "f9d98e1d572c19cc13516d54bb8525c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747422885, "uuid": "356054f6-3de2-4f17-8c46-917788eca4e8", "comment": "Malware payload (Prometei)", "value": "3435feb53d18084393a0680b2569757b376243bce22187ac1ebc38518e134a3a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747422885, "uuid": "be654077-9494-43cb-affe-24694e45192b", "comment": "Malware payload (Prometei)", "value": "89006e03316c42420bb44bfa4c25cebb84671e13", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747422885, "uuid": "bb27f0ef-d455-4737-b7c7-1a5575e80832", "comment": "Malware payload (Prometei)", "value": "aa79a1afc2645242fba1d84fe2e331d455a3edbf8622d4b4af62b90261ab47a1f2060fb9a64f0b7eeb5841f09a9359e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747422885, "uuid": "ada9cb77-af26-4d1a-a72f-600dc2b396a1", "value": "T131155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747422885, "uuid": "79d22cd4-1172-4b0b-9669-0b7fed3c13e6", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mpl6:qmShf4OTjMgXSJhBXEsVrmz9MOup1Khd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747422885, "uuid": "39d863e6-8dce-45f4-b485-4738d46057c9", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747422885, "uuid": "ebb0905c-83b0-4522-9c48-58d226e9605b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747422885, "uuid": "4d8d091c-fae2-4105-8b6d-ce5157cda81c", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e38f5950-322b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747382453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382453, "uuid": "1a087892-333b-4ae1-a91b-17706a92aa66", "comment": "Malware payload (Mirai)", "value": "a6b9aab2993ab8549eb56844e179dc12", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382453, "uuid": "62df1824-2ef0-4639-bbae-662ca4420322", "comment": "Malware payload (Mirai)", "value": "34488fca8bfd105d80bd9e6b86e72f3e7233f92f67a76a0facd32a9e2aa4e230", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382453, "uuid": "eef69d8c-afcd-421f-a83f-19e31decbb6b", "comment": "Malware payload (Mirai)", "value": "910bfb9e7fd073784400b1aaebc7b269f190236b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382453, "uuid": "ce66a801-2fc6-45c4-8942-a84e60dd448a", "comment": "Malware payload (Mirai)", "value": "006b3674d84fcb45fc6b9a1fff95e459db9557a87950eb8851b9bdc8318d0e212c77fefaf3caa81472425a0277d844b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382453, "uuid": "23fec27b-148e-4d29-8fdf-4f1d01b9e1f2", "value": "T139632855F8819B23C6C1127BFB5E028E7B2613E8E2DB72079E25AF21338751B0D6BD45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382453, "uuid": "eba882c9-6bd1-4582-b752-8012da3b4c21", "value": "1536:E2p1EahauhFSkQzOMNDZ7e3IvMIVWFwHvR:E27dhhYPDZlEQR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747382453, "uuid": "89742c75-b19b-45d0-9ef7-8c2f57c2bf23", "value": 72352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747382453, "uuid": "970a1ab0-8c1b-4a1e-94c0-ef75f9960a1e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382453, "uuid": "992d256e-6294-41ab-951b-f87c627bcdb7", "value": "neon.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbbcfc46-3228-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747381151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381151, "uuid": "ece22287-4283-4c7d-8bed-4ec2103fb1e2", "comment": "Malware payload (Mirai)", "value": "889ae1e2bfc5a427254aedd5b0f58077", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381151, "uuid": "e1ab8c00-4424-40e2-848d-eb1412fe54c5", "comment": "Malware payload (Mirai)", "value": "349852a58979c359283f53d3609e804552fef342b3afc0476af0a5dfba34f5a9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381151, "uuid": "acd21584-e800-4645-827b-e0553d098617", "comment": "Malware payload (Mirai)", "value": "f1918798fa1b9d4333d3c1fd11140f2a483cfc15", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381151, "uuid": "eee3589c-5e46-4d52-ad9c-b7837b96d7f8", "comment": "Malware payload (Mirai)", "value": "e9d96a9dc7c9ed8a9f1fa89600b356f68704c8b60104760fe985b3a73603776a4d005bee6f8e8631dc25a90b77d88190", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381151, "uuid": "3c19ae1f-94e9-4e42-b102-0290d878da70", "value": "T112538D75D12DAEA8C0424AB4A9598E704F13A0C046732EF7DA9587A69443DBCF858FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381151, "uuid": "6f68fdc7-035a-49d0-a14e-95cca6d3489d", "value": "1536:zag/Vdf5F1LwtkbaOoQ3veifs3guba/qzCEZaCw:zJzf5TLcQfPf+gehCEZa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747381151, "uuid": "c583e8c9-839d-449d-9aa6-293700d7eb3a", "value": 63484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747381151, "uuid": "075fd7e2-c99c-4448-ab89-7dd1ae0757b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381151, "uuid": "e89efc5a-e1e3-4ae4-843e-231e58f77b64", "value": "sora.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbaff574-3272-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747412987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412987, "uuid": "e92b0611-47f2-42d3-8617-70eb8be450e0", "comment": "Malware payload (Mirai)", "value": "a140e51eb8ac8ae579dbce5452f95508", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412987, "uuid": "588855d9-937a-46ec-b6cd-115e277c07a8", "comment": "Malware payload (Mirai)", "value": "34a9e15232860b86b9ad3d33c27adc0736fbff4b8e195784a30e268deb0d32a2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412987, "uuid": "8b2a9ecc-245a-4ab0-8dcd-e65b4ddd10a8", "comment": "Malware payload (Mirai)", "value": "82735f37e16fd580d1c501dbbd6929f5838e14f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412987, "uuid": "9ce45ba8-30c7-45f9-910d-49675d4993f4", "comment": "Malware payload (Mirai)", "value": "47c48bc01afc474332d206bce4ea07385bf6f73dfa9755c98020037a688082ce9ce8009156915b5bb24c1d16f5521b45", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747412987, "uuid": "1534e213-3d96-4633-a678-f3a17bcb3b61", "value": "T12D63961A3E219FBEFBAC863847B74A219658339622F1C5C4E15CEE015E7034E745FB98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747412987, "uuid": "e805356e-f53c-4583-939b-a29ac6c5e85c", "value": "1536:AHNFnXDuPq/SyZBp9tsCI0v6bqfg/Kkz73o2x85W:gNFXDKGrJI0SWYz73o2O0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747412987, "uuid": "b3fba5ad-e345-49ed-ae45-24c7ee31a0b3", "value": 69080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747412987, "uuid": "5aa1aded-c8d8-48db-a604-359594faa9dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747412987, "uuid": "6e507f43-e926-45ca-8308-5ec0f53737d0", "value": "Josho.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "135f1818-31fe-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747362776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747362776, "uuid": "2d1f7455-334f-4108-b2fa-4326daccec0c", "comment": "Malware payload", "value": "02d300cdfc10ded7961bdeef96f848dd", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Evasion", "colour": "#ED2010", "exportable": true, "hide_tag": false }, { "name": "evasive", "colour": "#079829", "exportable": true, "hide_tag": false }, { "name": "SQU1D", "colour": "#76E118", "exportable": true, "hide_tag": false }, { "name": "stealth", "colour": "#0E02F7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747362776, "uuid": "c41a4e3b-b988-4811-9849-a42a08daf76e", "comment": "Malware payload", "value": "3590c79d4502780b743d7eee5538b76203121372ea8b178763df899c1b2cd822", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Evasion", "colour": "#ED2010", "exportable": true, "hide_tag": false }, { "name": "evasive", "colour": "#079829", "exportable": true, "hide_tag": false }, { "name": "SQU1D", "colour": "#76E118", "exportable": true, "hide_tag": false }, { "name": "stealth", "colour": "#0E02F7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747362776, "uuid": "84076794-eb55-4819-8d4c-757c9db6f678", "comment": "Malware payload", "value": "a0b27ee94c772f1908c64743dca318179a8e6bd5", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Evasion", "colour": "#ED2010", "exportable": true, "hide_tag": false }, { "name": "evasive", "colour": "#079829", "exportable": true, "hide_tag": false }, { "name": "SQU1D", "colour": "#76E118", "exportable": true, "hide_tag": false }, { "name": "stealth", "colour": "#0E02F7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747362776, "uuid": "d6cf9ee8-510d-4675-b19b-487786613322", "comment": "Malware payload", "value": "5b4026e51cb49e6865272fa85a32c76bf39b4f00c9da8e68f6dfeb760eaf595ebbe7c16cb41105ed60b08a2c29e41da1", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Evasion", "colour": "#ED2010", "exportable": true, "hide_tag": false }, { "name": "evasive", "colour": "#079829", "exportable": true, "hide_tag": false }, { "name": "SQU1D", "colour": "#76E118", "exportable": true, "hide_tag": false }, { "name": "stealth", "colour": "#0E02F7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747362776, "uuid": "9ce70a45-71cb-4b54-b6b2-687d92c03569", "value": "T1F121442541AF90D6D2E18D43A4F66782EC7B2872107526077A6FDB21FD4109B8316348", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747362776, "uuid": "486763b9-6ccd-4fb8-8751-f00a6a6ea03b", "value": "24:8pDgVq9FKvDxQiHAC/k6m/gGvfDwdeezyDQCAsthAFViAmD:8pDggK7xQiHd/vlGHDGeezrC+V4D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747362776, "uuid": "4ddeb032-dcfa-4ef5-9328-1541c3cfdc77", "value": 1367, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747362776, "uuid": "28d76105-84b2-4a69-a5c9-c3f58e22b092", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747362776, "uuid": "236bf6fb-a5a2-4125-9097-d476ea67c011", "value": "squ1dm2.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b25afc64-322b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747382370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382370, "uuid": "232ba204-f751-4579-a27f-00fba4e71f93", "comment": "Malware payload (Mirai)", "value": "d51ecee6601c85a8e8f55fc04a6fb9ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382370, "uuid": "f540891b-9e17-4dc1-9dbe-70a6d839a89f", "comment": "Malware payload (Mirai)", "value": "3599c34860638031e367cd1fe902284b98d5d829e14a5bd5f015f4cf474ebedb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382370, "uuid": "331eefc8-4288-4b29-b00a-4cf6b7e635ea", "comment": "Malware payload (Mirai)", "value": "1b8fdae79480b4a047c7cfdc1e777ca319c86362", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382370, "uuid": "ff2fb43b-e83e-4d6b-ba22-ba87e6d8af1d", "comment": "Malware payload (Mirai)", "value": "3d093c153a4ec9f50bcc59171e60e10f6043428895f955314dfbb70d168b1396ffd4e93157160480022950d454e46896", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382370, "uuid": "10d2a1a9-60e8-47fa-91b2-f17de2d8a8ca", "value": "T1F4535C21BD3E2E17C0D4B47B62F78754B2E1274E25A4CA1E7D720E4EFF12A4066631B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382370, "uuid": "c44982ef-b978-4bee-b09b-7c3de651ad63", "value": "768:wVoEN7X6F4mvqvgqW7NAma6eFDaamv2qBtnO+CPKWgrqmK:wVBX6F4mvqvgqW7NMuaYt72ezK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747382370, "uuid": "866b10e9-ffaf-41f5-82cc-d0701441ac84", "value": 61076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747382370, "uuid": "0850259a-dbed-4ebe-8180-a0375d6f2e6c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382370, "uuid": "727c5361-065f-4b15-bf90-7434cb11448e", "value": "kwari.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bfae00d-3224-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747379299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747379299, "uuid": "9f2e60de-cd1e-4d6c-ae51-6fd3042d577f", "comment": "Malware payload (Mirai)", "value": "720704e8a45788371f66a1fbafda34c1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747379299, "uuid": "5fc2abf2-834c-47a6-affb-4cad5e8b8d2e", "comment": "Malware payload (Mirai)", "value": "35c780111be0daaf003fe94b3f2c86c1fa24206d97d17c682d974081041e4cea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747379299, "uuid": "682fd723-4cf2-457e-8335-f7339c6785a0", "comment": "Malware payload (Mirai)", "value": "6d44c0b78a5d5b5fc7293b17b88de7358fb4fcb2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747379299, "uuid": "39be5d2c-2043-4d40-9b62-b130a67a9161", "comment": "Malware payload (Mirai)", "value": "af0d92793927168ab9f3c52a2010df9e9ee28e99f5265c719e0b8baf72eacd5073688da296b001048686fcbc1416c92e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747379299, "uuid": "7dabe2f1-3151-442b-98b2-f860a6b07c18", "value": "T1D6F20A99F882562BC5E06339B39E294E3730F3D4E3CF7607E9550B6136A690B5C57E80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747379299, "uuid": "9f4b22d9-395b-42f1-a8fa-e6924bb5344b", "value": "768:n/Ttp4TGlp+zRc6HzBsFOz59WbsUoVHAMsQjK8:XflkRTVOaWbsBAMsQN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747379299, "uuid": "fe7333f9-7c80-471c-b6f5-1679fd7c57de", "value": 34416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747379299, "uuid": "06a0f22f-c6ce-4567-9cdb-87f51c9a875f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747379299, "uuid": "cd6e801d-e293-44c5-a96f-1d3b8b817111", "value": "neon.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb4a7aca-322b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747382385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382385, "uuid": "40d4ae99-7db3-4018-bcac-3ead5f7e7310", "comment": "Malware payload (Mirai)", "value": "f6c4e5ae907fdb9c18e133379755c271", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382385, "uuid": "56edfd5b-9c4d-4125-ac73-4b7535a4835e", "comment": "Malware payload (Mirai)", "value": "374c026e33c31c7cb8f66494bd7b95148a81182d7ab57ac92575d4ce3c36dd09", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382385, "uuid": "eea8e5dd-4a0b-4c03-b661-c22f8981dd40", "comment": "Malware payload (Mirai)", "value": "aa672d32ca582f1324ed63a871468c85808326b7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382385, "uuid": "b27bf9b1-7250-4bb6-90d2-6731325dcf40", "comment": "Malware payload (Mirai)", "value": "03577861c8c668e0a73b8d9437063e8e51b7bc6e9e11872d958506c56ef7a944a9349aae93fc790a5f8c56aa7e34146c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382385, "uuid": "f9bd36f3-cc69-4915-a5bf-8acf647f513d", "value": "T14A631B95F8818A21C5D5137DF92D168D372227F8E3DE72139E205F603B8A96B0E3BD46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382385, "uuid": "f0eee184-8b32-48e5-a08e-c26226be83cf", "value": "1536:hgnAkIP7B9stYVenVQm4ct8URqOSQHMgimu2aa7LLJa104t:ZP19st6en6m4cEku2aa7LL4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747382385, "uuid": "895ecd9a-aa93-4582-83ba-b1ac77cd565c", "value": 72264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747382385, "uuid": "a9ceee0f-b09d-49e1-b00b-3e5db36d0944", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382385, "uuid": "82828fc2-d2c5-4efd-bc36-d3cc5edde479", "value": "RpcSecurity.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dcdd4fa-325b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1747402737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747402737, "uuid": "a3a8ad5d-6739-48a6-8d91-3d39d9fc76f9", "comment": "Malware payload (Prometei)", "value": "3582765186bbe28ffa538dc841573b52", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747402737, "uuid": "5a58b29a-fe99-415c-970b-c68cda9d9e23", "comment": "Malware payload (Prometei)", "value": "3785b8845d09955c37a82559c5045a53d642611b5d9b82c4df35f7f002ba29b3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747402737, "uuid": "0a4bfb62-6fa8-454f-a58d-e331381e183e", "comment": "Malware payload (Prometei)", "value": "bc51b9dba34e31edd33b76f18710a387cf881aab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747402737, "uuid": "f13a0736-bf07-4897-8296-925cc3826bc6", "comment": "Malware payload (Prometei)", "value": "91b6540a851598829dbdd3361438ffebd764433abbed84d4464e748c06a485ae9b8454ed415108e9fcab5cd87c128b22", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747402737, "uuid": "72365dbc-ee28-4a73-9040-0c73358f4637", "value": "T122155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747402737, "uuid": "dc6fa244-8fcb-45fe-8317-f86f96a81a8d", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8MplI:qmShf4OTjMgXSJhBXEsVrmz9MOup1Khn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747402737, "uuid": "60621df1-9939-4bf1-8e16-f7052cceff93", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747402737, "uuid": "c46aea13-0368-46be-a033-a896dd354693", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747402737, "uuid": "ce3cb9a4-95f7-4143-9564-e1a4f603199f", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "483817fa-322a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747381763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381763, "uuid": "8ef7b3b6-c617-499f-8b5a-6c0a30f54131", "comment": "Malware payload (Mirai)", "value": "a9685768838588182ce6738429ac2eac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381763, "uuid": "e3e4f697-b4f7-4bf7-8c40-f78560d53a28", "comment": "Malware payload (Mirai)", "value": "378dddbcbb32f3d3fd57b73f75e7fcf641d0dfb2d520bb78afc63c5c23c216ee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381763, "uuid": "070a5377-8617-4252-98c3-aadc425c78fc", "comment": "Malware payload (Mirai)", "value": "538d5efa0aabe0357816388ca8f0b1e74ba07235", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381763, "uuid": "c40daa58-ff3c-4494-9dcf-ab3257a87598", "comment": "Malware payload (Mirai)", "value": "bd3d787b873144927f00c4b37bc2b69ec9d2342b0cd5475a84f973f220e668a8fa4850ca4ae4ac9c6bf12c995e405003", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381763, "uuid": "6fb5ef40-23fd-4388-9a74-f406c9feaccc", "value": "T16093E909FF511EFBC89FCC370AA91B0228CC699726A53B767574C528B64B24F15E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381763, "uuid": "39ad679a-0e1a-428c-a817-683d5b67662a", "value": "1536:KVNpYU1moifyzoYtNZ3JB2XN1bmtZobPkE1ODF4qRx5w:KVNJ1moiqFv2d1bmtkoB95w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747381763, "uuid": "3fe80bc3-37fb-4806-8f4a-d8cd356bafe5", "value": 92968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747381763, "uuid": "cb9d5b6e-cc99-48f5-ac1b-ed34b94101b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381763, "uuid": "5f055563-89d3-4885-be90-1b1a96bcc68a", "value": "neon.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec0a1022-322a-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747382037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382037, "uuid": "271ce4dd-b8b7-4560-9c6a-f5ba2cfd99f0", "comment": "Malware payload", "value": "0f32e13e5c57a684573548265e7a3129", "object_relation": "md5", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "CVE-2023-43770", "colour": "#614784", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382037, "uuid": "577b85be-df4a-40d2-8423-3c9dd640c2d0", "comment": "Malware payload", "value": "379343ee64d2d53d93af9f3f02f6d298ca2d359d37beac89d94eaa67abd5e4b2", "object_relation": "sha256", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "CVE-2023-43770", "colour": "#614784", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382037, "uuid": "8cef4018-45f9-4025-a6d3-b9925ab74d82", "comment": "Malware payload", "value": "1e2ab2dcbd6db5eca1eb954395597af35315b0c9", "object_relation": "sha1", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "CVE-2023-43770", "colour": "#614784", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382037, "uuid": "1f39a1ae-f956-45a3-81f3-fbbcdef41efd", "comment": "Malware payload", "value": "7146a32cf92f505b35df5eed0e6833ea3abcf866867f2afef6388c46303c4524f44a845e09bbe22f069362238d921631", "object_relation": "sha3-384", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "CVE-2023-43770", "colour": "#614784", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382037, "uuid": "46bd6338-9428-4053-bc5a-78d979d9f578", "value": "T122653329D7A52BBF40992FC2F208B55C8DF55762D7A2DEF2CD121B0142B5358F9B02A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382037, "uuid": "e69aa173-4c44-42a4-810c-8007efa088cf", "value": "24576:vyCOOGljaokqo0ttzuESFbWrHaCO8jb76QaYuODFDxT827qlW02oZ6V2N8j4iKN:KCJGpNttzuESBWeCdrKODZxTfmlzujny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747382037, "uuid": "485bb9db-a862-427e-90cb-9c72af861ad6", "value": 1433000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747382037, "uuid": "61253f50-092b-402a-8de7-db4a4d7730d2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382037, "uuid": "b2084af7-b5bd-4267-8a06-412588d89ee9", "value": "c9bb17ae1dc2f92131473c8b61fe0a79.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7748885-32ab-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1747437354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747437354, "uuid": "87fbee95-da9e-40a0-8758-0b7fb21cc3de", "comment": "Malware payload (Prometei)", "value": "44b685cbb5aeba05101d0f7405e6ae1f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747437354, "uuid": "7cf0d6bd-e24b-45c2-979a-99c1a30dd401", "comment": "Malware payload (Prometei)", "value": "379d8814ae1cbbf7d22f83d4e597e0f1417c25ae55439f37877ded5639c6a134", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747437354, "uuid": "cc4ffc74-e60c-4929-9924-f9c72af58b10", "comment": "Malware payload (Prometei)", "value": "c06aa59c1c5c2932e21921354948957e338abe75", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747437354, "uuid": "201dd50b-987f-47be-93ee-2203ba0c78c3", "comment": "Malware payload (Prometei)", "value": "0c5a5e74831747bd3c9f0ee68fa5b42eb09b7ece6cedf6ae419a9ed87e1754c4a35cb39c53afb55cdb02a30c7985d2ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747437354, "uuid": "e71a4c37-50ee-4908-b333-39cd8eb3b022", "value": "T1EB155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747437354, "uuid": "a6a210a6-a44f-494d-97b1-04bb3a5fc20d", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8MplJ:qmShf4OTjMgXSJhBXEsVrmz9MOup1Kha", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747437354, "uuid": "cb941089-31a7-4493-b55d-683070db827a", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747437354, "uuid": "4a58b617-aed3-4271-bf1a-52199dc62bff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747437354, "uuid": "4e53471d-5505-4439-a87c-a5ae69df42b7", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed40f20b-3228-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747381180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381180, "uuid": "db59b5de-5487-4b1f-9913-e22141742947", "comment": "Malware payload (Mirai)", "value": "77a39831a2a88d48d4a367ac0603ab5e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381180, "uuid": "bee275eb-ee43-4ce8-8877-7d1dbde591d1", "comment": "Malware payload (Mirai)", "value": "37bc7079f501f16f30bdf417f607893ac16aee97ffbb9d0a3b48fc7e232deb8e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381180, "uuid": "4420b283-9e51-423b-8241-c57be10173f5", "comment": "Malware payload (Mirai)", "value": "855132b31f725aaf7bed4183e71e07060aea3347", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381180, "uuid": "e4e22693-fb83-47b5-a4fe-ef6429949d82", "comment": "Malware payload (Mirai)", "value": "954698e0e8f37dc7c648e85ce38a6317fbc15cfca9808b142cd86558474a04d01e8b569a236966dbbf74bd7601da6913", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381180, "uuid": "e43548be-f404-4f5a-b650-a19ccd071ff5", "value": "T1B963E646BD828E16C4D512BAF92E018E331317B8E2DFB2239D146F2077CB92F0E67556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381180, "uuid": "611acf29-c56a-4a2b-8064-0032e4c2a9c9", "value": "1536:TZn3xRZOk3U1V6V8glRZQWBP/0GX+VQnPPI0iVITdGsGC:VZ9BCGGIdGsG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747381180, "uuid": "f4fb9ce0-f4d1-447d-bbbe-978454619dff", "value": 70788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747381180, "uuid": "f30a5352-f644-473f-8bb5-35fe8aa3bc11", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381180, "uuid": "aa0acb88-c6c9-4b9a-b181-54fe834a8d61", "value": "kwari.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7275d6ae-324c-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Hajime)", "timestamp": 1747396436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747396436, "uuid": "ad0c2458-2663-4857-9193-4ff28034a8f9", "comment": "Malware payload (Hajime)", "value": "73465ba9a8b9056b0bcad5945ec5b681", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747396436, "uuid": "77c79ca6-166d-43a2-a471-848273a3b256", "comment": "Malware payload (Hajime)", "value": "3827bb0bd432bcb72a3c7bb747a2405f5b6a21687c45dc41f0229e81dc9a9b3e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747396436, "uuid": "cbc26320-ae39-48df-87fe-ef66c6d17363", "comment": "Malware payload (Hajime)", "value": "e680f2b573a4a56d597b6390be60477cb30d8c2c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747396436, "uuid": "8fbd04b6-0ef0-4f73-bfb8-5bea8c3d28ed", "comment": "Malware payload (Hajime)", "value": "60702e23c87ab0ea602917c7a0a3749001563d0de64297bde6c275a1265681a977e609eabd73158de83529105c97512d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747396436, "uuid": "7e6ee59c-3384-45aa-9a1d-e12ff4d279f4", "value": "T19862E1072EAC3B07A46255F1F73C6E59F2011EDEA76BA807D1A8252350B3167F510C2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747396436, "uuid": "ef4d6140-639c-45e9-9bea-1d6cd2e82aa9", "value": "384:YTYXvQDuYY2xZ6VTgDK4mpwTl5yejHSDeWU:YTYIDfYG6ZmewZ5j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747396436, "uuid": "81ebc9c0-0f78-4597-a4ec-a08ce334cebf", "value": 15840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747396436, "uuid": "3b61f8c9-2b86-471c-af70-8db1ba716983", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747396436, "uuid": "c7ae6b6e-0fcf-4988-997b-8402ef1a9c83", "value": ".i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4bb9b9d-3228-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747381086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381086, "uuid": "f6419a40-f5f9-4e00-aad7-19ce14736e66", "comment": "Malware payload (Mirai)", "value": "6ee9527a6b39a0d571f099c387525398", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381086, "uuid": "b2e90340-b152-41d1-ba0b-1d48bf934299", "comment": "Malware payload (Mirai)", "value": "385a48084e1e7c86e7ead525b6a8414cdd85e3d4a66bb900f03dc7cc73321d76", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381086, "uuid": "dd558e0d-00ba-4e23-9195-663b2327fa2c", "comment": "Malware payload (Mirai)", "value": "d09ab891dfd1ac241f41b5a106e8128ba67b8e3d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381086, "uuid": "137180f4-a380-4b3f-be4a-9f695557956d", "comment": "Malware payload (Mirai)", "value": "bb438bc05bd7578d8299cf60f88a97390db4c28c277aac6a404daa13f138018daf5f423f89eb78097874f3035c34248e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381086, "uuid": "2e2a91b7-40fe-4a30-8ab3-33b4e1127653", "value": "T1615302EAD6AAD3BBCB8845BE61494FC9F78B5963350905D30910233CE6BA7C5B603760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381086, "uuid": "efc97c04-68f3-4db4-9350-2b423f20b2ea", "value": "1536:b1OV7LqRYTqgRL+j8WkTsOvga/iNhyqtPVuIQIOK+hwGpVuN:sV7MgRLdrgOvga6XtduaOr7Dy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747381086, "uuid": "673c71d0-ede9-466e-82bf-6706913f4711", "value": 61716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747381086, "uuid": "55037f07-528a-4f3c-bc6a-b1bc0d0d1741", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381086, "uuid": "6c0daf1c-9c64-4116-a4ec-1c5f5762991b", "value": "boatnet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6aa74242-325c-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Formbook)", "timestamp": 1747403295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403295, "uuid": "8f648df2-17aa-45f8-97e2-d4a6ce46ad6e", "comment": "Malware payload (Formbook)", "value": "ec08ddaabb34d92e11c5ca4e5b96184e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403295, "uuid": "b9e49597-b8b2-4a9a-9b95-f2e79eebf115", "comment": "Malware payload (Formbook)", "value": "385daa6df4e6c93c6402e26459810c3217594916607de466f152d0e4a6b6c1e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403295, "uuid": "0b53e154-1703-4f11-898a-2963a8b72b30", "comment": "Malware payload (Formbook)", "value": "766ba9cc91445808e3294500f74ad2e2a7d0a7a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403295, "uuid": "fe26ed83-a97b-4572-8460-4d9cc2763dbb", "comment": "Malware payload (Formbook)", "value": "5b114f13b81b340f62730579842d63732c1c33df34e0e3ac09e1b51393f9728a5a219d7b0491e3e67a2fa9bfba92ab6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403295, "uuid": "ccb6b576-e04a-4ae7-a12e-82f0725ac3f8", "value": "T19F65CF12739DC361C37251B3BA5AB711AEBB7C2506A0F42B2F943D3CB970661521EA73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403295, "uuid": "7667acb1-b1d7-4e8c-8465-ecd192af2237", "value": "3d95adbf13bbe79dc24dccb401c12091", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403295, "uuid": "51786e54-ab7b-4311-a270-9300aa6c5154", "value": "24576:ktb20pkaCqT5TBWgNQ7aGxO2gHiQkmxVmHRczoKTkw6A:NVg5tQ7aG0JPcA3Z5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747403295, "uuid": "5d296019-b42b-419f-95b2-260aeeeee32e", "value": 1480192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747403295, "uuid": "5bf05745-5abf-4ddb-b916-98789c5baad7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403295, "uuid": "a002cd30-2ddc-43b7-b233-985fa57d7e7d", "value": "invoice copy.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6e63766-3264-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747406966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747406966, "uuid": "9c3b73c6-2432-44e9-be86-5e31c2079de3", "comment": "Malware payload (Mirai)", "value": "6318ce69825c1b5347e67679ecf9c318", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747406966, "uuid": "13bd8300-e431-44c1-8b24-3017fe3b73e3", "comment": "Malware payload (Mirai)", "value": "386d2fc86cfff4d4e41e57e1a4ced2532ddafa5836207adf5f6623e42471bf49", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747406966, "uuid": "2bda8bf1-c2b7-4732-968b-e51fbd9608b3", "comment": "Malware payload (Mirai)", "value": "e8efa560bb8bbf7659f7924f17522aa5e40f2b69", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747406966, "uuid": "9c4af8d9-f11b-4c62-9054-792b18eecc18", "comment": "Malware payload (Mirai)", "value": "75a253f9c9edd7409881baf7f607ae6a5a982e6c6d141dce521bc429a8b1615f4f58d50df6907b816df826d52f3dac51", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747406966, "uuid": "9f54931c-f63a-4015-a1cd-2329b41748e9", "value": "T1EBE2F07DE8DC8710DA05917E289D395F2D08E689B9C445466BE0363BA860F6C7C363EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747406966, "uuid": "bdb34696-4c64-443d-a2ff-f40b1d8e7902", "value": "768:rLXtUHeK1r1fgqtwnSFCx93JyKXeliGHlfsAimJWjCnbcuyD7UHQRj7:Xq1r1fkSMD3Jy77HlfsAviCnouy8Hy/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747406966, "uuid": "c42a138e-5056-4b0f-8012-1f6a79ebb61d", "value": 34160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747406966, "uuid": "ebf58f9d-9a7d-436e-bc53-2f54a0033b18", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747406966, "uuid": "4d535e01-43d9-4224-b135-09938a819e95", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5368413-3228-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747381113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381113, "uuid": "96fb2ed1-f683-4c08-945b-8229bbad5e76", "comment": "Malware payload (Mirai)", "value": "1b1223a1c55d2542b7cf58e36be44a39", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381113, "uuid": "73f79351-17e0-4d3a-9fa3-278419c5b5fc", "comment": "Malware payload (Mirai)", "value": "3892841cc5cd0023a1b914cddabb2575b35890e09845aaf87ce1a505de7c23af", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381113, "uuid": "a9507460-ccaf-41f5-a1a7-afa1df43ecae", "comment": "Malware payload (Mirai)", "value": "b5a522f62a66f03587276e25f98f9684c7ec857a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381113, "uuid": "ad83220e-adae-473a-afe1-9afbeae4ede4", "comment": "Malware payload (Mirai)", "value": "8f6935be3a6233ae245f10f46c9485c367e2999a8af6ac0e8058cfa0345a1209b184ca44fa1b2a9aaf9c62432424e658", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381113, "uuid": "859b8423-bd4d-49ff-9b8c-dce27486415f", "value": "T129D2E1D0C2B20A74D32D50BB147D79976838D09A6696CDFFD5C4186BBB233A46D0335A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381113, "uuid": "649e362d-8bbc-485f-b763-51198328f473", "value": "768:huf1MAASPZgIdU/5Qcbt/OQXO9TnbcuyD7U9UcIZU:hufxrSIdeTOQXiTnouy8W6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747381113, "uuid": "2e7e1201-0b44-41ea-8e07-c41dd3c60d4d", "value": 29720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747381113, "uuid": "efc171f2-45d3-429a-b1a7-1d0e083f1d18", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381113, "uuid": "58d2a354-9bae-49b4-8af8-149523c70c2a", "value": "rift.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f383e9e-3228-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747381049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381049, "uuid": "4c5cca23-f66b-4926-ba0f-2acfe6f6b395", "comment": "Malware payload (Mirai)", "value": "a7d7ab8c2ca55fd25369b8336f54e24f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381049, "uuid": "1edc6d2d-b711-47e3-b8b9-e955cdf0d62d", "comment": "Malware payload (Mirai)", "value": "38d5235e3098a79e3566ebb6604e3cad1e2b39a1b2a9cbf939e7d35dd1f4d468", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381049, "uuid": "e2dedc6c-3d35-4209-9d89-b0fccc3968c2", "comment": "Malware payload (Mirai)", "value": "2367cdc91f15f5dc76b5ed33844c2e3374e10739", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381049, "uuid": "d30fc066-7ccb-483d-8bf6-85429b8e97dd", "comment": "Malware payload (Mirai)", "value": "cd291aafd5c48545a7a67f65d41491d9204458154b707835bb55ee9c3a278911ba4a9151fec46f6268023b1825752301", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381049, "uuid": "df388afd-01f6-4f08-b313-8d7f470df62e", "value": "T1FBD2D16DE5B451C6FD8D5C3E808C3FA10E5AE681231BDB5177228C4D5B32C5AF27A4B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381049, "uuid": "9ca357df-7e7b-44c9-b73a-5bfee1d49e07", "value": "384:Q8pVWtmRsLYEpB6V8S628FuRUuNJG9whQ3Cfbo6w+K95orjjT1RWGVCz0NvF:FMYHb62x4ahQ3CfdwLjCHWU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747381049, "uuid": "f10f0fb0-38a0-4752-8adc-541f0d30a2a3", "value": 29944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747381049, "uuid": "7c5ea29f-5cc7-4b1b-a1ff-540c29ae34d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381049, "uuid": "fc93d457-9c65-4575-a02f-7666f8b765d4", "value": "sora.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be0a2bd6-328a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RemcosRAT)", "timestamp": 1747423192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747423192, "uuid": "210cb4f0-1059-491e-8bcf-cdb68f11a3d4", "comment": "Malware payload (RemcosRAT)", "value": "4e7b3578575bd1b5a145119dbe7cbe9f", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747423192, "uuid": "213db864-0edf-4a19-b77b-96c3cb5d8f43", "comment": "Malware payload (RemcosRAT)", "value": "38e712338e7f7c03ea06226651766329e90eb80ac9f7eaafa9b2792fd43bab78", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747423192, "uuid": "6009586c-c3ff-4dd7-9bf9-27e0df1554c5", "comment": "Malware payload (RemcosRAT)", "value": "7231538ef2c995286e4cda724199dcf61fc85140", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747423192, "uuid": "5ad050c9-4c06-403c-8cd4-3adb5b286870", "comment": "Malware payload (RemcosRAT)", "value": "7fb0ae2fd32d3a899b56da53c82723d83217777a63a631401ccd18633382b45b6012ab2a32dea20b09c01600c226b98a", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747423192, "uuid": "72f43d18-542b-4b12-b13e-2949b9529399", "value": "T1A97237AAC7BBFD96CD43BA2EB53DA324015D052ECDB9C8D41640700A94E9759E0F4ACF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747423192, "uuid": "210ef9a6-71fb-4372-b640-e0d2790c933d", "value": "192:/d49eJhe41ueJhtCXmrG4Fepxu4Kor4rkt2qRRCeJhJv4nv:m92hvU2htQMFepx/Khrkt252hSv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747423192, "uuid": "4646d57e-0d77-448c-b307-dbac75323c11", "value": 16104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747423192, "uuid": "a639c3aa-bd42-475a-b35d-fb7e3896feb8", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747423192, "uuid": "634f11d5-bd30-4d59-9b79-d937f8587958", "value": "verygoodmorningwithgoodgracenicgoodfor.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1d7c419-3234-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747386235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386235, "uuid": "9a8490e3-49c0-479d-8ba1-74a4c10854b4", "comment": "Malware payload (Mirai)", "value": "82940b4717a95d50e003282f567b4a0a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386235, "uuid": "7f976322-ce02-433b-9fe3-b4d2941f57e0", "comment": "Malware payload (Mirai)", "value": "392475bdd54a22a03b37beb3c236206498abad1676faa64d8bbfec31b3a004ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386235, "uuid": "7435ed66-9672-4c5a-b705-cf12a075ac30", "comment": "Malware payload (Mirai)", "value": "1675374ce556f04e5b9d862c861871f6d6d50bc2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386235, "uuid": "20f0eb71-eb8e-43cf-a47d-fa259c63ed94", "comment": "Malware payload (Mirai)", "value": "2cce9cc2d408ea691c13c90f825b9c490d3f7485a18f35b8a46385232c0e8f2d655c37df0b1f837c72c635f30bf51b5f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386235, "uuid": "ca557d42-9f58-405a-90ff-5e2c05d8a59a", "value": "T1A803E1E8F1D69C75C6102CBE8B3B44C99D0AD7F4F60735662A94C0CD68D200D67ECE82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386235, "uuid": "bab50643-d459-49b8-9af5-f34ebadf4d10", "value": "768:O+JfRXN9RYgb2xY5vtefLMh3soHtQR9q3UELfq:O+JfRXN9RYgQY5lIU3HHGELy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747386235, "uuid": "12227bb4-136d-4c49-864b-9f341cde08d3", "value": 37744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747386235, "uuid": "346480e3-9d1c-4cd2-8d48-1f36d52e4357", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386235, "uuid": "bc38ccb4-b06d-4e16-bb10-f3eb006e8c71", "value": "neon.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f49b541-3229-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747381372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381372, "uuid": "6c0b35c9-1677-4eeb-8ff7-633550bcfd83", "comment": "Malware payload (Mirai)", "value": "b75b757dd34dd79e98ccf79d24dfd3ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381372, "uuid": "ab51c511-ba38-40f8-998c-c3b92b7ff54a", "comment": "Malware payload (Mirai)", "value": "39586a57a846713289f12112d4f88babd84ad0ec8d51e3d0d063eb73edd98f59", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381372, "uuid": "f22b8ac4-5181-4bf5-89dc-73f3b09f6344", "comment": "Malware payload (Mirai)", "value": "39228862ab87de663204ec1341c5b58a88a69594", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381372, "uuid": "bb3f9343-95f6-4fbb-bb06-ba3eb47647f0", "comment": "Malware payload (Mirai)", "value": "363c4230b0529c873c7abaf083d8c721075083c747e263650fdbae27575f131ced5918c4eb2757bed787b2f19ac59328", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381372, "uuid": "e05d3f26-82b6-4880-8f20-39e05070b7c9", "value": "T1D1630269226666BCD10FD230487BB0821363BD1E64F4AF2DC5ACAFBCCC51AC4596D572", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381372, "uuid": "e08432a7-a651-454e-9823-764f9ae3de06", "value": "1536:BXSAuiZ8oT4ezD4GbGO1NvV8XGBIopjMgFI9xDCX4bFo1/2m:tJ8oVzX3tWXuxjnI9u8eem", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747381372, "uuid": "615c22f3-9119-45da-97b9-5f7cfa79890f", "value": 67284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747381372, "uuid": "d2c63608-d74f-4614-b59a-d9bb18305675", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381372, "uuid": "e7ac23f6-f8b0-4d5e-8a8d-d4b84609569c", "value": "neon.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85307b1e-324c-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747396468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747396468, "uuid": "e963e90a-a609-47de-94c0-b401768be803", "comment": "Malware payload", "value": "f7368e011bbf51e5a943c6d6647bc97b", "object_relation": "md5", "Tag": [ { "name": "1po56mdxc-localto-net", "colour": "#E5C76C", "exportable": true, "hide_tag": false }, { "name": "AgidCert", "colour": "#56D604", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747396468, "uuid": "42e43bcf-17df-4179-bc4c-777d02ad060c", "comment": "Malware payload", "value": "3a9969c58400de101f8cffd22263a628c61b2d96619afa12c1b821b178e16377", "object_relation": "sha256", "Tag": [ { "name": "1po56mdxc-localto-net", "colour": "#E5C76C", "exportable": true, "hide_tag": false }, { "name": "AgidCert", "colour": "#56D604", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747396468, "uuid": "719fe358-1189-495a-a7aa-314fb17dd61e", "comment": "Malware payload", "value": "2f90b663da5d52cac896c166f85b1283d9ce5e4d", "object_relation": "sha1", "Tag": [ { "name": "1po56mdxc-localto-net", "colour": "#E5C76C", "exportable": true, "hide_tag": false }, { "name": "AgidCert", "colour": "#56D604", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747396468, "uuid": "a1cca8ae-aabe-4ba5-8456-bd359c0aa7cd", "comment": "Malware payload", "value": "98bc5bf139c7cf93d81aa5941f4af748ce7e2a395f460ca6b1a21edeb9b08beaa4f84aa975179085106f0f73aaebc5f0", "object_relation": "sha3-384", "Tag": [ { "name": "1po56mdxc-localto-net", "colour": "#E5C76C", "exportable": true, "hide_tag": false }, { "name": "AgidCert", "colour": "#56D604", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747396468, "uuid": "612b1a5a-54c8-4662-ba15-1c60d5d49c4e", "value": "T14682803820D43D271657367003FC675FB4A6E9F9459BEC71B153AC8BF10A262B06E62E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747396468, "uuid": "183e083a-96a6-4145-91e9-2266ad5e1ae1", "value": "384:jLXwpzU/lvyAtE/S3NUAbwNcVRUPF+J7zZAL7r32wKb:jrwpzU/lasT3NUAbwNcVRUPF+J7zZAL4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747396468, "uuid": "8974d49e-aa72-4655-9c41-52291df711e8", "value": 18972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747396468, "uuid": "93ae9f5b-5bd9-492f-93ae-afe01ff10434", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747396468, "uuid": "c361ce28-46aa-45bf-aaef-ee04bb669320", "value": "FA-45-04-2025 (4).vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ccda93a-326c-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Allaple)", "timestamp": 1747410224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747410224, "uuid": "2e2473bc-eaa7-462f-93aa-060e0b7bca70", "comment": "Malware payload (Allaple)", "value": "04ff5205025adf73e9ce2d5284a7c816", "object_relation": "md5", "Tag": [ { "name": "allaple", "colour": "#A939FB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747410224, "uuid": "8a31e179-144c-4d2f-ad03-d48718ff24a5", "comment": "Malware payload (Allaple)", "value": "3b61757c276c9f823c8d49f5322338891335c6ea17649ba0b39e36237d5d399d", "object_relation": "sha256", "Tag": [ { "name": "allaple", "colour": "#A939FB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747410224, "uuid": "2de6b907-a6bf-40f7-9ed0-9e9b557fc9a1", "comment": "Malware payload (Allaple)", "value": "4f92ea61f1535165724316b471903df8e3f1a3e4", "object_relation": "sha1", "Tag": [ { "name": "allaple", "colour": "#A939FB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747410224, "uuid": "cc7b4152-66c9-4f50-9f50-8d8642c9b032", "comment": "Malware payload (Allaple)", "value": "89a2044a2ac1ed42dc391adc2f4a5ad311c659126a30f77d8b359d4d887a344ffae6b6f3c3511d5c94615fc0693f2410", "object_relation": "sha3-384", "Tag": [ { "name": "allaple", "colour": "#A939FB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747410224, "uuid": "2a79d164-2e77-4efd-a3ed-db98141d0232", "value": "T1D7C7331A1661BC33F872BFF457F9EAB305E17187E04067D7EDA36E2949120C129CDAA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747410224, "uuid": "4247c229-8787-4b24-80ab-b2f01be328dd", "value": "786432:V/CyJ98/pUEUjJprn7YTB/jddy/Dhrbe5uGYjd0AFOOho49+qjbXAyXyFzToRye3:VTW+jJpQdC1zG0+A0x49+QbAb/oNJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747410224, "uuid": "d0e00746-412c-480f-bf53-1d9f5da40df7", "value": 53285180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747410224, "uuid": "7689e22d-8495-4dac-8996-088a7d5c68ff", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747410224, "uuid": "801ca99e-1792-4843-8e26-848579dc507c", "value": "malware-samples-master.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae099689-322b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1747382363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382363, "uuid": "32444b46-5135-46db-befd-1303e72141ac", "comment": "Malware payload (Gafgyt)", "value": "f335c70583cf09ea6711b8183d7966fd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382363, "uuid": "7c59ab4e-6d83-4c5e-b7d1-820f944505b0", "comment": "Malware payload (Gafgyt)", "value": "3b6bd2d5593c042a47595b9ee7d5a303a84c2325f36426dc434d63bdfda6b051", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382363, "uuid": "0451202c-3207-4b35-a711-0c47ecc34441", "comment": "Malware payload (Gafgyt)", "value": "c0b6e3a1820754a1ab769550e92ef2600ada0209", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382363, "uuid": "ddb3bd00-b80a-4bd4-bbb3-cef2f5dee800", "comment": "Malware payload (Gafgyt)", "value": "ae6f1b2d4db56e5525d2f62cea3bad81493dea02ef227065ed59e5e6908f1513e9c7c57e4215bb1cb2ded7c2597fab46", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382363, "uuid": "5d44bf1c-6e2d-4210-8e47-b8aeaa96294c", "value": "T1E524B83725232B51C4D5DFBB42A24338B4BED9AD345A0BD3A98D6DD93D30DE035922E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382363, "uuid": "6de6092b-97ee-40db-9aad-92b7c5211eef", "value": "3072:38VcY2xNPcam17Bmb3GdMJX/HEEaq8UtEiX:38VDqlWKbWd8X/HEEaq8UtEiX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747382363, "uuid": "3ef4888b-16d0-4bc8-87f7-939e22391126", "value": 211785, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747382363, "uuid": "c60ceafe-4541-4bec-bcd3-ed69ab9ff8a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382363, "uuid": "c05dd68a-c22d-480b-8dd6-0c500d8bc211", "value": "fwdfvf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6e7f8e6-3250-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747398296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747398296, "uuid": "2a8819f3-3aaf-46b7-89a7-22d8339dd028", "comment": "Malware payload", "value": "092b108e2aa002bbf045ded9f617d48b", "object_relation": "md5", "Tag": [ { "name": "dc8vcreun-localto-net", "colour": "#3815E3", "exportable": true, "hide_tag": false }, { "name": "InvoiceXpress-zip", "colour": "#B98988", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747398296, "uuid": "5c1445ea-06b2-4b85-99ef-ac69a3fc43c8", "comment": "Malware payload", "value": "3b8b68d1abeaa0b4b679aaf3ced79dd4171b884aa87ec7bfd0b6d1610591d2dc", "object_relation": "sha256", "Tag": [ { "name": "dc8vcreun-localto-net", "colour": "#3815E3", "exportable": true, "hide_tag": false }, { "name": "InvoiceXpress-zip", "colour": "#B98988", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747398296, "uuid": "714700d8-3d75-4d75-a3d4-2d0e34a66d50", "comment": "Malware payload", "value": "85e6d36f1d6688e12fdfe9fa9d1adb5d853c1277", "object_relation": "sha1", "Tag": [ { "name": "dc8vcreun-localto-net", "colour": "#3815E3", "exportable": true, "hide_tag": false }, { "name": "InvoiceXpress-zip", "colour": "#B98988", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747398296, "uuid": "feb1ffe2-eb78-4dc5-b015-253b30deee37", "comment": "Malware payload", "value": "954d81d24cfef274d10ad38bd1a724dc46297c834632a85a14c7ef10b773bb7d1410a113060c768e68d640727579f6b0", "object_relation": "sha3-384", "Tag": [ { "name": "dc8vcreun-localto-net", "colour": "#3815E3", "exportable": true, "hide_tag": false }, { "name": "InvoiceXpress-zip", "colour": "#B98988", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747398296, "uuid": "02fc3b48-0e64-42c7-b083-bc1edff032c1", "value": "T1E9261216F989C8A5FB6371375192C163F43D478CC88AA0E702F4478A98A5C8A4B57FDF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747398296, "uuid": "c280aedb-1175-48ea-a625-b9379a6e89ea", "value": "98304:7ccax/qEfPY/UbEdGPm2FugKcm/Kkym8bONfMiezA3brl/Zwq/dusqjF9dovtM1:Icax/qYP2MzPlWIbO5Zw6l/t/dusqVok", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747398296, "uuid": "3260d4b0-cddf-40f8-ac47-8ec766b9877f", "value": 4857485, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747398296, "uuid": "5069de45-4e33-4e25-a777-6128008f5465", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747398296, "uuid": "22bae248-9dbc-4c72-a280-ab982cc352a2", "value": "InvoiceXpress.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b27238e8-3234-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747386236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386236, "uuid": "19e4cfbf-559a-4f65-b148-91bfd5d37b89", "comment": "Malware payload", "value": "9522e5b7e7ecd372f4dfeb1a40b76e2d", "object_relation": "md5", "Tag": [ { "name": "196-251-90-185", "colour": "#01F3BE", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386236, "uuid": "f30af602-ed5c-402f-9ad4-7b3c47252a7f", "comment": "Malware payload", "value": "3bd32163c046f6008b5893e5eb1f22c60cd7c634d4a933268fad69de1120f549", "object_relation": "sha256", "Tag": [ { "name": "196-251-90-185", "colour": "#01F3BE", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386236, "uuid": "7c0e6006-8756-432a-85f6-def9b43d50e6", "comment": "Malware payload", "value": "01003770073f210430a6455edee2d6caf96c09d2", "object_relation": "sha1", "Tag": [ { "name": "196-251-90-185", "colour": "#01F3BE", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386236, "uuid": "9a4954ed-1a89-4633-9a5a-611bc76af43c", "comment": "Malware payload", "value": "29466321697786660fe325756ef006634d37773505bcf47c01a3e42f95ad5973e3bee6b89cda80e5e8a63793a8b5e5e1", "object_relation": "sha3-384", "Tag": [ { "name": "196-251-90-185", "colour": "#01F3BE", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386236, "uuid": "cd214e0d-adf6-454d-a566-2882fbdafc19", "value": "T11C61DE882F8851D027DB4769663944C5F46DCC1EEFD88C1AF01AA5D1FC249A1CFA6F72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386236, "uuid": "76783a92-35f7-4d1c-83ff-03ab5ea34b75", "value": "96:TXB1jNKKXw//B/SoFC/z+WeUIFzKJBWje0mtbX/+M:TrNNOC/bDBWjtmtD+M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747386236, "uuid": "66e0cf3b-9960-4e56-b57e-11bae37aeaf1", "value": 3213, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747386236, "uuid": "dbbee354-15e6-452e-966c-63d98646c115", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386236, "uuid": "4259e7fa-dcbb-4b8d-b207-5f017d5aecb4", "value": "Husqvarna-DOKUMENTEN.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18fdec74-32a8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1747435800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747435800, "uuid": "d46d2efb-ce25-4e68-a58c-fe73e641ecc1", "comment": "Malware payload (Prometei)", "value": "c5693a8a510b50b677dbae030f21fb04", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747435800, "uuid": "8620cb49-160b-4f6c-875f-742a2c970070", "comment": "Malware payload (Prometei)", "value": "3c0e790198761b9ffb5b82769825f094f0fd7df97fb61c0dc05166f8bcbb24ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747435800, "uuid": "55034dec-491a-4615-b499-332c4332d9f9", "comment": "Malware payload (Prometei)", "value": "8ecab181c960a82c46699ddde748f2f469220d7e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747435800, "uuid": "ec3cbbd3-d15d-4b66-b306-0dbee3bfae26", "comment": "Malware payload (Prometei)", "value": "d530b6c22f4a74b0107d3ac5f55aa3c4e8bc8bcce803ccf84abd4bf2d34df062995aee802e4a067969f720c2e82e7355", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747435800, "uuid": "d1601d0c-c2fb-4472-9f40-7aec8ae33a25", "value": "T1B0155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747435800, "uuid": "82cd6711-513d-45f2-bbbd-b4339489029d", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mpl/:qmShf4OTjMgXSJhBXEsVrmz9MOup1KhY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747435800, "uuid": "ede5ebd9-a844-41b1-b595-b9e913fcc6c4", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747435800, "uuid": "d28dd831-461e-432a-822e-65580b45b9c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747435800, "uuid": "efe6bb00-c6fd-4a43-953d-07fb96353023", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acde0168-322b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747382361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382361, "uuid": "f666a602-1150-4ca7-bebd-1cc82c8f73cc", "comment": "Malware payload (Mirai)", "value": "9b96d4675fbe86f2f442ae910dd17ab3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382361, "uuid": "000d950d-3c20-4b4b-9241-5fdbe05d7e5a", "comment": "Malware payload (Mirai)", "value": "3c85f5abe4f5b8bcefea70aa7e302bbe591a3ddd150fb9a381296a6ae3a1f77a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382361, "uuid": "8274dec8-1eb3-4616-873f-a49d4a07f464", "comment": "Malware payload (Mirai)", "value": "1aaa24da6987f58f23d82cf1e299f0acd542b0c7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382361, "uuid": "f855046a-c6c4-42e6-9486-ac6aaff4b1c7", "comment": "Malware payload (Mirai)", "value": "cd560488ef77c3de6c1d9e7f3f9abc353760366770345ecb8a6f3acea875ff8b1b1757fa485d3f5b4278ec5e95ac263c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382361, "uuid": "a8811c36-463c-4f94-95d8-e14ca539b3a6", "value": "T113C2D19CD6602262CC4C1F3F089D1B657FD173D1324AAB2853228C9678559CBBCCE9AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382361, "uuid": "d99e369f-4b1c-4941-b28f-5d05980f3b15", "value": "384:q3nUTu4VVCs0/8aZwUzOd+s0h5s8X18VEtTtI67wUIeQ5LUVt9oZAAROgSnIosRf:QIElwa18EtI67lQ5LQoZZSIoMW6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747382361, "uuid": "7e8b6a65-a04d-48d9-83d1-13f75bef4c0f", "value": 27272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747382361, "uuid": "1566de04-943f-4dea-b19a-68fd87a8a74b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382361, "uuid": "a61bae62-aec6-4719-91c8-76597932d169", "value": "phantom.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8932100b-322b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747382301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382301, "uuid": "d20118cf-347a-49dc-ad8d-039dc2805d07", "comment": "Malware payload (Mirai)", "value": "d240b98bebdd4d20c5a255b19240e990", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382301, "uuid": "6d8b1a2e-a253-4ab7-adb9-e660a2c62aea", "comment": "Malware payload (Mirai)", "value": "3c93834617e6f7b2bf5d546329b541778b250948e0dfd8634b9df47a73315921", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382301, "uuid": "2f4987bf-da30-4a9e-a544-321d2a242635", "comment": "Malware payload (Mirai)", "value": "8b21c6158b6525b773666f8f969d1d25c33bb69a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382301, "uuid": "fdff46cd-6689-416c-9645-f69e067cf49c", "comment": "Malware payload (Mirai)", "value": "3ec840b2fbc2888a8d9b1f5a4fcb9dfa27df94b492f30388e872eaf4d45cb35123505c34b05c7c9d8f4ad215e067a3de", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382301, "uuid": "e8f8c8fe-9811-4292-90d5-b4d96bc86e0a", "value": "T1BDE2F2A06765D877C5CFD172151E7E5F9CB7C19880064B578A3A8036C0F27B9AF086E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382301, "uuid": "051dd411-5150-4819-945e-90b6fe97ee29", "value": "768:ZTvb9/XgXXWA+j/YElnpfAw2sPOb1epyOnbcuyD7U9Ucs:ZTvbhShElZYM3nouy8e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747382301, "uuid": "2da73c01-9d07-4b76-b545-892eb270ea8d", "value": 31212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747382301, "uuid": "9b4e2f81-eaa2-449c-bbb6-3ec2527cd1c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382301, "uuid": "fab8e683-2009-476f-8bf1-02457a092cd1", "value": "rift.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b47200e8-3257-11f0-8bd0-42010a9c0005", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1747401271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747401271, "uuid": "09e9200e-e111-4011-8ebc-d4d72bef6744", "comment": "Malware payload (SnakeKeylogger)", "value": "9e3b7cb147384099f8d1c19009a27e87", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747401271, "uuid": "9b86a8c4-b4bb-45f2-9605-eb400c066e19", "comment": "Malware payload (SnakeKeylogger)", "value": "3c9b7c02ab283c1ff3b9420c19b557b1ec5d4517ef6878a4949bf8d05b341e05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747401271, "uuid": "f1d3a120-6df6-4247-9dea-e79212ec2559", "comment": "Malware payload (SnakeKeylogger)", "value": "80e8170055322e765e7072839a850d581724de7a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747401271, "uuid": "b8cf0439-2b1e-4754-a63b-7ca5b86eb4f1", "comment": "Malware payload (SnakeKeylogger)", "value": "96941cc856ebe6b9c4e90fe90717287f016294b6f4562012c855b2c0d71a716321da64706b988bd8b1e257b16c21bd5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747401271, "uuid": "bac11b44-8cdf-45b4-aae7-44e362979fa6", "value": "T118C4F124B245DC03D1A30BB519B2E3B817796EDDA821C68BCFE92DDB7CBAB451641343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747401271, "uuid": "a914a649-7c9f-4a9e-8b24-4e910402c37d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747401271, "uuid": "3aa4bf7b-7c07-4f19-a276-ace15850c37a", "value": "12288:ppMJEZJNe7er/X09SBNdwpjqcse03Vpify6EfomXTTsefv2SLmpAGfu4JGGW:LbpX09SB/wpXs53ziUBTYefv2SGbu4JU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747401271, "uuid": "c0c71c32-00f8-4af6-8c31-475d527e02c2", "value": 580096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747401271, "uuid": "00c56182-84c2-402a-acf2-d5aff9060bbb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747401271, "uuid": "530af7c0-cbe3-497f-ad4d-61dd850ef20d", "value": "Revise Payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4828cea-324b-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747396144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747396144, "uuid": "3218df67-b852-4558-8770-41fe8cb7aeae", "comment": "Malware payload", "value": "afae15ed1425e84b6ca6fc40975fdb76", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747396144, "uuid": "5cb7887a-493e-433a-b639-d2ed97f6d91a", "comment": "Malware payload", "value": "3cb45f8a6383df24ba4bb6b833a13f2cebcc1fba8319f3b44a0d4eaa6e878a56", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747396144, "uuid": "c8a3e2e1-f26d-4784-a512-78a114714a2d", "comment": "Malware payload", "value": "d220af75b06a6ea817e1f2311b63ef341bb866ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747396144, "uuid": "d76f7911-8705-4876-8c95-061438d8ab83", "comment": "Malware payload", "value": "81382366027d69325c2d9f45c63596dadb98ebefcd9d87f7907e751dfa108995fb8278165ee842606b270eddaedd8095", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747396144, "uuid": "edf14330-9dcc-4359-8a82-a3d3a3968344", "value": "T1E16423EF25967675F2689CBFC12365D84488BF8F4B4979B409500F8DA232F44BFA9047", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747396144, "uuid": "5b780214-0c2c-4ecf-8adb-6a734bb95baa", "value": "6144:oSWe1qCycW+BjQMnCNDbuIxfESpoST+VtsF6EM3HS0cGZZCKw0Hbu2KJudu:oSWeYcSkaDbZxMnSizs7cvc0Zmwu1f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747396144, "uuid": "a5d59b75-ab29-441f-93ee-d53bb1ccea0f", "value": 322266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747396144, "uuid": "801249bd-e16b-4c67-8069-07da1c97071c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747396144, "uuid": "40683ca7-d1d2-4b4e-a997-4432d5a118fc", "value": "afae15ed1425e84b6ca6fc40975fdb76.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "918f3325-3239-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1747388328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747388328, "uuid": "29f87d79-d57a-4971-b7b4-3ce9436b7092", "comment": "Malware payload (Prometei)", "value": "85a5198384bbf5881ec2bf9f53ca1b59", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747388328, "uuid": "83a46351-8bc8-49ba-9199-8a8243327e2b", "comment": "Malware payload (Prometei)", "value": "3cfd04e3aca8d112e93cf0456c591defc87d9a53ac0f99e9625a5e716be8c26b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747388328, "uuid": "9a14cbb4-ea8a-4678-a314-da1a2fd543cc", "comment": "Malware payload (Prometei)", "value": "c1d5d5e4da05d60a5479af09c984f407d09f33b9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747388328, "uuid": "c3a069d1-46a6-423d-b69e-58d529a2cd99", "comment": "Malware payload (Prometei)", "value": "d3769ec593c85f27470400772f7c76a0bb053ca0eba3d4466e2481d86871eb3900da6dc9e231cc55790e8ef6b59c578e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747388328, "uuid": "93afe027-173f-4a60-bd16-95811789e47c", "value": "T19E155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747388328, "uuid": "0b71c41f-32e2-4c35-af4e-b222ddc4e47d", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mpld:qmShf4OTjMgXSJhBXEsVrmz9MOup1KhO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747388328, "uuid": "adfdd762-302c-4451-bb26-fb73bcc0550b", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747388328, "uuid": "8fb5018a-0df5-42dd-8854-39b90efae580", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747388328, "uuid": "eaa31d47-04c3-4a3f-931a-ea21836ca105", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "110be6c4-326e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747410876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747410876, "uuid": "194fb664-f15d-432e-b20e-fa3eeaf8da23", "comment": "Malware payload (Mirai)", "value": "d0cf4bcc347f8bf7ca48c191b4ce6d4b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747410876, "uuid": "87b1d519-02e9-4bab-9810-e9f4ebf6c13c", "comment": "Malware payload (Mirai)", "value": "3d2638f24482880903df52daf400422303c89caab879496c14303e664727515a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747410876, "uuid": "61f2e8cd-71f3-4510-b3bb-07ac32d6e29a", "comment": "Malware payload (Mirai)", "value": "e702f8f57ef8f0a90062268f836280c76d6c7a63", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747410876, "uuid": "fcc6b31c-3770-4960-9f6c-ebf79ecb67b2", "comment": "Malware payload (Mirai)", "value": "3133208bf4205a5c231adfda0777b8fff526d9ab12241c25ee80d7f381f7cc541bcc99a398fe8d774afe4bf3e89c2a58", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747410876, "uuid": "91494cad-c1fe-47ff-bbdb-a23cbab6a34a", "value": "T11E732985B8809F14C6C5177BFA2F108E330297ACE2DEB3539D145B6477CAD2B0E36A59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747410876, "uuid": "5833e7e9-c0b7-4b6e-81fe-6cf53885fe7c", "value": "1536:NkniCvLhqvSs6w2SiEyEtRCqq/BsoLmpMguHcUNVUHalw7WuuH0hsfC2ermQ4Wmr:+LhkSfwXXTCqjoLmpMguHcUNVUHalw7S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747410876, "uuid": "7de50027-9e39-4c39-89f3-ccb46c4209bb", "value": 79896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747410876, "uuid": "fb6fe995-7f15-4260-8904-29e0ef96076b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747410876, "uuid": "b0cb42b7-2ba6-4de5-b25e-726a587dcfb1", "value": "sora.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5012a7b8-3297-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1747428591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747428591, "uuid": "664d1cba-a359-424c-aa57-5ad65a8a7a38", "comment": "Malware payload (Prometei)", "value": "a97a1975b5a4ce5b806c18fa747dbd56", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747428591, "uuid": "6edf3a65-b1a8-4a8b-a89d-b14c7a366d96", "comment": "Malware payload (Prometei)", "value": "3d464976ed403f55de4ce89eaed65e5c62092311d339724ce6cad53f9fd4e040", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747428591, "uuid": "14925282-c3ff-4684-bee5-0502092ff933", "comment": "Malware payload (Prometei)", "value": "35ff03e68cee664b691ebfa5487958ac6807e86a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747428591, "uuid": "8dd1eb55-26a1-4dfb-b49f-b4acb75e2c46", "comment": "Malware payload (Prometei)", "value": "016d6041a6a5242a6b6db7aa0f5f9f0c8a261d75b3893eb6b1b088f79eb20a787007db2793e4f20de79738df77072552", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747428591, "uuid": "59c703aa-5444-4a71-96d4-2ec2a614f485", "value": "T16A155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747428591, "uuid": "b507d829-5f67-4075-9f1f-0a56ed1e2b78", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8MplU:qmShf4OTjMgXSJhBXEsVrmz9MOup1KhD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747428591, "uuid": "5074f607-8db6-4fa8-96ba-eaeb82952af3", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747428591, "uuid": "c8ef386e-ec6b-431f-93ac-c0f8d273ca82", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747428591, "uuid": "75855066-9bcf-4d8d-9a84-50026e1fd1c2", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "808f9868-3245-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1747393453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747393453, "uuid": "bf79f98f-9bc0-4c62-96d9-4109ce197a1e", "comment": "Malware payload (Gafgyt)", "value": "4b421bcf204135399b852525d0e55a97", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747393453, "uuid": "c3cfadb2-e51b-43e2-ac84-261e1efd7968", "comment": "Malware payload (Gafgyt)", "value": "3d5a10089622aa613d793293fedf226d3a5a211fc3ca089d349a61d8537eeca9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747393453, "uuid": "f415f7a5-1e5a-4d06-a8a3-3c7615ae1e74", "comment": "Malware payload (Gafgyt)", "value": "cae1fc9a0eb80b656193df142dbbe0ab81ab34b1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747393453, "uuid": "ecd842bd-d15e-4f28-9c16-c6306cb6c4e9", "comment": "Malware payload (Gafgyt)", "value": "2827c2d04c69bcdb04f20767650f20e7f47f850dbd54005610c2f328938ce6309460c79f7a739c984a5b40513148a6bf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747393453, "uuid": "a1c48abf-9377-4d01-a211-880b25bdc9aa", "value": "T126E33905D7408B57C1E2277AEBDB424933339B54A3DB33099A38ABF43FC27995E26116", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747393453, "uuid": "02bd7652-e193-4dbb-ac01-7acf031eb297", "value": "3072:ut8iFDKEfFN+Fa+1sWoh7a8oXV7pUMbmQwfCMQiGW:s8iFDLf/+FaNBh7a8oXV7p5mQwfCDiGW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747393453, "uuid": "bab94772-e00e-4262-9ff7-dc6617a1faa2", "value": 150049, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747393453, "uuid": "cb5236fe-f6f5-4898-9135-196f350db732", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747393453, "uuid": "68b2727f-aab8-47ab-8146-bdfb7973e4b3", "value": "rebirth.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71e810fd-3222-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747378396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747378396, "uuid": "02482456-c0d7-4869-b79a-ffcb8abc9b34", "comment": "Malware payload (Mirai)", "value": "21ce32ef007eef07b31d842deca9c321", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747378396, "uuid": "0413fd8a-8ff8-4e1f-b1b3-766766f9ab03", "comment": "Malware payload (Mirai)", "value": "3d6b182bf8e8aa426e367bb30efe8daef1d6cce8f81b0101526ee5844cde7137", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747378396, "uuid": "c91e6345-99ad-456f-bcda-5e82e5be1875", "comment": "Malware payload (Mirai)", "value": "4324c368990cd6f44179ba16badb0eea8d3c76ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747378396, "uuid": "61b6b3f7-8cb8-476c-add5-f70302414ca3", "comment": "Malware payload (Mirai)", "value": "a4980d98b07cdf946810328d2a25568da05428babeb81958e877e9706d4a7b314622a60c35b73a0bdacd9a07d35f39fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747378396, "uuid": "4de0d540-c1e1-4ce5-a49f-087fa89a0bc8", "value": "T10B633B95F8C15713C6C1127BFB5D028E3B2613E8E2EA7207AE256F21338791B0D6BD45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747378396, "uuid": "14aeb660-ff74-457f-8f67-2006e5b1d24d", "value": "768:4HtoDOypnytBQ6Qcat/3Qcgo36bNHQz0H0e5B3MihqPM//9jdo3YVhmDzyrlJfPC:0ozpuPw3Qc2RHQ0p8ihXldooXrxqLvY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747378396, "uuid": "0a9d70b5-683e-42aa-8589-7602c8d90a48", "value": 71012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747378396, "uuid": "eb67db73-f997-4021-8672-3545c4ee58cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747378396, "uuid": "e2289f90-1a97-4490-8d73-b28741fc0816", "value": "neon.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68793711-325d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1747403721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403721, "uuid": "dc8e623a-a0dc-4e77-9a89-bb77cb4ee01a", "comment": "Malware payload (LummaStealer)", "value": "7e480675fb49e0814d79d0f761d81d99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403721, "uuid": "796470d0-9198-4f1b-9d59-09328b09a9da", "comment": "Malware payload (LummaStealer)", "value": "3d7950b1b485362392d751935df7949b3aedd6be93b59bf585b99b4273c1b24f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403721, "uuid": "6bb190c7-e237-4966-b9ae-84905eb92636", "comment": "Malware payload (LummaStealer)", "value": "d8d1e4236d2e45cf9610e8dc827cfc6ee449380d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403721, "uuid": "2f5a6a96-b9a0-43cf-bb8e-6e63d23e12db", "comment": "Malware payload (LummaStealer)", "value": "563a7300f74b9089026a1f9458ddb0e4dbde1d04fffa3c819799265f67c4f2d6eceebc91b40bdd69ffc0f0bc7b227665", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403721, "uuid": "b1f22341-08b8-4763-badc-b299ab481fe9", "value": "T1FE9533A67F81A6FEDE388079DA6A13096D31B24CDB7CE3525B6D04FB845FE187144838", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403721, "uuid": "fde424d6-7dbf-4780-aac2-525ebede525f", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403721, "uuid": "55662c4c-4827-42b8-8689-c59bd9639919", "value": "49152:EOstcfU0C2qdrC1RsxkGrfkzSxbbDchQCfG+:wcf70CfJGrfkzSVAhjfG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747403721, "uuid": "9c2944b4-b0c4-4723-981b-9707a1a54d83", "value": 1879040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747403721, "uuid": "de6a1aa3-1124-4668-b1f2-9ad55c049caa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403721, "uuid": "d5ad8626-9bfd-4443-aea9-fa8bd181849c", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e44e09f-3285-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1747420776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747420776, "uuid": "ce576c11-d925-42bc-a442-05f3741d1159", "comment": "Malware payload (Prometei)", "value": "64ce4a30cbb2efbcdccfc69b6d1e5ece", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747420776, "uuid": "c50a6c28-2e5e-4752-9efd-d04333039e28", "comment": "Malware payload (Prometei)", "value": "3d96932aa517f032985386be3f61c2d6e0a9c6d5b1832144a45384ead254d114", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747420776, "uuid": "38ae05a4-8501-467c-ad35-58a646265683", "comment": "Malware payload (Prometei)", "value": "d0adf3e2e2cb81990baf054954cef975e1d1de8d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747420776, "uuid": "b5b6629d-1bc0-4228-b575-8e2a238ca8e8", "comment": "Malware payload (Prometei)", "value": "6a196820956aec2b586d01e856c6e727edceee9c5ff0238eff216980f23ce85dd26760a28ec6db96a8a6d1bb82daf486", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747420776, "uuid": "9637713b-48c1-40a4-b86d-4ab12913ef5a", "value": "T1BA155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747420776, "uuid": "a0918212-fc96-4862-9c27-f9dfb4ead4c1", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mpl5:qmShf4OTjMgXSJhBXEsVrmz9MOup1KhW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747420776, "uuid": "8ed2c104-45a3-4e60-ba39-c08fed57bc53", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747420776, "uuid": "196cd8ef-f5c8-48d4-8ab6-30d12f314557", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747420776, "uuid": "e38912b3-2a04-4832-82ee-c2df92717dea", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7719cc7d-3235-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747386566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386566, "uuid": "28369c08-3a2e-4209-9722-1f845ee3e02f", "comment": "Malware payload (Mirai)", "value": "1b2a310e2b9e1e504c8c9664876ab9b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386566, "uuid": "53cb2dc7-3a16-45bd-93be-e88f86f30b7f", "comment": "Malware payload (Mirai)", "value": "3d9d388634f7195eaa21db54dde696342dff80721e3e5baf770318a7c3d03c28", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386566, "uuid": "8ae2d5e3-7e22-4d50-aaa2-81ee2920ad7d", "comment": "Malware payload (Mirai)", "value": "e0bacfd1773136c44830c8bb638dd5420aa35f46", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386566, "uuid": "fe7c5be9-e0c3-4bbf-8b9e-3991f0ab46db", "comment": "Malware payload (Mirai)", "value": "b4ae59536f266053aa4460bb5e8013d85cba864c361629a60009b3bdb8b4e4d115971f0bee94621d7f90ca50218a6d3b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386566, "uuid": "4160608f-7910-412f-8495-ab451ad07630", "value": "T13F93E809BF511EBBC89FCC3706AD1B0238CC599B26A53B767570C429B64B64F19E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386566, "uuid": "d68d3d36-0301-4bfa-b8f1-43b56b377bf1", "value": "1536:Fh0pQfoG6F4P8jXaIEn9ms2GtgVZ//pWKRWLaKa/io:Fh0GoG6F4l8s3tgVFGmio", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747386566, "uuid": "3de38263-30dd-4ff1-a753-0bdc96f1c260", "value": 92972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747386566, "uuid": "516d8a39-4a20-4d5b-997b-1dc7b3104956", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386566, "uuid": "a24f99ac-c8bc-405d-83be-c6e30ac9e700", "value": "neon.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1aaee330-322a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747381686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381686, "uuid": "64a9ac5e-bb5e-4775-ad08-44d3e0208d2d", "comment": "Malware payload (Mirai)", "value": "20e4a0c2c2ebb0b45171d86cab45a51d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381686, "uuid": "c251b7ac-073a-4b24-a2ae-161f5126c568", "comment": "Malware payload (Mirai)", "value": "3df90cd57cd7c4ceda99e3435ebec5c3b10456aacea9c21cd5669472adef7f94", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381686, "uuid": "9e71c785-ac79-40b4-9e00-9f90fe785ee3", "comment": "Malware payload (Mirai)", "value": "0443bb82dc805f845b6d1c765d450b88f4a48c71", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381686, "uuid": "f9c27ea4-cb4a-42d3-8757-2d3dc5b63d57", "comment": "Malware payload (Mirai)", "value": "54d36445e77479805433218087c39438195ab68ebb287685b992b003b216146a586fdb520be527b3cb44adbdc59bee20", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381686, "uuid": "0c9a7b0e-a3ef-4058-af6d-8178e2821365", "value": "T120438D63E42A4E98C19941B47468CE361F33E5D462CB4FFB23A5C3B59053E9CF849BA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381686, "uuid": "671f1790-3aff-4e29-9989-018f1b7007bc", "value": "768:K0Tn63SUpJK8SCwPDAK//veA7qaBohHAHtC+7x1C00dgf8Z8qXF1K6IO0:KflKFuK//vR7d2hWtC+qrSqXho", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747381686, "uuid": "34f9e497-3c34-4a6d-a9f8-6c414a912fe2", "value": 60532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747381686, "uuid": "17b44261-02ca-4765-8fd4-706ca4ccc3a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381686, "uuid": "36475246-ae6b-4ca2-8cef-ca418dbadbce", "value": "neon.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a4e0f73-324c-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747396476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747396476, "uuid": "38ab236d-9b60-4900-90e7-626f1ea998b0", "comment": "Malware payload", "value": "1ea60b843d507eadc7b931d17be3b4b7", "object_relation": "md5", "Tag": [ { "name": "1po56mdxc-localto-net", "colour": "#E5C76C", "exportable": true, "hide_tag": false }, { "name": "AgidCert", "colour": "#56D604", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747396476, "uuid": "8db5367f-2b67-47a4-bafb-d7585304af58", "comment": "Malware payload", "value": "3e961c0e52873a0f9753098f48e09df6b9bff97fc5eff714b4b19e14cae1caba", "object_relation": "sha256", "Tag": [ { "name": "1po56mdxc-localto-net", "colour": "#E5C76C", "exportable": true, "hide_tag": false }, { "name": "AgidCert", "colour": "#56D604", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747396476, "uuid": "4143b67c-633e-4a82-b3e7-011f07d23b15", "comment": "Malware payload", "value": "1a9f58eabfda9d34f0e62d1db3ba0b3ea9c16cc1", "object_relation": "sha1", "Tag": [ { "name": "1po56mdxc-localto-net", "colour": "#E5C76C", "exportable": true, "hide_tag": false }, { "name": "AgidCert", "colour": "#56D604", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747396476, "uuid": "34de35de-136a-4bde-9f50-1464651b5a3e", "comment": "Malware payload", "value": "1854a6dd1802206b20a0f560665adee94a8c53b3ac1039fcfd29c6baa4c4a744e0da91859f566e8fc3ea3bed0edf85a2", "object_relation": "sha3-384", "Tag": [ { "name": "1po56mdxc-localto-net", "colour": "#E5C76C", "exportable": true, "hide_tag": false }, { "name": "AgidCert", "colour": "#56D604", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747396476, "uuid": "e4a26e03-0733-4282-a3f5-a08b14aac69d", "value": "T1BC82E627596DF822D37654F05D3F5B772235BA71CB7AE897A1133C8C60172A3B20CA98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747396476, "uuid": "a17957ab-559e-46b0-a7f7-0e528b07736e", "value": "192:eQFTRwKfsyw2ofR8s8xICFAjko2f/1zVJuuu7NCudXA2BHuCwfdwbwU42rBVO3Qi:eqTRrt5xbdudXJuZ0/WSQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747396476, "uuid": "6aae9d12-0217-436f-a63f-42e9e7b9bc5b", "value": 19021, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747396476, "uuid": "d1605e99-67e4-4b47-8e49-1ceca7d77a24", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747396476, "uuid": "07a43118-6529-493f-816b-862398436b11", "value": "FA-45-04-2025 (5).vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef3db48e-3228-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747381184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381184, "uuid": "16329b48-c6fd-447b-8807-3901d8e123f6", "comment": "Malware payload (Mirai)", "value": "b2896b16d57343403240f2964de82859", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381184, "uuid": "a5ad79e4-00f6-4780-b612-6c8c5c8f5a18", "comment": "Malware payload (Mirai)", "value": "3f1427a0d532ae35ce802d029136ccb773ea7e84985f6bdc44e70409a692b849", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381184, "uuid": "bedf14c5-f997-41f5-9956-40da2d416cfc", "comment": "Malware payload (Mirai)", "value": "052c49f9fd0756723a18891a3931747be663149e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381184, "uuid": "09bc3452-e449-4e3a-846b-ff80582b752b", "comment": "Malware payload (Mirai)", "value": "2ed0cff0d2dfbddc49ddf27d359f06ef52108ea222a4ec505873456ee86d11a89d7e6353153277f7d1748ba7dcfdcd12", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381184, "uuid": "2a44381c-d19f-4599-856f-95a78d6e947e", "value": "T173630891B881A626C2D1137BFA6F008E372457D8E2DB33139D255FA0778A81F0D57F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381184, "uuid": "863291fe-c0cb-415a-9a94-36dcb60491d5", "value": "1536:eOTgWIYeMlktkUwnEU0+m7FcWS2RM8fhWtu5zPeH:eOTgWLeMDcJS2Rrpeu5K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747381184, "uuid": "e698510c-6a2a-4260-a7bf-18f43fd84792", "value": 70860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747381184, "uuid": "fa47e9ea-c0b8-4890-839c-5cc48c0af00b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381184, "uuid": "1e710536-0ab8-4017-aede-f6da4402a591", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f9610fc-324f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747397586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747397586, "uuid": "e72bd0ad-e609-4481-a567-57303383acce", "comment": "Malware payload (Mirai)", "value": "ddb6c5b6327131499684d019cb87b21c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747397586, "uuid": "49c9889c-c72f-4dc9-b51a-e64603e44b0b", "comment": "Malware payload (Mirai)", "value": "3f6efeb115b2c69c73c25799395824bd428024cdcc708036eeafe23cc08096ee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747397586, "uuid": "4496f8f0-9878-40c7-8713-c32a57bfd95b", "comment": "Malware payload (Mirai)", "value": "8808903880d7f4e53754d0b7d8c968182ae88216", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747397586, "uuid": "4355ee68-a727-4d22-aa77-2a5cc48a0286", "comment": "Malware payload (Mirai)", "value": "fc5da4e11c79c59a6a420267a7687d840f3703cdf1e8f7033846e7b047e14c1205af57909c1b354a1ac6f00f01fbee4a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747397586, "uuid": "f58fdaa5-e8bc-4532-a405-22b1223a4179", "value": "T11363F19F606630C8CDEDB4F5A17D37546D4171AA23DC5B6C6F13CCACE9021AAB48F928", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747397586, "uuid": "aef1129c-e8a0-42a9-b4b2-169a73f17a2d", "value": "1536:d6sfd1jaUTkuV0HETk5LBLLEfFNNYmRBM8feQNWUW0:d1jaUVmm6LBM6Q80", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747397586, "uuid": "850f0aa9-6d49-4c4f-a4ad-b382a08c6f85", "value": 72916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747397586, "uuid": "0dc1f394-520f-4d70-aed7-09cc24c701c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747397586, "uuid": "c242386e-a556-4acc-b044-3c6dd559423e", "value": "Tsun.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bea7a6ca-326e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747411167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747411167, "uuid": "f555969d-cb05-4f51-95e0-b6131d27f6fe", "comment": "Malware payload (Mirai)", "value": "4dbc83166d383d7c79e65618f06492dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747411167, "uuid": "7823103d-ad46-4551-988e-289e5973e454", "comment": "Malware payload (Mirai)", "value": "3f7177c941bd064f11ef742f27127f1e1a7bf15126ba2d39936bb6cfe06707e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747411167, "uuid": "a59a9a08-3029-48fa-b9c7-136769a0fb96", "comment": "Malware payload (Mirai)", "value": "4c7c5507df5076a54222e753c86a859514dce0fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747411167, "uuid": "29041ed3-7b5e-41ce-8cd3-cd0f94287850", "comment": "Malware payload (Mirai)", "value": "39a89b7cd3c02a99d7f46898d076d09be2dfacc1bf6466407bf6d7572a4ccfe1900faffbd65f31cc709d55574e862697", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747411167, "uuid": "3c16d584-d2bb-4811-aa0b-76727481b571", "value": "T1F6D2F1E8EFB8DB87D4D1B73E4C5DDC0A35AC69671AB6912D0B410C226039DA0D5ECCD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747411167, "uuid": "740f828b-aac5-49cb-9cbb-109f55fe015a", "value": "384:MeMzN8f05Rpjk5Yfo2xZUTKmQAHHOvgm0vtsgV7EmQi3iDeGFXmLc1/Z3/e8UmmN:EN8fWlfoQmQAXV7EmQciiRcrHKOu3lqo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747411167, "uuid": "f06eb8bc-11f8-4448-ae43-c7a4f799a8fc", "value": 29912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747411167, "uuid": "855315fe-bec5-4e72-b0b6-af490d432b0e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747411167, "uuid": "1660b9e5-e6cf-49ba-8bfd-28a3af47dacd", "value": "z3hir.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81dd9465-3235-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747386584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386584, "uuid": "6395a5f6-850b-4d49-b546-b20c97a9cabe", "comment": "Malware payload", "value": "d0c288b5335ebe985c68f4fbbeece12d", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "ZuRu", "colour": "#5BAD18", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386584, "uuid": "f6496efc-fdef-4280-bc06-0174d76fa389", "comment": "Malware payload", "value": "3f86c4cc956a6df5ddfad5d03334ece07e78351dec3ca62390f203f82675e00f", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "ZuRu", "colour": "#5BAD18", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386584, "uuid": "fc96e303-c1ed-4da8-a799-eeb1dcb7bb88", "comment": "Malware payload", "value": "f67e1468d20be89f7fffaccffa5956eff4a6159a", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "ZuRu", "colour": "#5BAD18", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386584, "uuid": "3a6e4cb5-d034-4eb0-922f-dae0600b4875", "comment": "Malware payload", "value": "845559fc3a951d876355d50f9befce18e8011a352bb142915b085ff71340e403405d62b8361f265618a4508040bda53c", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "ZuRu", "colour": "#5BAD18", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386584, "uuid": "8e56377e-304d-4650-a4ff-7c964905ffea", "value": "T1A013B6176748095BCD599238C17E53839294FBA9EF52B34F0390D228AFE5FFA1315E0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386584, "uuid": "6208b01c-bdb9-45ea-85e2-5e53b390c5d8", "value": "384:miL7YtMhyPlGQ6aRCYVCjT+UZ51uqQzK2:rLa9GQLHVC2M1uxW2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747386584, "uuid": "2387d09c-6481-4947-8595-c0312e2183c6", "value": 43296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747386584, "uuid": "3a6ee8bb-baba-4c8e-846c-4ba422221514", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386584, "uuid": "3d087e96-b40d-48e1-b45f-ee6ddc394de7", "value": "3f86c4cc956a6df5ddfad5d03334ece07e78351dec3ca62390f203f82675e00f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00a7b8ea-3288-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747422015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747422015, "uuid": "6568d06b-8c79-4097-831a-8c129eb2e5b1", "comment": "Malware payload (Mirai)", "value": "84acfc98162452677e8b5abe3ad516a7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747422015, "uuid": "bc43c830-ae1e-4feb-b4a7-49d7b7a75e75", "comment": "Malware payload (Mirai)", "value": "3feb734ffb59eccedefb07ea1b9e36d9392c2940fe1d094257e0bec461697e10", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747422015, "uuid": "b4bf4c0c-c55c-43be-a6da-e0be6ff6d0a3", "comment": "Malware payload (Mirai)", "value": "095c7cea19e4d16a080f8ab59fa26c1a5358af57", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747422015, "uuid": "61650fc4-ad2a-4b59-b96d-2e3bfa8ff2ef", "comment": "Malware payload (Mirai)", "value": "2d502f7e1a2c5ba94c223f3eb7ca2fed8f4f36e513663346b09d57c78262a147dbc250e4cb2cce6b1da2521eac76425e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747422015, "uuid": "98390b57-2ba8-4a8a-a796-2834ca156ceb", "value": "T185835B25BC792E13C0D4B83B22B78325B2E5270E25A4CA5DBD360E8EFF156A034575B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747422015, "uuid": "73a4b7ed-3eb1-4c6c-b88f-517697c7226b", "value": "1536:LKMo/69SyAXsE3QdMvjPV4jlbOYWQzugUYUASA5c:mhCsZ6M7PIbTW2JULAK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747422015, "uuid": "d7b66ce7-fc46-446a-ac0b-aece75ea3ab2", "value": 83008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747422015, "uuid": "38227049-36e5-438c-a6e0-2f3e0cdb7afd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747422015, "uuid": "04f3d5d1-6a3c-437e-9406-f1d97f06f9b1", "value": "db0fa4b8db0333367e9bda3ab68b8042.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f660c0d-322b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747382338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382338, "uuid": "bbd662c6-758e-477b-ab04-040c4375f806", "comment": "Malware payload (Mirai)", "value": "801606b0eb8400dc67d4ad347a14f4b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382338, "uuid": "ed8fc460-2b12-4665-8178-755d02fd8d3b", "comment": "Malware payload (Mirai)", "value": "3fff6d65e3fa37b3eb085ca2e6f528a7c1de83efc4a8e9097ad9e8700ad254fe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382338, "uuid": "aaca2ffa-3ebb-4ac4-8d45-1250ce0831d3", "comment": "Malware payload (Mirai)", "value": "b0c531c36b8552c1d34797740a5bf1e468b6127e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382338, "uuid": "20c8b256-6d2d-4e04-9c51-3131b2024121", "comment": "Malware payload (Mirai)", "value": "51f2ca5fd7365f7a371e971f0c6c5480067b8fc2031e2d5ebb67cba79c5377348caf3e024d364fdde0b2734cf12b894a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382338, "uuid": "1ea24bc8-d5cd-4caa-b74d-248355b97901", "value": "T1E5337C67D82A4D98C5194278F4688D391B13F408A2973EF65E8EC762501BDBCF60E3F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382338, "uuid": "5d047c0e-6251-419f-a229-e89b306b137e", "value": "1536:uaok/dgBORYzVUsvbE0g/EFDBiSurCei:uG1ftsvbE0g/wDYSur", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747382338, "uuid": "dc859541-e6df-428e-871e-aa6d16eb50d2", "value": 51968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747382338, "uuid": "87c2b0f4-f553-4996-b2a6-f2b03a2d99d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382338, "uuid": "6743f14c-ea31-4eed-b867-516fd7fd4b3d", "value": "kwari.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31b8d269-3288-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747422097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747422097, "uuid": "082e7d43-f00d-4f96-98c3-3c87044b18d1", "comment": "Malware payload (Mirai)", "value": "9ce4b58d5b47670494704d446e3d15ba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747422097, "uuid": "ec2a2278-7dd8-44d7-88f3-dda4ecbe71d0", "comment": "Malware payload (Mirai)", "value": "400635d38eb98b4b5724f95434a47ac3a746124452261554092b2644cd5279ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747422097, "uuid": "3f84c127-bad2-4846-bd2c-74dfc49b1ed0", "comment": "Malware payload (Mirai)", "value": "2fc29e99c3c8af856ee684669bb168d70c028cff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747422097, "uuid": "2a34a0f5-f7ec-4589-8302-7dc3f22fd494", "comment": "Malware payload (Mirai)", "value": "6d6e9d0467b913afb64e2dad794281785957d318081518392fed7a7d7e0bfb1c5011cebafeed171b7e3b2eeaf6085b92", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747422097, "uuid": "186aedae-259b-4dcf-8695-a8139184c697", "value": "T19B631945BCD28A2AC6D023BABA6E51DD3321B3E8D1DE3107DC105B2477CA61F5D37A91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747422097, "uuid": "4134aad4-4026-48fc-ace6-5ef0b0fdc37a", "value": "1536:5UHCIwS4sgUscNf4rT9oaTxs54wUYAHkekPykrupE1IIA:5UHCIwS4X8fqSHAEtacupI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747422097, "uuid": "ffa6f03c-b619-4b7e-b83e-d66c1c3d8ef1", "value": 72044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747422097, "uuid": "79e94d3f-27cb-4b52-84d9-6506d5faa030", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747422097, "uuid": "6f620576-f345-417b-a4f2-d7c3120755a7", "value": "db0fa4b8db0333367e9bda3ab68b8042.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f858c7d-3299-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747429503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747429503, "uuid": "72d623e3-976c-427f-a1c9-90645524970b", "comment": "Malware payload", "value": "9f72e8011180c65250a1fa16732bcac1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747429503, "uuid": "817f1154-90fc-473e-b66e-17b6083979c9", "comment": "Malware payload", "value": "40166eb4ccd72868b7519bb3463b24704b0ab7f3a9b446c97b38a2115a901391", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747429503, "uuid": "95a41d03-5e3b-4ef8-b662-d5c00555c02e", "comment": "Malware payload", "value": "fd3578dc4c0e8614513e2b59709de3700bd69847", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747429503, "uuid": "70f6827f-7d85-48db-a1dd-882a77ee15fb", "comment": "Malware payload", "value": "e9f72f70612a2d4124fb84459fd88439aaba20225b892e8402bf551586d24ba1729a5c32da08d0aff636b85c847ef112", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747429503, "uuid": "55110ff6-d7da-445c-8a3f-7bbe5ae5e6d9", "value": "T13442E850EA9FE9F1C9051AB0261AF72B533734381218DDB3CBE4FE57ADE169084E71A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747429503, "uuid": "03b4d497-1fb3-44e7-bf37-404c1c5a449e", "value": "192:fiBSn85eInjII38vvEwUVjDJjooLfpHR0iLdSNylQ/3XEbanA7qRiNiza9LfgUh8:fiBpB0IxJj7fPQ/Ht00axfA9Cyn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747429503, "uuid": "10aec360-2ccf-4278-b41d-45777d58b4b8", "value": 12769, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747429503, "uuid": "6eabd80d-8915-448a-a2c9-20231ba1aa81", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747429503, "uuid": "02a557c3-cb25-4bd7-9d0c-5ddd9f13446b", "value": "i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9243a639-323c-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747389618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747389618, "uuid": "725b1f1f-c816-418b-84b1-ab3efb2d3617", "comment": "Malware payload", "value": "45a10382ff9ddbd298519e604454465a", "object_relation": "md5", "Tag": [ { "name": "antivm", "colour": "#43D3B7", "exportable": true, "hide_tag": false }, { "name": "C++", "colour": "#5B35EA", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fud", "colour": "#410AB8", "exportable": true, "hide_tag": false }, { "name": "javascript", "colour": "#5DBE2C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747389618, "uuid": "5152205d-5042-4701-a60f-7d8bdf40f79c", "comment": "Malware payload", "value": "401bf115a8453e130a5effbe767cdac2d202a330af60182df5f73a7159668610", "object_relation": "sha256", "Tag": [ { "name": "antivm", "colour": "#43D3B7", "exportable": true, "hide_tag": false }, { "name": "C++", "colour": "#5B35EA", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fud", "colour": "#410AB8", "exportable": true, "hide_tag": false }, { "name": "javascript", "colour": "#5DBE2C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747389618, "uuid": "a2a5a875-3549-4f08-9eb6-4f8b6d6a96cc", "comment": "Malware payload", "value": "2721547b44745eac018f92568aa65f8925fd6a0c", "object_relation": "sha1", "Tag": [ { "name": "antivm", "colour": "#43D3B7", "exportable": true, "hide_tag": false }, { "name": "C++", "colour": "#5B35EA", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fud", "colour": "#410AB8", "exportable": true, "hide_tag": false }, { "name": "javascript", "colour": "#5DBE2C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747389618, "uuid": "1617fa2f-1689-4b93-990d-38db7664c545", "comment": "Malware payload", "value": "ec685cdb72733bf41289d336e9eb6df1c275fa1ff36e25faf664e3e2f0279edac12be3b002dfc75e98d843916b00534f", "object_relation": "sha3-384", "Tag": [ { "name": "antivm", "colour": "#43D3B7", "exportable": true, "hide_tag": false }, { "name": "C++", "colour": "#5B35EA", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fud", "colour": "#410AB8", "exportable": true, "hide_tag": false }, { "name": "javascript", "colour": "#5DBE2C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747389618, "uuid": "7b272e27-5fb5-434d-aaeb-c1e32b92c551", "value": "T11AC54B31F1E540E9E097E0747E269A46D9A3704603B46BFB26D1CE441BBA9B00BFF791", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747389618, "uuid": "c8e688fd-fbc6-46f5-ad49-10d8f6b5e2ca", "value": "f1bd6399880c011db8f23d106d893d1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747389618, "uuid": "87216c2f-48c4-45b2-9a8d-ba391fb299e2", "value": "49152:fUMB3oiHaG/4y+7285F41XXDArAeHFj/oew:Tj885e59w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747389618, "uuid": "12029636-3652-4e21-bd9a-a7427b1dc7a4", "value": 2625024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747389618, "uuid": "74cdff7c-9ab6-4763-998a-e314758ed796", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747389618, "uuid": "fdbebc35-258e-464f-9281-b59a802ef2e6", "value": "DupeDev.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b0a322d-325d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Amadey)", "timestamp": 1747403806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403806, "uuid": "e530d704-dd4d-4990-8abc-b20173533ca0", "comment": "Malware payload (Amadey)", "value": "1ff195a55fb0a1ac8b88d634d46e371f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403806, "uuid": "9604e9d8-b8c3-4f67-822b-111501018950", "comment": "Malware payload (Amadey)", "value": "4034c8bf8f1863b88d85ead67a70d9df989c4d2c2b15dd37dba9047c9aea0be0", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403806, "uuid": "e19c0403-3068-4c52-bc0c-19e309003b95", "comment": "Malware payload (Amadey)", "value": "bb73ba366bcaac0430e60fdf9de9697d7f53a21c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403806, "uuid": "8a4dec43-e779-4436-a669-d96d79f0e453", "comment": "Malware payload (Amadey)", "value": "12a3409f52779fc092a2f8d4e185f443b3418eaf1d8db86476d8dbdf346752220d2de1e67fa1be8faf376c5c4114c080", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403806, "uuid": "fea91965-0e22-4eaa-a4f6-98b098c2115e", "value": "T1F6159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403806, "uuid": "a2f070ef-531e-44a1-950a-df31eca6c528", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403806, "uuid": "96b26d6e-ab0a-4472-aec8-359c65d8f72c", "value": "24576:CqDEvCTbMWu7rQYlBQcBiT6rprG8aMib:CTvC/MTQYxsWR7aMi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747403806, "uuid": "2c548cba-3981-4980-9fc7-0d20c222e4d9", "value": 961024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747403806, "uuid": "a0211e66-21fb-44b4-87b5-965fc862b009", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403806, "uuid": "8d9e5d9e-855e-4bf5-af66-aaa79be944e3", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "399d2599-324f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747397629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747397629, "uuid": "96edc107-fbd3-4de1-ae03-96b1b5f8ff0c", "comment": "Malware payload (Mirai)", "value": "a8ef99ebeb5f65733b1204ba2a3b74e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747397629, "uuid": "de74a998-923d-4abc-81be-ecf7f7c5b6e0", "comment": "Malware payload (Mirai)", "value": "40f802238cd04544e52554910d665c34b0c79ecc889aa399d494812ada813580", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747397629, "uuid": "3525e99f-77db-4f10-a10b-5e5b1414fd29", "comment": "Malware payload (Mirai)", "value": "7dd04ac6ccdbc12ee824bbf932876a44bc70c8d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747397629, "uuid": "46e1a5bd-742a-432f-ba86-b27a53307a34", "comment": "Malware payload (Mirai)", "value": "4a983b13145d61bf19e7987ffeb258f9e7593e8d47ce130904cda3a36382341a70332d1872142297593a3c1ba561072f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747397629, "uuid": "4ab45a81-e1a9-4dca-a833-031ab5f6f0bc", "value": "T12604BEA7B74F1591C86102F81FCB8BAD3F2312415D2B86E36C6A353F5E761CB2522B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747397629, "uuid": "ed909a12-0a3b-443a-97f1-ae81198e0a5c", "value": "3072:DsBt/wg94VIbPgBkPE2f1PqKqNGiZgJCaWFIN8Zq:Ds4+r0kM2dCpbKCaWFPZq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747397629, "uuid": "f7ad85ce-e3ca-49bf-bfac-88642f04ec51", "value": 181708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747397629, "uuid": "432d6c3b-d6c3-4f4d-a5ea-33f15565122e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747397629, "uuid": "1c01e9d6-aa92-42ee-9b04-82bea90d329d", "value": "Tsun.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c39574b6-324c-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747396572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747396572, "uuid": "088cd449-5b8c-4b0a-a75c-11d2fb8ae40b", "comment": "Malware payload", "value": "ac17060ce8ea23158d6801600b399e37", "object_relation": "md5", "Tag": [ { "name": "1po56mdxc-localto-net", "colour": "#E5C76C", "exportable": true, "hide_tag": false }, { "name": "AgidCert", "colour": "#56D604", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747396572, "uuid": "df0cded0-cac8-4f34-a49b-c6885b2dcfa3", "comment": "Malware payload", "value": "412285ae82fde51b91e34327f9fcf40591456982a50ce73ca2fd74641f3da77b", "object_relation": "sha256", "Tag": [ { "name": "1po56mdxc-localto-net", "colour": "#E5C76C", "exportable": true, "hide_tag": false }, { "name": "AgidCert", "colour": "#56D604", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747396572, "uuid": "f2ea229d-0722-46c1-ab74-80681a2740ce", "comment": "Malware payload", "value": "cf462076d0b4123e22ccee58868a6b7d457bec22", "object_relation": "sha1", "Tag": [ { "name": "1po56mdxc-localto-net", "colour": "#E5C76C", "exportable": true, "hide_tag": false }, { "name": "AgidCert", "colour": "#56D604", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747396572, "uuid": "3c819e48-1b65-430b-9859-55cb9e6f64d1", "comment": "Malware payload", "value": "66e3c8532283277ee0f7745d4f775b0b3e4853cccd135cc58e21650afa2637aa6c0b97c9ac59553cc9d9c47459085ea7", "object_relation": "sha3-384", "Tag": [ { "name": "1po56mdxc-localto-net", "colour": "#E5C76C", "exportable": true, "hide_tag": false }, { "name": "AgidCert", "colour": "#56D604", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747396572, "uuid": "75f874d3-ec50-42b9-b7bf-883b2c39e210", "value": "T18C460237AEDAC628EE774DB3B1D28242642F1568AC0B907F13B05DC58E60C4B0756FE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747396572, "uuid": "852a11ec-aada-4ebe-a45f-a5b81e1f7957", "value": "98304:QjlxdPCJUxy0YxvjgGcnaN1P3QjtMtlvVhaJp3FlBVclpR2PtZttv9ycA:Qjlxd9yxjbbV3ktMr+p1evR2lli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747396572, "uuid": "1773c6c1-5db3-4b28-be7d-f317ea314791", "value": 5589953, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747396572, "uuid": "6ba7b19a-649f-4a88-96bf-7e2af2b72250", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747396572, "uuid": "65e0436f-c841-4c4f-89a5-697a0be60f04", "value": "InvoiceXpress (2).jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dfc2648-3226-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747380135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747380135, "uuid": "43bad28f-9ede-43c9-94c4-97d7382e645c", "comment": "Malware payload (Mirai)", "value": "73452b012adab5d329816201a106aa7e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747380135, "uuid": "e6569309-a8ee-48d5-b323-b95f343ab0a5", "comment": "Malware payload (Mirai)", "value": "4163d3af6552b5c430a47ff7bd5969218b55ad3a14ca1a14bb393e2348299b6a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747380135, "uuid": "95abbd90-a829-4713-ae68-c0caeaf4a9b5", "comment": "Malware payload (Mirai)", "value": "aaf629522af54b100f65aa8ba87f9016b09a0b4b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747380135, "uuid": "fb9aba61-78d2-41f3-ada0-c1210ed5ecb9", "comment": "Malware payload (Mirai)", "value": "9e01a3e9ba50302a0005d0e421f339cf70c7feb912827e5f885ec5647acf1d0e02b1ade11ced62c795d4c78e0575bd1a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747380135, "uuid": "7527779c-01dd-4275-92ed-744b554fdbd6", "value": "T1E373A64E6E319FFDF26CC33047B74A31A7A963D622E09685E26CD2141F6034D585FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747380135, "uuid": "a69df39c-0fbc-461c-8f42-86c38800894e", "value": "1536:KFtryvJURuCRuTiucl1RYi7bRxyEge69nlyi/p:KFtrKJORYiZxybycp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747380135, "uuid": "3d92034b-686b-4773-b731-9f869abbde92", "value": 77516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747380135, "uuid": "070f5147-117a-40c8-af33-78f519250543", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747380135, "uuid": "cc4147af-1e28-4e11-a250-658eee75ea3f", "value": "hmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da1ff741-3262-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747406059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747406059, "uuid": "8e3b1c81-16fd-4b08-8c01-96c2c6afbc8f", "comment": "Malware payload (Mirai)", "value": "84094756be68f69c49f61000283c6377", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747406059, "uuid": "8eec3e95-d5c1-47f6-9bea-5b6fcf0534e5", "comment": "Malware payload (Mirai)", "value": "41b237ad770ec7021b314081e1a9dcd65092a6e2410c9ac34e9ac2002f6cb1fe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747406059, "uuid": "607e66e6-d1c4-4b24-ae8e-4b44d9e50a91", "comment": "Malware payload (Mirai)", "value": "e5bd61252e14ee98a3d2f91bff1288cf03b2df7d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747406059, "uuid": "fd9b8520-82ac-44d6-8557-588504949716", "comment": "Malware payload (Mirai)", "value": "27037fe69ac5e2f9ce16c8f4fc192720f3efd4f4caea95fc183744d8c0315ff1410a60c8818323fe4bf7ea3230894edf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747406059, "uuid": "41ab22a0-05ad-4a83-af10-791f08166d03", "value": "T1DA82D178525978B0F230607BF8AAD3D7AB3317BCD1FEF663070495987A8920815B93C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747406059, "uuid": "0a5d5832-26f3-4966-8b9d-38649f4b1a2f", "value": "384:u+jx8lDhrKTmp5+M+tciblLJ7KJjcOWmeAPPhymdGUop5hUA:pF834KEBtDpLGmos3Uozf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747406059, "uuid": "db9a1059-b3ed-4be5-98c7-95907f8c0510", "value": 18552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747406059, "uuid": "0f6d33d8-54fd-4d59-9ed7-071ccd753bf8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747406059, "uuid": "17437252-b0d7-44c3-aca8-7513ca0dc31e", "value": "neon.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1967573-322b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747382342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382342, "uuid": "017ead87-ac54-4302-98d0-8324b4fbd953", "comment": "Malware payload (Mirai)", "value": "e17c4f3e8524f05e05ffbe2f723e3ba2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382342, "uuid": "a903865d-74af-41d0-b6b7-3eeb72bc27f1", "comment": "Malware payload (Mirai)", "value": "426de1ed9b1d716af2ee2d3b750ac872320233a7a90bb9c505da92b365909f24", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382342, "uuid": "9dd1eb9d-b542-49df-a6f7-b1a0a75323df", "comment": "Malware payload (Mirai)", "value": "99910a8bca62e2931899a55007a2dfdd4949b227", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382342, "uuid": "974a7ecb-b293-403c-84d7-1cba630c8a79", "comment": "Malware payload (Mirai)", "value": "e6127278778a904f293e015f7dd5aade691c495575453937b550137988d0bdb837c9c24e97952c540f3b62515e4491ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382342, "uuid": "900c6ad0-4e34-4edd-8aea-94d40f64a294", "value": "T19E534B32FA762A27C0E5A47A21F78B15B5E117DE21A4C65E3DB30E4BFF606406502EF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382342, "uuid": "a15a69b1-92db-4744-9f1c-1ed24c15f18c", "value": "1536:wwkfZJxFtojQlvnrj/Byzn7dke4tuItYZ6w8+BwQmz0XYIfiV0u:BkfZJxFtojQlvnrj/a4LYZ7FYN5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747382342, "uuid": "dc71e285-13fa-4148-ab5f-740589ea1bab", "value": 63480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747382342, "uuid": "1769113d-3dca-45d9-a529-2967e160a8c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382342, "uuid": "a0bba8ee-7069-4c53-864b-d4d2f11cfab1", "value": "RpcSecurity.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ab30851-320a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (SSHdKit)", "timestamp": 1747368157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747368157, "uuid": "7b666219-d6db-42dd-8a80-19e1d9c6c8fc", "comment": "Malware payload (SSHdKit)", "value": "1a8d32671bc009f09be94ddc50fe16be", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747368157, "uuid": "d94b3e29-b03c-49ef-933d-c342347f5c22", "comment": "Malware payload (SSHdKit)", "value": "4312e39cd68005b262dbbc244e5f63a8443d710ae9340b07fc8edea47ebf2bc8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747368157, "uuid": "7b544142-cb16-4aad-972a-f960b1ff9dc7", "comment": "Malware payload (SSHdKit)", "value": "7002071ed5ca8480d221483e1fa6c31d08d53a4c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747368157, "uuid": "33353732-6fc3-4df4-a8f2-97a8aba068a3", "comment": "Malware payload (SSHdKit)", "value": "ebdc998826301727d539b4c667ff590be2103209907333e10404a07112cd6e1021ca30a18b0e287eb9aea92d9f761722", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747368157, "uuid": "e00c9add-dc7d-4535-a547-c03ff9203701", "value": "T178356D56F9808EA2C5D8177BB75DC35833534B78D7DEB102CD08672877AB94A0E3B982", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747368157, "uuid": "6a4d085e-26b2-4b7e-80c1-9b079e4f1e36", "value": "12288:00Bw2wHeeJgR3asIAksAi0uObzkzOgFr1qwRcFjV1D7a9KbsaKjpeFmz4T28bLvl:00BnRED/TwOjX0a5xTdvl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747368157, "uuid": "465b7f5e-4128-4fdb-9c7c-01f2ae522a65", "value": 1110241, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747368157, "uuid": "e9d4c8f2-f53b-4ade-890d-aadf0475f367", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747368157, "uuid": "c6390f08-c599-44b1-bd4d-9646792008b1", "value": "sshd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cefb51f-322f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747383837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747383837, "uuid": "bccc88ee-c853-48c3-860f-6b107888681e", "comment": "Malware payload (Mirai)", "value": "6f1430033a670d7707263986cc9cfe6c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747383837, "uuid": "af34a9f5-fe61-4fea-ae59-f8462b78f8e3", "comment": "Malware payload (Mirai)", "value": "436b83929b0fa98b56ba91f40f8257eb6a85e41a0d29392162629e556614c708", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747383837, "uuid": "24f99741-43f7-4134-883c-6a7cd86e3b5b", "comment": "Malware payload (Mirai)", "value": "5a71eea37255536f8ea01a9346cf0656903bfeb8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747383837, "uuid": "5e636427-7072-423b-a2ee-e15f9aa7f1ec", "comment": "Malware payload (Mirai)", "value": "01ef06faf7a6014745f3c992cc4f3a1ad0d0ad999879e9af8f26df1e3a837a65616be61f33be88b960ddfac3d739e1fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747383837, "uuid": "b62e0846-1249-47c9-969d-8cc81c1d1bd2", "value": "T129638D66D419ACD4C4844338D4F24B792BA3B80483771EB6AED585BA4047EFCF9193F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747383837, "uuid": "e6c760c8-23fc-4ca3-a805-4ff75a6f9acc", "value": "1536:+aB3/4pSGFuNNNvwtkHKE7MIgJ/NETdsCevTX2C3i:+IQQGwNNNvHt1s7vTX2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747383837, "uuid": "5c72bc10-7f3a-42a1-a6f5-79e67d8fccc3", "value": 72276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747383837, "uuid": "a7a28bb9-da08-4c56-90dd-8c8d8fd54d74", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747383837, "uuid": "34a235ac-a925-4c6a-a609-b8b0b511dd20", "value": "UnHAnaAW.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d021e4d2-3227-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747380702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747380702, "uuid": "33297601-18f8-4938-b785-31776a0ca3be", "comment": "Malware payload", "value": "50a5ad62b99851599a4e2e4cb60da5eb", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SpragmosStealer", "colour": "#C6E2C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747380702, "uuid": "c6f7ae5f-fda6-4b2f-a26f-c3706b6cb304", "comment": "Malware payload", "value": "438aa511360de054b9e160ab6aa6c90feb5e7ad5b07c86b9e26e26aa2b3ab63f", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SpragmosStealer", "colour": "#C6E2C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747380702, "uuid": "4a597de6-0a1f-4ac0-afac-b126629253ed", "comment": "Malware payload", "value": "4f3affc4e94045fc681b1f831664e5b11272b3c3", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SpragmosStealer", "colour": "#C6E2C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747380702, "uuid": "016842be-cf6b-4c6f-94d7-bac0f60ca289", "comment": "Malware payload", "value": "e25cabf027b7e447c8d42c4c858c0b1de9b539250dc568be0f289f4bf56791980f066ad1e4883d6d837fc6b13d3c319c", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SpragmosStealer", "colour": "#C6E2C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747380702, "uuid": "f20879cf-9046-429a-a4cb-54b666324aad", "value": "T15543C629B940511B41B3537AECC3D015FEBA017B8206195878ACC1DA6FF494FC7BDE9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747380702, "uuid": "f5d87d02-e9c5-480f-9a12-2227df4e1c41", "value": "1536:Bs2uhe7nXJcfJil4CjRdgWRKA8MaQkpFs8cE:+UNuil4UgWRxar", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747380702, "uuid": "8a7c620d-69c9-445f-b5e5-ed753c497c92", "value": 58004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747380702, "uuid": "cf7b1a9f-f71d-41d9-b12a-bd201944d2bb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747380702, "uuid": "ddf74040-7eee-4a70-81e5-bab5cf7d2aac", "value": "Sparagmos.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16ec0663-3236-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1747386834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386834, "uuid": "e0f9d582-a38d-40f5-9834-91a402e4a489", "comment": "Malware payload (Prometei)", "value": "1a426e644f7a1ecf123da0a630505cd7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386834, "uuid": "4b62c5de-97ff-4554-839c-a43921635554", "comment": "Malware payload (Prometei)", "value": "441b177e606b866a97993482b170f792c49ca70d9e1f27e5e0c7196e14be85b9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386834, "uuid": "117c5566-fc0a-401c-8528-a2e3cc119323", "comment": "Malware payload (Prometei)", "value": "0f633f0882c5a55b8aa5842502ff8c9d1969a20f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386834, "uuid": "b5609033-fffd-42f0-a674-ca9b88705513", "comment": "Malware payload (Prometei)", "value": "36acfdc281f5f952246928788383f8186f87a65d9fd3d25ef21ef01243b493e6416f72b8cdbef12ab42a5256698c805a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386834, "uuid": "72ece4fd-8703-44fa-8868-c26d253294c2", "value": "T1429423F8C83D2E3098169B3CBB5A826CF0A15772D9562B7AB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386834, "uuid": "2703bfd7-0dae-47eb-82cc-d9ea71a30875", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitg5:25WOSACZSV6eKRH5EPiamb4DsDwwcJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747386834, "uuid": "8d9dbb89-ad8e-4946-be13-eec727ec1c01", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747386834, "uuid": "9d767f32-7fcd-4708-8222-414d42ee4509", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386834, "uuid": "e435f2df-a3ed-418a-bd57-b68ddf0dd8c3", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6c629e4-322b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1747382351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382351, "uuid": "846c5b31-5b0e-4a90-a41c-e6fc3ec3ef40", "comment": "Malware payload (Gafgyt)", "value": "c911870ccdcd78a67c303689af9d1d3f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382351, "uuid": "4d23f714-8212-467b-b1aa-e2388e143ea0", "comment": "Malware payload (Gafgyt)", "value": "442755a754a9bb1025ddb0afefcbc221ac9f9d37f4007b964b5f2c083fae2c22", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382351, "uuid": "1559e74a-8857-4aaf-983d-5a452e5e5335", "comment": "Malware payload (Gafgyt)", "value": "eec9c94264bcaa2070bdcc7e528c4e61e27e1ffc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382351, "uuid": "21952f17-124d-411d-8a31-f0c5cde6bfd2", "comment": "Malware payload (Gafgyt)", "value": "768241a677b1196fb3f27d1f6f77e1905df3455be141a052c9363c539e45f5a8c3d46cbc00a16bf7fefe5f8e661b2dd2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382351, "uuid": "cc14a973-0f61-43b0-8de0-f2672acddb30", "value": "T13BF3C9968B31D9B7C053E9323A756158B39CBB6A0B0F09CBBE1D75621E1E0CF641F264", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382351, "uuid": "f509fa1d-e7b5-4e3b-beda-88f40d93a4d1", "value": "3072:oSGAVZCgbOeVMeJlD29FrhWULBsLUD0afD+tKIj:oTAnCgbpjli96ULBsLUD0afD+tKIj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747382351, "uuid": "f26ae80d-1750-4bf2-ab05-718c29190e57", "value": 171653, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747382351, "uuid": "0b99d37b-e1b3-4b8b-a367-1b9fced602a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382351, "uuid": "97351626-f2bb-4669-a2cb-4fffae79284d", "value": "vtyhat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a2f9f2f-3255-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747400342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747400342, "uuid": "db0642e5-0b8f-47dd-8749-274dfe729cb4", "comment": "Malware payload", "value": "dc5af136798b5428f63fe6489e55ad36", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747400342, "uuid": "b6bae083-a066-444b-9fb0-3a1ed1489207", "comment": "Malware payload", "value": "444f08ff83f0e55fd21ec7be5192f915581077fb98a4e4d13399b78599a31c55", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747400342, "uuid": "2d85f545-e7c2-476d-90b0-d5aaa0382b98", "comment": "Malware payload", "value": "67b74393392c70b1744aac8af4af3170dab5c196", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747400342, "uuid": "5668a862-1f7c-4a96-8f06-a306496221f1", "comment": "Malware payload", "value": "cb030a4bf91c6d497b818c4a0184785afa4660ba6d5aa43c8ac725776e16abfc19054bd6a11280a8a8c67fff5d87021a", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747400342, "uuid": "47b8c0ed-651b-4c2a-b40f-a8c87671ae71", "value": "T12B65CE1B68484B62E51D42B4BD470D991F155F5DA8C9B9AE316F2EC73BF83320C8E42E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747400342, "uuid": "b5511af6-8e77-4584-ba7c-7a67242aef03", "value": "24576:bO+QECKIRlpWcdx9qBs6XSggmjvjdrt8Cwdh8cg7eJJCBta4:TQ1HJ37kSggm75BVirya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747400342, "uuid": "1d04bb39-f89c-4e34-b6db-b94ec480757a", "value": 1541632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747400342, "uuid": "4508a221-ddb3-46c9-8243-ba9e53409544", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747400342, "uuid": "f9b17ab2-89e8-4cbf-b1b4-d876734c269f", "value": "T-150.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e5e375c-322b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747382337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382337, "uuid": "d5ca83e6-8290-4a72-b619-cd9da11588e5", "comment": "Malware payload (Mirai)", "value": "a1bbbcf938fa7180d4abbc0f15b55367", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382337, "uuid": "78e052be-5690-486a-b382-3ead6e7ac544", "comment": "Malware payload (Mirai)", "value": "445edfa2520bd5d9c4c9e0acda48b7f4b2651b2bb8467426663298fccbed8e58", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382337, "uuid": "500461b4-b5c8-4c8a-9164-ffc086c96d1f", "comment": "Malware payload (Mirai)", "value": "3c07640c3a3b655e8e251c28c58863022bb1b8f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382337, "uuid": "249bf09d-4a4f-4df1-b638-598b35e702e2", "comment": "Malware payload (Mirai)", "value": "cc4d041cbc1194b99f6c98ced4085fb1a68b080ca17f039d3df3f97b16f400db5a64700362e4f0c48eaca01e4fdc5081", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382337, "uuid": "23f2d36b-a0cf-4d88-8590-7a95d4f5e5ad", "value": "T18073F819BF610F77EC6BCC370AA92B0529CC954B22E57B367934C528B60B61B19E3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382337, "uuid": "608745b8-0613-4edc-ae56-8ad5aebdbac0", "value": "1536:7J5dbFB4x92nKoIVa98M26ofWU+UZ9CYXzdJa10o:7J5dxBu9uKoYIUXd4f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747382337, "uuid": "5d331277-a039-4cff-9d41-1e87827c8615", "value": 77320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747382337, "uuid": "985b7809-4a19-4927-b01a-f0d58a154bed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382337, "uuid": "12105445-0b29-4246-b107-3c2bfdb86aa7", "value": "RpcSecurity.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6904739e-3241-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AmosStealer)", "timestamp": 1747391696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747391696, "uuid": "1fcc8a67-ab46-4c85-b22d-a2b1657c7423", "comment": "Malware payload (AmosStealer)", "value": "28a10baef599fbed2410664c86512754", "object_relation": "md5", "Tag": [ { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "security-check-u8a6--com", "colour": "#68A0E7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747391696, "uuid": "c887b44d-809a-4492-8819-7f5ca0c78fbd", "comment": "Malware payload (AmosStealer)", "value": "449440f520289cbfab71b7d13d2e2cc489db40c6dd86ea5939e09ce9227ba1c2", "object_relation": "sha256", "Tag": [ { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "security-check-u8a6--com", "colour": "#68A0E7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747391696, "uuid": "86a3a860-f42d-414e-95dc-62a9b10d83ae", "comment": "Malware payload (AmosStealer)", "value": "a8a786e1607b17bebbd2d125aa8f80e1276b2e6a", "object_relation": "sha1", "Tag": [ { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "security-check-u8a6--com", "colour": "#68A0E7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747391696, "uuid": "e677f149-3292-4187-80ac-8349debcc22b", "comment": "Malware payload (AmosStealer)", "value": "b840242364adc6160f93bc79c239c596f313b1cb52572fbf681b29c8a130df510f36d152394763b0360415cd4b4fa3c2", "object_relation": "sha3-384", "Tag": [ { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "security-check-u8a6--com", "colour": "#68A0E7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747391696, "uuid": "20865ae3-d67c-45e3-b20e-335efa989204", "value": "T1CBF4F18CF1D83F0BDCA701B725581792A0ECEE511390C76BE9514BBBBA943BD6C172A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747391696, "uuid": "c3e8d642-25ae-477f-9ffd-54b4f9ada1ca", "value": "6144:K5PPTfZ++jtl3g/ZGi1DRBneYleuRbuisQ1Nuw97DIEurgIaBxEKJYmh7YJ4DZn8:KJPqJHn59XHpFCbtXi8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747391696, "uuid": "858c562f-99e6-4d36-aa48-ae11f6fe8221", "value": 748816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747391696, "uuid": "19228c1d-0c32-4c73-84e8-69a770852d4f", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747391696, "uuid": "20710046-dfa8-44d6-9cf1-8ffafb88da6d", "value": "449440f520289cbfab71b7d13d2e2cc489db40c6dd86ea5939e09ce9227ba1c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56ddfd9e-3235-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747386512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386512, "uuid": "2c1b3f42-8545-4f04-b38c-2c297d6d8227", "comment": "Malware payload (Mirai)", "value": "b170f8a4f2e265d289605cc6a2a4455b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386512, "uuid": "b6add8f3-9d5c-4bdb-b145-1b4c35bf3786", "comment": "Malware payload (Mirai)", "value": "44ae290eefb70f644382bd2f1ff6232150ba5872b8a4d7feef1fe45e2371de94", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386512, "uuid": "542cb1ff-e983-421a-93fb-f4ee659c1e78", "comment": "Malware payload (Mirai)", "value": "099e254457e5b28630007f44611921e5fdeb027f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386512, "uuid": "a73d1221-db29-4699-9a68-28858c79038a", "comment": "Malware payload (Mirai)", "value": "e7eed82c13737fddeaf62223f5f499d9d6d59a9693e199acde85d335553def75d64d41cbf1aae845434c8fa364ad5234", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386512, "uuid": "3e923870-ac8d-400f-8323-4c9b8a4710bc", "value": "T1FEA30946A9419F02D4D631FAFB9E414933136FB9E3EA7201D920AF5027CA9DB0F77612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386512, "uuid": "2576c2b8-dfd0-45ed-a5fd-b51904e7ea1f", "value": "3072:4JCaUws3nUvwAh2atEKyMxL77hfE17USPqFHJaZXr:+C5J3Uvwe2atEKyMxLPh/Sy9QZXr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747386512, "uuid": "ad78c86e-8401-4f5a-a79c-8bc54a706d28", "value": 100180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747386512, "uuid": "1d6983fe-ce07-4129-9e3c-bb38f8536afa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386512, "uuid": "81d8aac3-a8d4-49ab-95b6-25fbc50f97c3", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "984efb5d-32a4-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1747434295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747434295, "uuid": "ad6487f3-655f-45d8-95fd-6c382d96e3bd", "comment": "Malware payload (Prometei)", "value": "4f40e9878f980dc1446d5be463b4d2c9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747434295, "uuid": "3a37cbbb-cca8-4efb-bb92-cd02831f88de", "comment": "Malware payload (Prometei)", "value": "4527db1dd519a0dc4af5440e435617dc1a4b92edabdf71bb399a1b788eb1eed7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747434295, "uuid": "b45422e9-d13a-4e23-a274-cbe165f1a6ee", "comment": "Malware payload (Prometei)", "value": "468f47ed0dbece43330ad6810e5550eeafafb24d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747434295, "uuid": "ef7faace-9686-40fc-8a81-8ddf7a2a3fe1", "comment": "Malware payload (Prometei)", "value": "a173682b928fc2406fd140836bcfc43550e0f819989d69d21fdb6cfd8ec791ee3b3ab4457e0d5745e483716fab1f9f21", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747434295, "uuid": "8c933572-f2c5-4472-9c8c-0e1291ae0ffe", "value": "T141155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747434295, "uuid": "b8316341-988c-4c9b-be9a-c572dff69d6c", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8MplA:qmShf4OTjMgXSJhBXEsVrmz9MOup1Kh7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747434295, "uuid": "8136f79e-0c1a-4d9b-8424-341e9b7c6eec", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747434295, "uuid": "c661647d-3590-4adf-8c72-97c4b91beb07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747434295, "uuid": "995721c1-54e7-4ec8-a81a-cbe41654caef", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46703d19-3244-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1747392926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747392926, "uuid": "a7e0e96e-2955-43e3-91d3-b16a1d4b07cb", "comment": "Malware payload (Gafgyt)", "value": "cbc087ad7290c4e9224389a2c8803cc5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747392926, "uuid": "510d43c2-85a2-49b5-855a-a20d50bdc3d0", "comment": "Malware payload (Gafgyt)", "value": "453cc4d41f07c893aead00c79195ab01a507bc6847c028aa9aaa3d118613daa8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747392926, "uuid": "8a0834e9-7785-44ae-b3df-36fecdfd103f", "comment": "Malware payload (Gafgyt)", "value": "e33f32ad1b43b9114c7d935ad0d5a084742f77f4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747392926, "uuid": "25a74110-bf1d-40ae-8f1c-2f282f3b1501", "comment": "Malware payload (Gafgyt)", "value": "17ed048b4232a65c313f5873073bc67fddc8bbedee70b9be5de3c53b7fd61b6e4c50542dfc61f08bf69061e92ac983d7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747392926, "uuid": "cb0e780c-4b32-4dcf-b4a0-f135052f587c", "value": "T106B30741D6548627C2D32B7BAB9F438D3336AA54A7E733095528BFF43BC27981E3A111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747392926, "uuid": "d544b554-e213-4884-93a4-eeda1a41f998", "value": "3072:HgvUxOcKFN+B9Jy8D3XvpIhfXl4CHz9cm7QnKQXaeW:HDEKXy8rvOFXl4CZcm7QnKGaeW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747392926, "uuid": "971196e7-1c85-4bbc-8140-d4e373958ac9", "value": 111561, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747392926, "uuid": "b624fa96-0407-44f6-a938-a1e32bad7239", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747392926, "uuid": "b8cc3069-6d97-439f-a7b1-cd2541116eae", "value": "rebirth.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "790bec72-322e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747383562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747383562, "uuid": "a9a51746-ec37-40b4-a0de-0b0efb196d36", "comment": "Malware payload (Mirai)", "value": "36f92fc044de6fc5563ea693d83d4ad4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747383562, "uuid": "c13eec24-355d-4d1f-bd53-004d260eecc8", "comment": "Malware payload (Mirai)", "value": "453f6bf3eac23b1d1aad25dc266e09384a9899569fa71b6c5552e7616d21d53d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747383562, "uuid": "19f26d73-d560-4343-9d37-3771d6a6add0", "comment": "Malware payload (Mirai)", "value": "bd07051a7f2292114259a1619564066dfdcf8f7a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747383562, "uuid": "6719989e-344f-4a86-ad5f-9f429ed6920e", "comment": "Malware payload (Mirai)", "value": "f9c8cc79d4d6cf520b2c86ec53c25e831dd129cc43085648cf760a1ba77d82353bf37a69f7d87befaf7cb72d8c937fb5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747383562, "uuid": "4c725655-788b-4a8e-ab22-6c81f156389b", "value": "T173231903EDC180FDE186D1309A5F9137DA3BF87D1224BA5E5BA5BA713D21E210F1EA85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747383562, "uuid": "bbd10514-c938-4375-b055-7d82139cad49", "value": "768:F603lMY9xMEdVGHmiyoVWVJtvwdrYx+rhpplz:I0Z9xMEdUGiy6itvwRaypL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747383562, "uuid": "d7df27ac-abce-4c56-b4e9-8e3f0c55351d", "value": 46144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747383562, "uuid": "02edd1b7-9b4e-444b-8f04-f35eac4a8fab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747383562, "uuid": "f2d12190-0be4-450e-8cb7-0e5df63ce6ad", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "052a0354-3259-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Hajime)", "timestamp": 1747401836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747401836, "uuid": "a2b0c138-96bc-4078-bf80-9751c5f94875", "comment": "Malware payload (Hajime)", "value": "4fb4c11e568a4646cfb8c7fd3ace5110", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747401836, "uuid": "bd2cf50b-c7b1-4e2a-bd69-9ddbaadde612", "comment": "Malware payload (Hajime)", "value": "4540fe2250a26d75357704e223a928d4874ce80f9d038b28dd3ae15c309e605a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747401836, "uuid": "d79077f7-72d6-4482-a44e-31e64b421ae6", "comment": "Malware payload (Hajime)", "value": "d382fdf887242b0517d469baed81524d0471d741", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747401836, "uuid": "21ce7cdb-c392-4063-be10-6bdd2ec20beb", "comment": "Malware payload (Hajime)", "value": "82d46ab6fe9b82335336e5c0b707091e2cff64a9da99668c47a4e0f1cefd8ac0bb90afa1fba2b9286c2c90dc69ace84f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747401836, "uuid": "2b95661b-7a93-4f55-8c6f-e72d6d13a73d", "value": "T13B631206239A29B196714AF2E7FDBB4CF64A39588FF16C247C123D78A93136D4CC8919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747401836, "uuid": "cce8b423-c454-43e2-b5d3-b4358cf2b4ae", "value": "1536:yYI0ARqw1qAEW67UIWi7M8gmfmJo0WgswnD6Efyq8PxlR0:yYI0ARqw1qAEv7UIFM8oJorFquyjkR0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747401836, "uuid": "ff586ad3-2535-4b80-b180-565e86ff17ea", "value": 67680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747401836, "uuid": "a2d0e4fc-ea38-4e67-97b9-d4ed3ead62e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747401836, "uuid": "9d56325f-064d-4b1a-b16a-04ee61d67745", "value": ".i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fdc1d5d-325f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1747404673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747404673, "uuid": "788601b4-b5aa-4c9f-9492-11bff2a2bbce", "comment": "Malware payload (Gh0stRAT)", "value": "3d1a810dc31683e726b32414a3f0587f", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747404673, "uuid": "10529da6-2cd0-4d61-b5f0-e39891ea1f34", "comment": "Malware payload (Gh0stRAT)", "value": "45a638c989dc770b1c043699d1c6c67373b4d5310f95dfd627c642d35931710f", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747404673, "uuid": "09fe08ac-3727-4ddc-b413-db9e5981cbeb", "comment": "Malware payload (Gh0stRAT)", "value": "b6031bcf04e9918d72670f201bce8d8b3d200787", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747404673, "uuid": "225e6ec4-c965-4604-8196-db2fa3a86764", "comment": "Malware payload (Gh0stRAT)", "value": "b23aa63004de38be1d4384e07611c06fdc33e9911fa9d0554d4dc79e593c842246c788d8395cbc8433668ad923497d04", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747404673, "uuid": "c1ad7ef0-afbb-40d1-82d8-2d8b8241e5b2", "value": "T19D773313B2CBD03EF16E4B3B05B2B29494F76960A836BD5286E484ACCF181741E7E757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747404673, "uuid": "332e1896-4b2e-452d-8560-54e77d5d463c", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747404673, "uuid": "c63e41cd-9dbd-4593-8272-fa2e38ac6c7d", "value": "786432:wXtmpNyXcoNlfygC9R4pUxc+2njBra7reIMQD8nVxtxrewqe3/py:wtmuXcofypeU++2jBgJt6VnxreKI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747404673, "uuid": "93c9219a-68b2-42dc-b121-5836e25bc109", "value": 34569398, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747404673, "uuid": "b7296cf5-44c7-4247-8801-6565ea35c7bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747404673, "uuid": "1fd7572c-71d9-42d7-8470-066c7bcc7ee9", "value": "111111.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb976041-3272-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747412960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412960, "uuid": "53d27996-8f94-47ae-9567-6ce46a4da3eb", "comment": "Malware payload (Mirai)", "value": "8ab552812fd0a33ba5319a0a50b73598", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412960, "uuid": "5a69e036-35dc-43ad-9ed5-8e7cbcf88a4a", "comment": "Malware payload (Mirai)", "value": "45bfcc0cb6f6a92550b176e73cf5a1e5ed879c5b2a5b78b27c761a369506ae57", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412960, "uuid": "959093c1-6300-4dab-b6c6-fe56c28b9a61", "comment": "Malware payload (Mirai)", "value": "a22b9e7531f24da9148ac339d65e0e77ee3c4def", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412960, "uuid": "9cfbbc9a-48e6-4e65-8188-094cfc285ae4", "comment": "Malware payload (Mirai)", "value": "cdd60ca3810fd8f7980ddb231faccd60f8ea4e8c1dfdb7a08f0a17f82997a7120b90a84e06d9ca4eb0ac1dc18a1d3eb7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747412960, "uuid": "06acf284-8922-4fad-9e01-43177f8990f6", "value": "T156338DA6C5BDEDA8C1544AB87D258F389B73E00086933EFAD644C65A8047EECF1593F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747412960, "uuid": "b0e344fc-df99-42b9-8d9f-855985dbe05d", "value": "1536:5aR5ewtQZut8GdcPs3q/aKlMLEm0DOFCn:5k5eDM2P+qiK60CF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747412960, "uuid": "7e0d76b1-0a58-4754-ad4a-a916372a5a91", "value": 51336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747412960, "uuid": "385e3813-1fae-45df-a0f8-72cc909d3306", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747412960, "uuid": "1ffab255-4e9a-49b4-b09d-d824b2e67a09", "value": "Josho.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf13f939-3249-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747395303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747395303, "uuid": "e4af7759-dd69-4204-ac3f-9722132fcee7", "comment": "Malware payload", "value": "92cab93fe56d5ec5a0b73083f47a1868", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747395303, "uuid": "907c4a59-9d55-4a0c-8593-3b0c01614d6c", "comment": "Malware payload", "value": "45f9325ab2ad25ce734183c0b38394d6563ebf7da818685447c5dac69a314d2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747395303, "uuid": "e42b7049-7ec3-4ce5-951b-09fe18d3e3ae", "comment": "Malware payload", "value": "6432ffc0126f439f67cbaf46dc314a13e9ebba39", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747395303, "uuid": "ce531e81-321f-455f-9761-da39f7a176aa", "comment": "Malware payload", "value": "e8c5b269abc9971743287d9a100ab6d6caf2e888c45154ff5a419db346dd8c1740d363992e7bdf3805911754ab8b2a56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747395303, "uuid": "0b0338cc-b48a-4001-a4d4-5745ef47fae0", "value": "T18E24BF02BDC250B2C5932C715B2A6B22F97C6A301BA9CEDF97D44D24AE215C1E7353E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747395303, "uuid": "367e37e2-2808-4c26-8889-b7fa9c7c2578", "value": "3072:HnWSR+jounK7NAKDjiBmKbOUEuQvS/bcwWE2wup3vMRU6RLvHEd9VhMCyqKr:2TouKrWBEu3/Z2lpGDHU3yJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747395303, "uuid": "f65996f4-fedc-45df-8262-75b0dced213c", "value": 228141, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747395303, "uuid": "a84c6284-2d04-47ef-9d05-63bed819b637", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747395303, "uuid": "105902a6-d308-4f9b-a1dc-2f5223831321", "value": "92cab93fe56d5ec5a0b73083f47a1868.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8c8dfac-3281-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747419371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747419371, "uuid": "68d54410-61d7-4c58-af25-36959e135adf", "comment": "Malware payload", "value": "d5f0829847911855ef6e09605346c4a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747419371, "uuid": "b8020938-5f0d-43f3-b76a-39f3d2c3a7d8", "comment": "Malware payload", "value": "460e55b5c2eaf6c066c587aaa5bd58f0fe23b75aca26c3a389cd30f0a8020f45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747419371, "uuid": "870688f1-9ea2-424e-ada3-2a66644e1d1d", "comment": "Malware payload", "value": "660ede34fc4b2cff6dadb7a0b12996d8fd2b9ed6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747419371, "uuid": "9cd4cf4a-0f28-465b-9acb-82c22d776096", "comment": "Malware payload", "value": "847503b7673034b442a305f20a5354f3c8e539d60af565caba16708d170215ec0fc46b4e7a7997707c917e40c3c85904", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747419371, "uuid": "2fcd3a91-0993-4e37-b5b5-ae7ed66d2b08", "value": "T1B9B63328A7A811F7FAEAE13D99528873C6297C151752C4E3D3F0C5662E233C177367A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747419371, "uuid": "8fa45a04-7688-49c3-86a4-ff3da4d4f68d", "value": "33742414196e45b8b306a928e178f844", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747419371, "uuid": "b24c717e-73d2-4e12-be87-718b94862028", "value": "196608:EAquoUqJJcRuYiiLnbWJWH4Lc355urH4P/XRLeSEJ+2KKmF:zqusJHY5WJVwJ5umXpM2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747419371, "uuid": "d86dd7cf-eca3-4c06-a6e4-85e96503754f", "value": 11252830, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747419371, "uuid": "b62d4485-7380-4e63-a790-1ca97177acd3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747419371, "uuid": "ca83b0ea-887a-4602-b0ec-e04db531162d", "value": "ransom.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3967878a-3288-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747422110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747422110, "uuid": "31facf69-1144-485f-94fd-d883f79d9b77", "comment": "Malware payload (Mirai)", "value": "b1e41d9111fa5a6eb336eaed68c23d3a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747422110, "uuid": "3f2a9c68-a898-4718-812a-6b96f04c0828", "comment": "Malware payload (Mirai)", "value": "463e3a05fd78637a9086ceef08ae0009d126b588ca126c221b0485fb0612fc72", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747422110, "uuid": "06e18e60-0624-4ad5-b701-8e0530763659", "comment": "Malware payload (Mirai)", "value": "29245ec05cbbc78639410c1e4ecf80064a0a8a3a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747422110, "uuid": "5cbba421-6b1b-4d86-8a4d-80fbc662b451", "comment": "Malware payload (Mirai)", "value": "9560af5a77c2b06a4233a835d87530428461a561f0bd14ea0097aa652624f94b28af7c3b470f0fac8566c68b5b100196", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747422110, "uuid": "768beed0-38e2-414d-852b-35c7a0095292", "value": "T12893F746BC918E11C5D423BAFA2E118D331263B8E2DFB223DD105F6477CAA2F0A77556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747422110, "uuid": "f4f15d0c-e240-4121-9da0-7530b969f5af", "value": "1536:JnwnqIuMUiDclVivygksCJ15U5F16jwIl/oITiPFGtDclIPi8w8f4EabA:J1IfyV8y5s4mZ6JRuP0w8f4Ea", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747422110, "uuid": "b5794fa7-18b9-4c0a-9dbe-41dc50c551e1", "value": 91500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747422110, "uuid": "c93afbcd-dad8-4534-ab4a-6af18b67b567", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747422110, "uuid": "6988ee6a-3e60-45aa-baf5-a3bae9a41a2b", "value": "db0fa4b8db0333367e9bda3ab68b8042.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41c59144-3244-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1747392919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747392919, "uuid": "25a1ae8e-246c-48c2-930d-695b4ed4fbdc", "comment": "Malware payload (Gafgyt)", "value": "5e562fcc20604130a8def7baca87f9c8", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747392919, "uuid": "7701cc14-29aa-49e3-923e-e47a388e11ca", "comment": "Malware payload (Gafgyt)", "value": "46d85b7c5daa9cba121d3206f5f25d1269e1cab0c43c3049a883180f3771a81b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747392919, "uuid": "990e1423-0f48-47fe-be8f-cff2ddd388cd", "comment": "Malware payload (Gafgyt)", "value": "6e9c3d6b535be996a53b7d837db8a7b2f8810fe6", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747392919, "uuid": "90c7b7e3-ef4c-4dc0-898c-8afeafb400b1", "comment": "Malware payload (Gafgyt)", "value": "31660d65956262c730100c5c515805a1298a6d195bf2fceffa4cbf5cc3774f32d94712b914ae58a4c7ac996c4a5edfac", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747392919, "uuid": "985e7bce-f0ec-4516-b997-380339bb6a8b", "value": "T118A012C650302560C45C4DF87881D00430404388BCC16E0850C486A244C4B0C3454744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747392919, "uuid": "7496b7de-bc20-459d-a00c-c29388ddb2a9", "value": "3:TKH/JnlEZTLU/LU0qMrSD2HQ:alEZ0/L7qMi2HQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747392919, "uuid": "bfd28423-3481-4fae-9170-3cc75be1d8df", "value": 85, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747392919, "uuid": "2d44969d-336e-4b4e-818b-df3bdfc7d2e9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747392919, "uuid": "2778b2f7-357c-4184-b379-821187d40643", "value": "bot.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18a00b70-321e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1747376529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747376529, "uuid": "9fd058a9-c6dc-424c-abcb-20c9dc9f945c", "comment": "Malware payload (Prometei)", "value": "9f9b88f5f5018cd07a8d01addf296614", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747376529, "uuid": "54ff93e5-08dc-47b2-a48d-08520255705e", "comment": "Malware payload (Prometei)", "value": "46da3697c39548afb438a21d7067c506b58a879f53533b480ac7d15512627416", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747376529, "uuid": "2f99feb4-427b-4956-bbaa-5b37a2a63f6a", "comment": "Malware payload (Prometei)", "value": "eed98040c5059c6cb7086a4257a75d10b6b22cab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747376529, "uuid": "614eb961-9544-459d-8dbd-b14a2cf502ff", "comment": "Malware payload (Prometei)", "value": "962c04288b3f97a6713a2ebec19cf2192c1f10a0e74c5e44dcb00f0e7bbc0fc8e1babad7a01b02689ef694354db78ee2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747376529, "uuid": "1d6fdaf6-195e-40a2-92d9-1e1fb3446c7f", "value": "T15D9423F8C83D2E3098169F3CBB5A826CF0E15772D9562B6AB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747376529, "uuid": "17f00830-b680-4b44-9f21-8e35fe5e60c7", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgr:25WOSACZSV6eKRH5EPiamb4DsDwwc7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747376529, "uuid": "4c1146ae-e655-47a9-8230-fc81d0962f9e", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747376529, "uuid": "9e888c0b-b66f-4e5f-87a6-6c40afcee527", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747376529, "uuid": "41d6b280-e7ea-4093-a74b-2d7413f51d6d", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fd821b4-3236-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747386876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386876, "uuid": "8a42f9f6-bcc6-4ad8-8ae6-d2e609390b54", "comment": "Malware payload (Mirai)", "value": "3b33459df78687dfeea25afe3507d725", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386876, "uuid": "f6cb8483-98be-43da-a05c-066294adc002", "comment": "Malware payload (Mirai)", "value": "4716bcfba6ec3362bbf53c6a86497cdf53292d31c53c126a88969c5d1998533b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386876, "uuid": "67c5f786-36fa-4452-8e71-a84799a430ca", "comment": "Malware payload (Mirai)", "value": "e59d6a91f862cd5d1f50528988a6aaf901f32451", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386876, "uuid": "d56d2a4a-f6d4-4aec-a25d-8dafe13b5c98", "comment": "Malware payload (Mirai)", "value": "3e15dd3b3f3f87cf7decaf318a6219266729e93a6c9cc6567d37b15fdd827f7c0aef819388dac3ba2336a7274b538df6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386876, "uuid": "86545295-5f35-4d1d-99aa-4f2e060ba4a1", "value": "T11983B6087F514FF7DC6FCC320AA92B09288D654A61F47BB6B974D468B54B20F19D3CA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386876, "uuid": "ed0e6765-30ac-42dd-a6c8-85e3da6c3739", "value": "768:MZ7xteofe3wrMpmNiy+4b8V8X8kzi388wjGlXm0KMS/2y/870t9eD3eeewseUndL:MtRYijP9/2yUO967FsXAqUZsc/Em5q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747386876, "uuid": "204e8a35-ed2d-4095-bb9a-c650bcbe64f2", "value": 80792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747386876, "uuid": "1dab57c6-c195-4017-8044-508f4176442a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386876, "uuid": "27d41846-f9c2-4b6b-a260-c1b216088f8a", "value": "Mozi.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb8cd449-324c-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747396586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747396586, "uuid": "2af0b3bb-9637-4283-ab89-08976872f085", "comment": "Malware payload", "value": "eb69e9b78a6da386db49cb54abc740f5", "object_relation": "md5", "Tag": [ { "name": "1po56mdxc-localto-net", "colour": "#E5C76C", "exportable": true, "hide_tag": false }, { "name": "AgidCert", "colour": "#56D604", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747396586, "uuid": "c5159c86-a6d8-448e-9775-0a270923bee4", "comment": "Malware payload", "value": "4727ba4b70a805375b9e7d80de8edffb71478af153d8a3f44cc48b43177fb344", "object_relation": "sha256", "Tag": [ { "name": "1po56mdxc-localto-net", "colour": "#E5C76C", "exportable": true, "hide_tag": false }, { "name": "AgidCert", "colour": "#56D604", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747396586, "uuid": "1f7c11c1-c0bb-4e8f-a717-de11e44f4722", "comment": "Malware payload", "value": "1f8ce0216039960090af7b76f14d9fdebb14ea7b", "object_relation": "sha1", "Tag": [ { "name": "1po56mdxc-localto-net", "colour": "#E5C76C", "exportable": true, "hide_tag": false }, { "name": "AgidCert", "colour": "#56D604", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747396586, "uuid": "cf804601-e88c-41d5-81e3-75205d453827", "comment": "Malware payload", "value": "5f11cc62553d21bd67bd0c1bbe224cca5b055984fd66bc60c5fff47172f167628c188cb204e35e79beab03f4a3d4a691", "object_relation": "sha3-384", "Tag": [ { "name": "1po56mdxc-localto-net", "colour": "#E5C76C", "exportable": true, "hide_tag": false }, { "name": "AgidCert", "colour": "#56D604", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747396586, "uuid": "05b720b2-6883-45f5-8e24-44976273c621", "value": "T1A5460217AED6C628EE67C4B379C286C1642E15E8AC0B987E03905D954B60CC707DEFF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747396586, "uuid": "51a5f6b7-8d6e-4d8c-bffa-ac88b25a2e55", "value": "98304:2qc0biFVlYEbO4RyhYJlvhhaJF7pl9lclyRLPKUnqf9391:w0bi3+EbOXhY/SFV6MRLix5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747396586, "uuid": "5dd536ec-a933-44c6-b34d-ac2c98eece7a", "value": 5586976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747396586, "uuid": "b34110a2-fff8-4d01-96e5-7b980f0b3d34", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747396586, "uuid": "7557a22b-3c05-43a2-b760-749417a1e8f9", "value": "InvoiceXpress (3).jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cae9471-3236-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747386870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386870, "uuid": "4f842e28-ed66-4283-a6b3-db133f8b79a0", "comment": "Malware payload (Mirai)", "value": "02625c65a9ca93dcd41cb96f424dc46c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386870, "uuid": "96000fd6-621a-457a-97b1-063438c9b400", "comment": "Malware payload (Mirai)", "value": "474806fcdb987d6917a5e58aa2025290fc0d44dbb653f9a8fbcfab67cad9fdab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386870, "uuid": "b2a47c75-4cf6-4ab3-8b97-4a05cbc0fa93", "comment": "Malware payload (Mirai)", "value": "25b8e7e4ab873844e0cd8912aa41bb174e934a57", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386870, "uuid": "fc7563d0-0662-4613-9541-49fd9d80da8e", "comment": "Malware payload (Mirai)", "value": "9d7a7a81240f661981fc592881dccbf5b1008a9c2a6dfbd92ac425944c0a3ad492f34b27ca8f04f4f73ab5225e3ca8c2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386870, "uuid": "e4e61424-fae4-4d3d-a2f5-8cb4141a7c11", "value": "T1DDD34B96FA408A13C0D62779B59F5249333297E1E3DB33078A245BF03F46A9A4E77D06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386870, "uuid": "484441b4-117a-4d81-b5bf-b6164d7c873d", "value": "3072:scNazqgnzb3fhGcMpnsqAmFhz4pYx+M7Xflr5M/9Hv:5NmnzLRysqAmFhkpxM7XNlM/9Hv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747386870, "uuid": "66e1796e-fc6b-48cb-885d-0756bd443a31", "value": 138243, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747386870, "uuid": "a58fccfd-a6b9-4294-a022-903d716271f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386870, "uuid": "c62e4e30-d0db-4e31-a966-be6210e14a64", "value": "Mozi.Arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82e847ad-3245-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1747393457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747393457, "uuid": "462c522c-4912-4e81-ae7c-e96c06ee157d", "comment": "Malware payload (Gafgyt)", "value": "54a888b5601f7ed8b86656c9f423eee3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747393457, "uuid": "03452574-48bb-449c-a3aa-0eb0c2698053", "comment": "Malware payload (Gafgyt)", "value": "475a4dbdad90906a5d9464c736deef1b91aab99113979981f307f3128cb49175", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747393457, "uuid": "4834ce26-6258-4ac7-9f18-4d34ccdf8891", "comment": "Malware payload (Gafgyt)", "value": "b45b5dead07674c9817222114cbe56fb9e642504", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747393457, "uuid": "1bf7bf92-407d-4f3d-841b-cc0abcf1b8f8", "comment": "Malware payload (Gafgyt)", "value": "8c33c5f6b2762acd1d90186c469a153810c4c3d341500d5241ec63d9bc2a611257161f5005f4570157bd41b1368dfd88", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747393457, "uuid": "ce2c06b0-282e-45c1-a028-2c7aa450cba0", "value": "T1CDC32A2327670B23C4E9503441E75337B7B5CB843978934BAAD0AE9C2F1AAD435973E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747393457, "uuid": "f432d31b-9388-4eeb-b01c-b9eb1719b21b", "value": "1536:lIR8jc0YyVNM2ZwoL0QImVv6Fuo+uU1tjTQM9KGmuwA/KiyYIW:ZcVyVNXZPVvaFZAX4GmuwACXYIW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747393457, "uuid": "32161e5e-6669-4613-9f75-46e94eae4db6", "value": 119963, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747393457, "uuid": "9457de99-032c-46a4-9dcc-2c594b7a1fdf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747393457, "uuid": "d24941b9-4ab9-411e-90d6-dc31cd6df4a2", "value": "rebirth.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caa6c260-3228-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747381122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381122, "uuid": "0c81c4e0-df13-40bb-961b-04f601abd9eb", "comment": "Malware payload (Mirai)", "value": "5f2704926818cbf1651289778a9b5529", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381122, "uuid": "6c610784-4542-46a2-b1dd-5348533d7641", "comment": "Malware payload (Mirai)", "value": "4815b651bf9049d56faa7a8608af5e63e2f839928fafedb28341507002d1d9f1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381122, "uuid": "3e82fd7b-dbe3-4611-9b45-dc1e76dc50ad", "comment": "Malware payload (Mirai)", "value": "0e2b642752d375d0d09859664e0caab2aa7848ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381122, "uuid": "a75dbff8-dbb7-4294-a00a-17e6b79af454", "comment": "Malware payload (Mirai)", "value": "01f6c5f9ff193459abe02f97233eb70764c4b9157326994ddfff24c8854f3469c173695c27a4d4fefaf907e4755279ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381122, "uuid": "3a1078d5-23eb-4471-bd8f-a0c65bc764cd", "value": "T1E9C2E193A0E58D06C872423B791F159B60386429138DFE2A373AAFDC62464B4A276DC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381122, "uuid": "61977d04-6fe3-438e-8135-25868c3fda81", "value": "384:MRGW9WXUx5+bkbRaliVErjrL9VD9jPwrSaf5dwapDyCTYHHJC8oytPFnAqV/Llk3:45+Kcrb9VDJe5FLTYTlPFnz/y7AoKc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747381122, "uuid": "4829b7c6-1674-4b4b-97e1-711019febf1a", "value": 27704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747381122, "uuid": "d57fb0ab-3c7c-4df7-a686-5067fa2138d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381122, "uuid": "6d93eed5-9aa5-42eb-8835-fb5de240688c", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e483b7c-3245-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1747393450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747393450, "uuid": "c1668789-1b5f-4c3d-bdd1-abc41f45be31", "comment": "Malware payload (Gafgyt)", "value": "41204b64f79c83b104bc0c6cbc80d58c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747393450, "uuid": "064d9c5f-fa43-45bf-af51-08cd8c624d1e", "comment": "Malware payload (Gafgyt)", "value": "481f813f9bcb2a0c0dfb34802ff2fb86ab4df8c44c9a0a4566c20aa64756be24", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747393450, "uuid": "92168e92-a7f1-42da-9999-b69829f31d1c", "comment": "Malware payload (Gafgyt)", "value": "9e0d31985f38d39c25231e54d90abb1200157f88", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747393450, "uuid": "e8a15107-cdf4-45c6-b385-d0420e0bb566", "comment": "Malware payload (Gafgyt)", "value": "93a8e2f715b3376377c5300ddc4d199cfb8c658e608b2b1823bb36a4767bcc02d963baa1e4f10f2d9f80070b74ca90f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747393450, "uuid": "dc40639e-0ecf-4a36-85cd-93e11ec006da", "value": "T177E34905DB408B17C1E2277AEBDB424933339B54A3DB33099638ABF43FC27995E26516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747393450, "uuid": "1a24bb2b-dd92-412e-8453-6c0f73b96c15", "value": "3072:ut8iFDKEfFN+Fa+1sWoh7nI8txVpUMbmQwfCMQiGW:s8iFDLf/+FaNBh7nI8txVp5mQwfCDiGW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747393450, "uuid": "ac985b99-a7c1-4ddc-bbd4-f3bafaba2f7e", "value": 150049, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747393450, "uuid": "fc17ea73-5dc2-43d7-a42f-f710a0b42352", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747393450, "uuid": "88629bfc-242d-47e1-ade2-305f21d0b74c", "value": "rebirth.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef21ffe3-3287-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1747421986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747421986, "uuid": "9893947a-d0b8-4854-9c56-7d3c52c15af7", "comment": "Malware payload (Gafgyt)", "value": "e1d06d62a6bac7dc6734644051a80634", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747421986, "uuid": "e41e9435-6104-42cc-949e-95f5309cf1db", "comment": "Malware payload (Gafgyt)", "value": "482eace4132761f4a0111b4273466f6ba090c014690dc1ac8ffb7ab41e7f32f8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747421986, "uuid": "f7b63d13-4a75-4ce6-86d7-b9f76f3e6ce6", "comment": "Malware payload (Gafgyt)", "value": "77bde192bb7ab9ff2ff11ee63d7c1a987dea0141", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747421986, "uuid": "ef900bc4-e558-434d-89e9-63cbfd799698", "comment": "Malware payload (Gafgyt)", "value": "31282c859434627c11d5bf5aada67872ace626c4e6eb91cd2185e3bddb07b790876116d03062beae7f6d04ff1c0f9fa1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747421986, "uuid": "fe6d13a3-20df-4b4d-b349-123d1f887ef4", "value": "T168E31A06FC404623C2D16BB7B35B438D77225F699BCB3351AA297DB02FE0B591A395D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747421986, "uuid": "d69ec573-df29-4a2f-a14b-cb1f89497dfa", "value": "3072:Pi+lT3j4X6LJ1KiUZrh/tPtgu/po7etJ8add9Qzhsit6l1oM6T6X4TtQ6W8GoQTG:yP7tPtLxo7etJ8addQHt6wM6uX4TtQ6n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747421986, "uuid": "c65a77e5-adfc-4dcc-9b6e-c740b0511f6f", "value": 146438, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747421986, "uuid": "6e3e845d-5beb-4284-b6b9-b94d0cd21bfb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747421986, "uuid": "b3e43ef4-092a-4746-8759-b6da35836798", "value": "apache2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69dacf45-3292-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747426487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747426487, "uuid": "119b0412-6f1e-401a-b9d1-04826e3c5560", "comment": "Malware payload", "value": "066090f7da793af1d3ce7d0c5c689d29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747426487, "uuid": "5bc960ec-74c2-4a89-be2b-60053cb3fd09", "comment": "Malware payload", "value": "485ea0445496b4cb16d4112a318a939f274aba9a2ff4b8bf00c27a43981b28a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747426487, "uuid": "37cb8289-7ad0-4642-973a-8d12f9e61336", "comment": "Malware payload", "value": "660e6aaa959f6351fdd79a977c0fd08d4f4b3c53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747426487, "uuid": "380a0857-acfb-4897-83de-54f37139763d", "comment": "Malware payload", "value": "59591589795c5cb0c047d6952111fae9e1f4a47b424d9458269628566dc1bc6d6ebf75a033fcd21a49f61e9390114461", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747426487, "uuid": "33bc0909-4864-4e73-baed-8ffe3900a24a", "value": "T19D473398F1945CF1C6B5543F5ACA46A2FDB6BC100BB4C9CB8BB893A01B673C4553BA34", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747426487, "uuid": "750b5439-3827-409e-990a-36fae87cb2eb", "value": "33742414196e45b8b306a928e178f844", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747426487, "uuid": "dfd7be22-7cb6-42fd-95a6-68ecb12c7579", "value": "393216:C3647iaY5WJVwJPW+eGQReAZNvTDy++aKh9jodS365/vE:C36kiaYWJqZW+e5Re63ynaW9MSQvE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747426487, "uuid": "24734869-24dc-4af0-9091-04f76616d639", "value": 25176617, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747426487, "uuid": "fa490c41-0803-4a07-ba0b-2026e1068ef6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747426487, "uuid": "add7cb76-1847-4e76-bb6a-5bb4bf33806d", "value": "BOFAMET.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd9355e7-325f-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747404750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747404750, "uuid": "a64428e3-eca4-441b-8371-499f2f9594c8", "comment": "Malware payload", "value": "7b1996833b688765b24d02ed0a5e483d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747404750, "uuid": "e19d6879-f798-46b4-a9d7-3d13fac1b198", "comment": "Malware payload", "value": "4890d6ecb4d777a2418e36d0fef094c8f18381b2877b6295f3af71ee9789432d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747404750, "uuid": "e988c284-ec4d-4d4e-8fd5-190f4a9f1a70", "comment": "Malware payload", "value": "dc2402fe87ae7aa0a620de3a9cc4c3ed988667c2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747404750, "uuid": "80303eb3-e9d5-4fd2-9950-de92ac6290b8", "comment": "Malware payload", "value": "216ecfecbcf156b856a874bea95f1f97e91b47cd36aa4b26a322fb0c497e32195b328fdce23dd29172debea552bc4f65", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747404750, "uuid": "20bb299e-dfcf-42f4-9907-cce78d55b600", "value": "T14095960C71D988CDA5417B22A577EC44F234D335F0ABA5D6B5DCE8F426E0060DB7AA3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747404750, "uuid": "f30999d2-6594-4f87-8344-fc83c1c0e9a3", "value": "24576:Ivl9aRZRubJZubJz/avl9aRZRubJZubJz/p:e9aRZRubJZubJz/E9aRZRubJZubJz/p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747404750, "uuid": "9d4c09ab-3363-4155-8a19-955724699919", "value": 1938690, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747404750, "uuid": "fd452c3f-122d-430d-9439-2e46a367a1ae", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747404750, "uuid": "c48b267d-9507-4d1c-86f7-5e4eeb27992a", "value": "payments_16.05.2025.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b35c1a8f-322b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747382372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382372, "uuid": "c36a00c8-4a70-42e2-9984-c86fc2551f91", "comment": "Malware payload (Mirai)", "value": "041c24456fcdcbc46777aa4828aa196c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382372, "uuid": "c07bfd55-80a3-481e-b22e-b80c98a814d0", "comment": "Malware payload (Mirai)", "value": "49409131afa7d87c3928eb50932a5aa67e472af6172d699b15288f90d9a217fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382372, "uuid": "34f82eb8-1c94-4b2b-b170-e56c773a91ca", "comment": "Malware payload (Mirai)", "value": "751e1f6824e60d9b7e421cf3834faaeaf0681c1c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382372, "uuid": "4df1de90-7ecd-4888-9898-e5ab11b1a87b", "comment": "Malware payload (Mirai)", "value": "806925d4cb063c61e9cb3096c94e394eba4e6a821742622a2e0f0613491a4be9abb28e25299c8273157d67749183a74c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382372, "uuid": "8dd65a4b-8baf-4f48-b30a-aa9c57f043aa", "value": "T100638DB2C0B46D68D2800B70B5E587398323D918A1DB6EF7D6418B78A447EDDF2193F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382372, "uuid": "de670597-e321-499a-aaf2-c16f0e8b46f6", "value": "1536:9ac9aynU5Tc8HIcdWTRUA1zWhGikN+jmXICszCibRt:9IynU5TBYH1KQHXICsz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747382372, "uuid": "d8a78afa-49e5-469c-9b3c-476cdca0894f", "value": 68764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747382372, "uuid": "3077824f-34e0-46df-990b-af742079e922", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382372, "uuid": "97689198-0e30-4469-b75b-a745d007f2f6", "value": "rift.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a492adb1-3228-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747381058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381058, "uuid": "3fa2083a-4702-496e-bd69-21d2a7f64e5e", "comment": "Malware payload (Mirai)", "value": "97078a57bfad2e8f73c8c42548aa7d39", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381058, "uuid": "80acb8b4-e9d7-4970-95df-dd721be5641f", "comment": "Malware payload (Mirai)", "value": "494c163228b19a50ee3f101149c73e5f4f43acd71e3d155fde70dc4b557ecebe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381058, "uuid": "4f07fe05-2d8e-41f4-9309-ce323796e792", "comment": "Malware payload (Mirai)", "value": "2b5f05124b296749bd020a3718508dc9f5b8cf40", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381058, "uuid": "c9ffae3c-daeb-49c7-94b8-4b2e19066f94", "comment": "Malware payload (Mirai)", "value": "46694255dad83719f5a2b33864aedd512a453a5763356f306bac9f414336d57f3c62b39244d0c3519f4f4f2e0e8e02d6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381058, "uuid": "b0a531fc-e8c7-4507-b7a0-75ffafc7a3cf", "value": "T1C9D2E1B86B0145D7CAAA90748DE50B362D608FA2F1426C076558D9D7BB098AD2CB5DC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381058, "uuid": "9e983c17-446d-4225-8076-c0053c81f952", "value": "768:E4ylAtv6pqLJM0RXaxGyUbXtheU/SoQ9IJgGlzDpbuR1J6:XMBqTRXa+Zhr/hVJuU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747381058, "uuid": "9bc7172a-4a4a-45a0-86e4-ac5e913e188c", "value": 28884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747381058, "uuid": "3934a7d6-73c0-4d84-9516-4a960292d5e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381058, "uuid": "2edb58d0-ec13-4aa3-8dd6-57709643a241", "value": "sora.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa1eb9f8-322c-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747382920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382920, "uuid": "cbfa22e8-ca22-4438-81be-11d3a78f8482", "comment": "Malware payload (Mirai)", "value": "8d5db2d89e167119a1506c2c04b57972", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382920, "uuid": "65be991e-1178-40b5-aeac-179cb5f04a3b", "comment": "Malware payload (Mirai)", "value": "4a59815900db01c89e2ee932640f49ffcf4bdc91a809d31fb210786ef57f8d2e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382920, "uuid": "489e36da-03ac-4ae1-a15c-a6a15c1f3381", "comment": "Malware payload (Mirai)", "value": "af585e704b0639ca06f0371a61de300abde0a589", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382920, "uuid": "7e27e360-da5a-4028-a419-9d11e0ad8094", "comment": "Malware payload (Mirai)", "value": "cd7dd90925250f74e6c2d92c366af80d4c059fb1612fb808af9f26183984465d690b376401fa6fdd7710580ed2c45646", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382920, "uuid": "e23e13b6-a5e0-4b79-9188-515cf83a6a1e", "value": "T10A835B22BE761D2BC4C4A57A62F34324F2F6475A24ACCA1A7DB10D8DBF25A4031537B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382920, "uuid": "ef817c3a-b4f4-43d1-9e53-6725390be3c8", "value": "1536:7RkgHXjVLCkm+7ydFtH40o+5sogfhrtxO:7pOhF40omNGO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747382920, "uuid": "df5cc512-46dc-4dd4-a1fe-7aab03f85429", "value": 83272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747382920, "uuid": "f3bd1ef3-981c-44c3-94f3-7d64897c7015", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382920, "uuid": "6d1b3bc3-6388-4e03-b3fb-78522363f891", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11ec3f33-3275-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747413884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747413884, "uuid": "8d3ba82f-9b96-480d-89c3-85e179dd68e3", "comment": "Malware payload (Mirai)", "value": "44dd7869b4fbd32af1e7f864844b2b75", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747413884, "uuid": "a40ec5b9-d713-4f22-839e-1f3bda4a4dcd", "comment": "Malware payload (Mirai)", "value": "4ae36969795c94c8bf41da40fa68dc5f21fab3b485e90f79646c67ec054b54b6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747413884, "uuid": "0b3af6f3-bfd5-425b-81e1-a82f2586cd54", "comment": "Malware payload (Mirai)", "value": "4e47e70bccfb36c4be9134f0ba62995ed649c275", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747413884, "uuid": "3e3b415d-7d17-4716-acd9-37392a9a6b5c", "comment": "Malware payload (Mirai)", "value": "766166e049c8f1473fb53681903f3fad927742f7264c2f1b6cc5077fa8bf588bc3a4d8f4887660b0803c4d3246597919", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747413884, "uuid": "6469189b-e5b2-4a1d-b16b-02e32557745b", "value": "T1D79127E93534576A2DA1ED7369D7C652F28521AAE1CC0D0BF2D2F0E5444DF62FC84B82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747413884, "uuid": "b60eb7a4-5a3c-45a2-ab41-3b1f67ed2d99", "value": "48:vz8MV4klz91V4RzrOrWV4czAoV4azE0EEV4EezUkV4+z91V4RzJZV49ziSV4szyj:vV7bW3PpD4TEpe3NfaXEXfNlz0/Axq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747413884, "uuid": "6039f9da-a0f2-49cf-a29b-b834018f0b9f", "value": 4440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747413884, "uuid": "5e1c0dc8-ab85-4b9b-992b-7fbb6a82c3f5", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747413884, "uuid": "c4994b0e-c37a-4ecf-b69f-d35bb04cbd9e", "value": "yarn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f16c5cd-3288-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1747422066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747422066, "uuid": "afca2c44-e703-4355-8854-9177f4e553ab", "comment": "Malware payload (LummaStealer)", "value": "4019f43f477b70d6c0b0d482eb7769a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747422066, "uuid": "344b3fd3-a6a1-4564-a371-8ba863b54214", "comment": "Malware payload (LummaStealer)", "value": "4b49ecdac3221f60f27bf1fc2950f86a5ff640fab62729c4a6a84717a828bb3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747422066, "uuid": "30881668-002c-4952-9955-a8d07c3ec3e9", "comment": "Malware payload (LummaStealer)", "value": "321d3ecfa4efa8dc769f0177e34f00ed6d0db480", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747422066, "uuid": "aef9b766-3a41-44d7-8769-65c28cd48558", "comment": "Malware payload (LummaStealer)", "value": "988f8fb420e270e51778e25b648d2ad35015de89d90855d46984d2a4b337b1db4927a92dd10e4c4acf90b1a822a87e2e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747422066, "uuid": "f396f6f6-cff3-4596-ac71-a3659cbb17dc", "value": "T17A35F164C24664EFFD9340BA4A52A642B97778728B281EEF2188E7772F133C05D39774", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747422066, "uuid": "afd5ff00-feea-4214-94f4-12ec08522484", "value": "cc56030055f1b3ec9cc1fa678dfddfd9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747422066, "uuid": "269f3d5c-e364-48b8-a373-0955bc334025", "value": "24576:188xQ/Sz/clrxuG+ZS6u/w8v6ujXB+ZS6u/w8v6ujXLt:188xQ/SzWrkG+ZSJ/w8vX+ZSJ/w8vf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747422066, "uuid": "1f379179-c849-4da4-9914-b5892c3fe66c", "value": 1069096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747422066, "uuid": "a2e670d2-2a2e-449c-be3e-40865dc8b2ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747422066, "uuid": "258b1ed0-5df5-4994-8f39-510be6f2427f", "value": "ZGSI81i.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3d7532b-323b-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747389218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747389218, "uuid": "58eb1c34-883a-4359-9426-7be1dc26e6bc", "comment": "Malware payload", "value": "e2331988e208fa31c3251a882d23e279", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dsh-fvsrchps-cn", "colour": "#DE3429", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747389218, "uuid": "6210ec0a-7f1a-4783-adb2-b4168c26b55f", "comment": "Malware payload", "value": "4b4b47220d5cca7b513a33287e7bbf4e74ea01d8f8bef9d01edb31dc6fcae232", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dsh-fvsrchps-cn", "colour": "#DE3429", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747389218, "uuid": "17920cc4-4c29-4d76-af02-ceaf3f0a6789", "comment": "Malware payload", "value": "e6af93c668b6b84a875f6d73de34751f04a6f9c5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dsh-fvsrchps-cn", "colour": "#DE3429", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747389218, "uuid": "4da19be8-68a7-4794-929b-b1883837c65c", "comment": "Malware payload", "value": "ee3b96242ea6b9e98d5ce86093580537bf846f6fc866c179d7f10490f7000dbd7305e8c91b57c1628452f4bec6028bda", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dsh-fvsrchps-cn", "colour": "#DE3429", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747389218, "uuid": "d3c1e6b4-19da-440b-a901-85a4d2fccb22", "value": "T114763329F5AC3F91EAC9CBF1196121B50A672D33132B53E82330758F86BEC9C5AD4539", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747389218, "uuid": "a180ed92-425d-4df0-a6bd-df3445eb65e2", "value": "196608:4yKyvNyyTk4SsohPekOfFGSw66W6HMwravDaaW:4yKGNyynSs4eksGfHJaraaW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747389218, "uuid": "8fdb9811-91eb-47b9-957d-7ef3a1829c5f", "value": 7343894, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747389218, "uuid": "b9b3de3f-2e62-47b8-aac4-bc43750f2ef4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747389218, "uuid": "e08db931-4e66-4f21-8337-23ae644fdfba", "value": "CRClient.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daa74db8-3228-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747381149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381149, "uuid": "c0632055-ce9a-48c1-adf6-a862e731d41c", "comment": "Malware payload (Mirai)", "value": "dff5824b3627f2794c1a7dc2baafb8b9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381149, "uuid": "b2222228-cde7-4472-a664-4edce6731ac8", "comment": "Malware payload (Mirai)", "value": "4b51976bd77932fd92826afbeb563de098975d799bced68fcda77e68caa3a339", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381149, "uuid": "ca4e9bdf-b1c5-481a-907f-c1ea6dc19494", "comment": "Malware payload (Mirai)", "value": "6388d362a57c8b4f8395f03501dc5d58c9957df2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381149, "uuid": "cfeafa40-4eb3-4ae2-b20f-33a3c654409b", "comment": "Malware payload (Mirai)", "value": "b03e81c3f343a5420cfecc79363acc8d1745b16937144171dedade1435ecfc49aa0e1d0ac278312d4781cb0b93f96d78", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381149, "uuid": "e480efe3-53d5-4bc7-a0a7-67bf6859c60b", "value": "T1C3530222577258B1C6C4433B3E3146C7739C1B7D63BE36BB439A0A95FAB98C16B10986", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381149, "uuid": "09b02132-ecc4-4fb6-99a2-b84ccbe6c988", "value": "1536:odfQgKG8MVy1Uq3Kjp475d7NWIqzZ/4fQLa:odhKGfM1dajy5dRWcQLa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747381149, "uuid": "38f2103b-6c8b-44ac-94fa-87fb5557698d", "value": 64240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747381149, "uuid": "8c45b372-e026-4edf-a4eb-d8e261e6a972", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381149, "uuid": "abf2111d-7a1c-4901-9731-27b62cfcc14b", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0edb1fb9-324b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1747395840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747395840, "uuid": "a175e173-5692-4be2-8e90-2b25c462a986", "comment": "Malware payload (Prometei)", "value": "5bb2e41215aa8c139f71678927fed3c7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747395840, "uuid": "2f1cff06-456a-43e6-ba72-56d77dddf32a", "comment": "Malware payload (Prometei)", "value": "4b5359550d22dc93469a3dd06eb2ef8ea7652be9f5b8377c4a8b11223979831d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747395840, "uuid": "74fdd84b-06c2-4721-b5ed-cba8db586096", "comment": "Malware payload (Prometei)", "value": "debb25e1725451f248e674c203dc7eb6ddd5d346", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747395840, "uuid": "72e47f71-b331-485b-9ab6-b8596da03af2", "comment": "Malware payload (Prometei)", "value": "72eaa076eac74c87bd7a8ae70f44d258ce1aef4f0aa8d83cbc142cd3a4fde1781b668eeed42c7f2d02f6636a77302f39", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747395840, "uuid": "0d74877e-294e-4158-b745-0e5f233b8aba", "value": "T1E59423F8C87D2E3098169B3CBB1A826CF0A15772D9562B6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747395840, "uuid": "3ab46f29-6cb3-4e91-b7be-eb36649224c6", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitge:25WOSACZSV6eKRH5EPiamb4DsDwwcO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747395840, "uuid": "74e5259f-56dc-42cb-a07d-9f12ec0805ff", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747395840, "uuid": "3f63d588-7232-4267-b5a7-438b54bcb092", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747395840, "uuid": "ff08f055-4b22-4d70-9e3f-5977272cf097", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbabec4d-325e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1747404344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747404344, "uuid": "a8eadd67-e05f-4377-bb64-619b5239e553", "comment": "Malware payload (LummaStealer)", "value": "ea901d024730d280e9195ca52bfd5a3d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747404344, "uuid": "3c07ea13-0def-4d97-8597-7ae2b8fccbc9", "comment": "Malware payload (LummaStealer)", "value": "4ba169f5c334b0f841bd919e5f06c1044a7c864fa6ab7d855ee8b12337c0e26a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747404344, "uuid": "647617e4-83ff-4bb7-87a5-3ed3870111ba", "comment": "Malware payload (LummaStealer)", "value": "46b918c44be12004cfd5c43395551868026da316", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747404344, "uuid": "1f345280-7ed6-48c4-a4d7-840c00096469", "comment": "Malware payload (LummaStealer)", "value": "585e6f077674d350b62c6f96faf0b11f8f7fc293b0928fc54918947a88dbc5590a2f5767d925a2889234d8a523805e2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747404344, "uuid": "f7d79a8a-0ff2-4d18-a168-9551a95fa3bc", "value": "T1B09533D12F71943BEE0D5A350A9692B79BF457059AC32FA010C62DEB7A173010CFA7E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747404344, "uuid": "eb13a15b-86ff-4355-8d32-eebb6d067b0a", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747404344, "uuid": "3b8555dd-58cd-4793-9d9e-68fa6db2d1a7", "value": "24576:3D9/d6Qmoqcl8zLIEmd5/r5GfUfTto3H0ZBpJ9iNyqx69kwF/E45pH4hR+3I4eGS:ze/oqpwvEfCUUZBSi/zofeWGZPQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747404344, "uuid": "aeb863f5-9430-4153-859e-796e62ddcab7", "value": 1967616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747404344, "uuid": "1a9144aa-32e3-45df-a234-f8df2f4c92ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747404344, "uuid": "d5acb2f3-28f9-4b2f-81a3-a5b347051cd5", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9f2f372-3275-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747414192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747414192, "uuid": "d08eba1e-e44d-4764-ae7b-5db00627041a", "comment": "Malware payload (Mirai)", "value": "0a1ebbbd2f53166217a78fea4105b5d9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747414192, "uuid": "a10f50db-16b9-434a-8e1f-0c83922006e4", "comment": "Malware payload (Mirai)", "value": "4c28fccab4620da37813faf8eb39fd7dba6a594853aa3b0144e8c42699d8fb94", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747414192, "uuid": "05922868-9456-4db9-bee7-2ba3d3955ad4", "comment": "Malware payload (Mirai)", "value": "4ac7f213b5930111c9ababd73e85b75c43864a9f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747414192, "uuid": "6b43f255-8d89-441b-ad6e-edd990cab8a5", "comment": "Malware payload (Mirai)", "value": "810e7b40441cf453aa70386e013626a08d61a99d6c6d799f1921459023d7b5503373d1ca3c8b9c11a2d12b68728b94e5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747414192, "uuid": "2e82ad20-4bbe-4317-83e5-c8deafcbd762", "value": "T1BE144BD7F800DDBDF80FE77644230909B530B79210925B377267B96BAC3A0A55A27EC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747414192, "uuid": "07ff2e38-8d44-442a-9712-be9a8a476903", "value": "3072:Y6JOgANRLye9NS1//Vj7DWI8KohTbRrKp2H525VOjbioLPFEH6yAXb1x:zwLn9Nc2I8KWTb2i52ALPpyAL1x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747414192, "uuid": "239e16f1-eb01-4cf1-97a5-71ef6e539b21", "value": 199328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747414192, "uuid": "7d38eb40-c673-4e7a-950b-195adc17b766", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747414192, "uuid": "a68524de-56e5-4124-8e3c-e532474bda3e", "value": "neon.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc5b8b98-328a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Formbook)", "timestamp": 1747423189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747423189, "uuid": "4a0454bc-748c-4238-a68c-073b97ccfa3c", "comment": "Malware payload (Formbook)", "value": "6d982efc879b5135b18bc1910ed86dce", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747423189, "uuid": "663149af-c2af-45d0-a13e-800ae5bae5ca", "comment": "Malware payload (Formbook)", "value": "4c7e5c9b9468a7c8749b000d83e22da94a2252d45965163e8a744d9fde4fa6ab", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747423189, "uuid": "392e09eb-c201-47cf-8cc4-99fe808c78a0", "comment": "Malware payload (Formbook)", "value": "f5c63a0ae74b4a1aa1105e41b1622223c44c8ee9", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747423189, "uuid": "63f836b3-fde3-47a3-a35f-be886786d4da", "comment": "Malware payload (Formbook)", "value": "95e5fec03c560781b933f2301c2fe8bff562bf3b79192a754ad571f5eeee0851eb2a3c1b2b4839e6fca3edb69ba95f93", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747423189, "uuid": "7a719d7f-01ef-4dd7-88f8-d78283c8b392", "value": "T1FD6257AAC7BBBD86CD43FB2FB53DA324415D052ED8B9C8941600B00A94E431AF4E49DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747423189, "uuid": "bdad06ff-7652-49cb-a016-30b63893bf6f", "value": "192:/b67w8P67PW8SMakP5xg6iEB6aMgc6+Dw8NF67p3:z677P67pxa4Tg6iC6aMgW7n67F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747423189, "uuid": "840125fc-f6d1-4dee-b584-7e54bfcfc437", "value": 15760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747423189, "uuid": "02bf6690-cb5b-42b3-a260-5068244bf116", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747423189, "uuid": "6b78650e-9082-49e7-88a8-4a518a2b0af7", "value": "greatattitudewithgoodfeaturesgive.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22fd38e5-324f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747397591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747397591, "uuid": "65340ff3-5461-4b9c-acc6-c3ebe6e0019e", "comment": "Malware payload (Mirai)", "value": "e944c193da933da0b85f891a68c38c07", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747397591, "uuid": "070b0918-6d61-41a8-9f33-64c3eba89093", "comment": "Malware payload (Mirai)", "value": "4cd5a0b8f450bb4b1eaeabe20ed1d9ff59aae87e272998d56e73d813da5040c1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747397591, "uuid": "0ece1743-b93a-4209-ae42-a8ede6287849", "comment": "Malware payload (Mirai)", "value": "9f8c95b08f373418aa6e278cf20756c122564a73", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747397591, "uuid": "ec63676b-ce31-4582-8092-e3fc2b0e28ca", "comment": "Malware payload (Mirai)", "value": "f81c91da6bf82111984b1681f8f48c36e20a37d628c6fcf52a41f4c3eb89b8c0233cfae1ab7d2f632b038b7f4801e885", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747397591, "uuid": "4c3fe831-b251-4b92-b62d-e606b27ada95", "value": "T16D53F28379D1DBA2EB9C1532D516C72879D3234086FCB36087B5677851C9AAE503F3A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747397591, "uuid": "21adfbe9-cef6-4710-b799-28fcbb492ac7", "value": "768:0OIC0ztnW4IdDTis3j+W4waTrKwxip8ICUgH3tcFCBppIg1YdCQhzIYW8ALHmx3l:L0RItisN4ZrhLTItCQhYOyaYMz7x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747397591, "uuid": "d9a7bdea-dea8-43ea-95c5-59ded665775d", "value": 66632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747397591, "uuid": "d74d278a-1dc7-4a7b-ac5f-9f6d5a9a47ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747397591, "uuid": "7e257978-aafd-4df3-be38-99f90d823bd0", "value": "Tsun.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "426cf07b-324e-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747397215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747397215, "uuid": "d137a2d3-36ed-4edb-8719-3ed95ad60416", "comment": "Malware payload", "value": "de14285d55d703576fc7d0e940981eaf", "object_relation": "md5", "Tag": [ { "name": "InvoiceXpress-zip", "colour": "#B98988", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747397215, "uuid": "90fb575b-7250-4105-ad80-66be50a9c99b", "comment": "Malware payload", "value": "4cdcc9b106ed277d88aa6c026aa709e94b246750cfdf61ad879a415fef207a60", "object_relation": "sha256", "Tag": [ { "name": "InvoiceXpress-zip", "colour": "#B98988", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747397215, "uuid": "b874c8bf-07f6-430b-82c7-0cae601f75d0", "comment": "Malware payload", "value": "21c4abd0e788d2451678414140fcb47a302d1049", "object_relation": "sha1", "Tag": [ { "name": "InvoiceXpress-zip", "colour": "#B98988", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747397215, "uuid": "4ee29192-cd20-4686-86f6-54999f487a77", "comment": "Malware payload", "value": "9fdfbf6ba06ec77dd133ca23f320d0dbe086d39fa473e708dd53b98c6e78a5fc903b8401f025e0dca7e9e1e3682bdea7", "object_relation": "sha3-384", "Tag": [ { "name": "InvoiceXpress-zip", "colour": "#B98988", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747397215, "uuid": "6ee2ce8a-fbbb-45c5-9e88-d906131953e4", "value": "T1DE1833A9ECB50E4AFC27C23EDE7A979F839461C62B409D3BE504C3534687BD2667240D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747397215, "uuid": "47dbef5c-e62c-4b03-a897-61ff45bc578a", "value": "1572864:d+pSWIWar4WKoUHXNjgDtLcLX7Bu/WqxqMXYEXh3X8n00F7waRlbX4:d+nar45HXmhQLX7BrqxoEXhY5Vls", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747397215, "uuid": "7bcbbde1-d0f0-4354-9caf-d5a0d51e8e7a", "value": 92181269, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747397215, "uuid": "75fd79a0-4450-41a9-b79e-6c40422589b1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747397215, "uuid": "b4f06514-32f2-4615-ace2-287c3600c498", "value": "4cdcc9b106ed277d88aa6c026aa709e94b246750cfdf61ad879a415fef207a60.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97cfffb4-322b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747382326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382326, "uuid": "3459fcba-9b50-49ab-b65a-a54393b08656", "comment": "Malware payload (Mirai)", "value": "ed91739a093d9b8cead6287225489791", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382326, "uuid": "5c5361a2-0079-4a1f-b40d-febe4e3b2d1d", "comment": "Malware payload (Mirai)", "value": "4d26ccffc97c7ddac0b86cd39285b8c344aed8f68e80753a82c3a6b083af9cdc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382326, "uuid": "38c0c57f-9406-4fb0-bd98-4f487ba4cb61", "comment": "Malware payload (Mirai)", "value": "ac5ddba59b44ba8ca32927bf4f686ab00ff000b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382326, "uuid": "7499a79d-90ae-4da4-ad1b-4dd32c47b348", "comment": "Malware payload (Mirai)", "value": "e7102f4ac41e317ad5c18fd7204b15d9cee948c0745ecb5a56f4185c9cf11388dabb7cc32bc459b1dba5dd8259a7d0af", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382326, "uuid": "7d7ad15e-8d05-436d-bded-a81600283780", "value": "T1A823F260F17DEE73D2804CB0ED96EDC32B8E6AB9816174F31E56121D76943163EB1913", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382326, "uuid": "3511eefc-8c81-4ce4-b653-24b81bee30c9", "value": "768:EVH8ikdyLRdN3aM8YvWowAJUS7XtRK4JJHn1TAwvire9q3UELi0db1p/ecHWfIU1:EVH8Gp3aMFpJPK4rH1UnrDL9p/ec2wU1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747382326, "uuid": "a915af6a-c9a0-4c30-858f-4f83115787bb", "value": 48376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747382326, "uuid": "4cb1009c-4c68-4e84-b85a-22f8fec1cd59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382326, "uuid": "79a4ff6f-9d6c-4581-a205-4487a904a3d7", "value": "kwari.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b95884e3-3223-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747378946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747378946, "uuid": "05693b4a-1d52-4b2f-9df2-129dd27c0acd", "comment": "Malware payload (Mirai)", "value": "2118d1b2305cbab321efb9862587e133", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747378946, "uuid": "608c5a22-eb47-49ce-939c-ba56873eba71", "comment": "Malware payload (Mirai)", "value": "4d3061252d747ec5ec19650a0e27279d78a1c6d2756230bc7dbc0e09f46c6e0b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747378946, "uuid": "4203b591-6a87-4aee-856f-785b84c6cd70", "comment": "Malware payload (Mirai)", "value": "44045c07d64108003ee38873284107013a07471a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747378946, "uuid": "26813e7e-f379-49e5-87a5-d7f399a3f4e3", "comment": "Malware payload (Mirai)", "value": "64a5286070ade679846a54aae81a5240f683e6afe898f04126ee4dbf900643ea7e4aeecef564bde481efba79e369985b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747378946, "uuid": "14b13eee-fa3d-4bfb-8cb2-a5bee1830e38", "value": "T109F2E1AF2189349ADADE0C3F63D9C671A9419080314A2F9DA38089C9B53D4477DCEABC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747378946, "uuid": "9a5a72c0-922b-4e0e-956f-7cf5606174ab", "value": "384:cIsK//PiH90ahQ7rRcjUczGbl7noeGGaiUa8VZjzHbnF4/+iLehdchAM6cFhsTRV:hsKqH9YCGbyFiN83vpQxhAn0sdWU9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747378946, "uuid": "6983f4e0-284a-4c73-a4d8-87c3c5f29811", "value": 35620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747378946, "uuid": "37575e82-7966-496b-abcc-d8234fb02be6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747378946, "uuid": "d2b2c8c9-73cb-4129-a0f4-bb55fdeb0f82", "value": "neon.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2888204-3228-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747381082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381082, "uuid": "c43208c6-54a7-450a-a146-a71a84f9ac5b", "comment": "Malware payload (Mirai)", "value": "9d3fb8f05936ded2d88e6287822b6099", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381082, "uuid": "5cf649f3-4734-472f-b745-47223e88af58", "comment": "Malware payload (Mirai)", "value": "4d8b94d042af9869134d63fa431b8dcdbd81fff4121c0705b2ba21254bc4b043", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381082, "uuid": "b373ef13-a07e-453c-9737-4a469ee4de63", "comment": "Malware payload (Mirai)", "value": "507ebfa9226868da6100e52de5e085f271eab9be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381082, "uuid": "d625e864-8b00-4a44-ab35-47e0aa7f1ea6", "comment": "Malware payload (Mirai)", "value": "ac417fff6042ce137905b3346403af0323bfa48add5224f24f989a0c86255eab60f3eb6b9d35eb975ce42af5f210cf1f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381082, "uuid": "554a5bb3-08b2-4fa4-848f-51d99418a1c6", "value": "T16653F1E215281294D90008FF4FF54F387EA19BE4D0E0C986718CDDB76FD7569B58AAE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381082, "uuid": "e59940a6-5a4e-4d81-8803-ae02ddae768f", "value": "1536:8pyE0U09iUVncFuYrWZDvBVHWkfuQzkazH35VJueh:8pyE01JVcFYBVHN1zkaLpVQeh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747381082, "uuid": "df7de8a7-1fb4-4177-8ee3-a4b098fdad39", "value": 62152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747381082, "uuid": "0a48031a-411b-4d0b-8528-8c3397d7f219", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381082, "uuid": "321b294e-7062-4608-a034-758884c106fe", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3ed2d9b-31fc-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747362160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747362160, "uuid": "4f4ead62-1da9-4598-aa9e-45e991bbc39d", "comment": "Malware payload (Mirai)", "value": "8c17e07eef1d00751dabc40c0beb2aef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747362160, "uuid": "e760ad8f-92a2-46bc-83b1-856d3ef7d644", "comment": "Malware payload (Mirai)", "value": "4e3fda6da8ac19e00911162e39ec674234dbf122d03b1452c2ea82e489282ccf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747362160, "uuid": "ea53de82-0a3b-40ca-8b02-fe054b4cb868", "comment": "Malware payload (Mirai)", "value": "887af4656a1840c9d6ec7eaa2e8f632a30701aee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747362160, "uuid": "b890afa2-4aaf-4c8b-b140-4e5d8ad369fe", "comment": "Malware payload (Mirai)", "value": "220a2af3f41f8bc3fed273affaf029fbce2f95a7e999f58871c60782b4f6c83c3dbae8e4ff3df81ea1decdc5960e9abb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747362160, "uuid": "db6ec1bf-74f8-40f0-ad5b-18e2612839b0", "value": "T11F93C70EBF319FBDFAA9823047B79A11AB5923D127D1C586E29CD6011E7024E641FFE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747362160, "uuid": "c2352cbb-9e87-4056-b370-463e29f97f2f", "value": "1536:c4rC4SShoZ4uBvUAgOiRbbv+qG327kZPQUecBxsqThI:c4Gk2ERPv+qb7UPQ6ThI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747362160, "uuid": "e38d520f-5025-47b4-9832-33b635cda7c6", "value": 88864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747362160, "uuid": "b57a4298-f3ad-414f-8747-2952430fc9da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747362160, "uuid": "2f53e38c-18d4-4eef-bc79-fdba77e2ac2c", "value": "neon.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d86694ff-3228-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747381145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381145, "uuid": "8cbf25a5-ea7e-4539-8d3d-95739053d82d", "comment": "Malware payload (Mirai)", "value": "3d5e4f6f08c40b33359ea3721200a568", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381145, "uuid": "f07a9926-e418-4f27-a491-cc0222e0c820", "comment": "Malware payload (Mirai)", "value": "4e7be74ada404a303371b366a3ed09d14ad0abe428d0c6e0d67744a108714754", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381145, "uuid": "6f42ea71-9d6d-4ebc-9d6c-826ef4242e50", "comment": "Malware payload (Mirai)", "value": "39b3d69ee60ad65ca7fcc6bce7079641c8782dc4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381145, "uuid": "a4b8db68-e8c6-4ff5-8466-8775aad6ee58", "comment": "Malware payload (Mirai)", "value": "f312b5efd0dbe216493d0bf72b2a8ec45a256f71c63fd187078a67a536449109c9e52832a20e77bdf10b0f39c3426c72", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381145, "uuid": "1bf4ba1b-bd9e-458f-92cc-bd2c84dd56c0", "value": "T1B0C2C0AFE8183E8ACACD087C846212957D8BF2C6504F5ECDD7354C845EA684FB49F8B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381145, "uuid": "1304ad6f-5b2e-4ca2-845c-f35adf280100", "value": "384:YqjQb+w72R3cjMaRzI0o/DGri026tQKcD9Uhap5vUs+NP6ZVPZRWGVCzhMhHIl50:zMfCuj1RtaD4i026VuRPvCN4VPXWMa50", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747381145, "uuid": "f5de067f-fa1d-491c-899d-94918060c26a", "value": 27048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747381145, "uuid": "4bb2afbd-bb75-403b-b232-f1d8a6be8a05", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381145, "uuid": "7a04f6a0-867d-4ce1-ba6c-53fde041aa3b", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad5629be-3234-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747386227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386227, "uuid": "773456c9-5abf-4fea-a9ce-3136646ab0ea", "comment": "Malware payload", "value": "cf21a32e6eee93ab4f085b7c2bb18b64", "object_relation": "md5", "Tag": [ { "name": "196-251-90-185", "colour": "#01F3BE", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386227, "uuid": "955b71fb-9502-43bf-9ef9-000f3a295c66", "comment": "Malware payload", "value": "4e981932b139891e66768e05daf26c75f829ec7b9d4d91fcc3878d7c19c9d386", "object_relation": "sha256", "Tag": [ { "name": "196-251-90-185", "colour": "#01F3BE", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386227, "uuid": "59c55e66-d6e3-4756-99ab-7f1fbe3a2715", "comment": "Malware payload", "value": "b5102cddcec3bc629da27e48cf40e119ffa2a405", "object_relation": "sha1", "Tag": [ { "name": "196-251-90-185", "colour": "#01F3BE", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386227, "uuid": "ec00ed6c-c65a-423c-bfd2-b9db0d7dc3a7", "comment": "Malware payload", "value": "e52d8794894b8e985edadd4b72588db2158994de5f5611ec717f85db0a90869c25fed9245acd1a888c45a9ebc47545e3", "object_relation": "sha3-384", "Tag": [ { "name": "196-251-90-185", "colour": "#01F3BE", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386227, "uuid": "a3123c35-e266-45b5-b199-fd039264e43f", "value": "T1CE91DD8A6F40586513674B6E7927D4C9F1E5EC56F68E801BD602BCD0FC50938ECCD672", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386227, "uuid": "ff429f45-0bad-41d3-a1a9-b0edfdb6fefb", "value": "96:Fhudwx2NI36mYCgs3zcx1kRi/eVFi+Qh4TTgcE:zqwx2NI3gMzcx1Ci/eVFRgcE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747386227, "uuid": "cbc2aab1-c00c-4f9b-9612-52b86d08b0c7", "value": 4500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747386227, "uuid": "8c21ba59-c57f-4872-8bd2-c0211fc8169e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386227, "uuid": "11c2489e-43c8-4900-b5c1-4fa9e260ea75", "value": "Husqvarna Documents.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdadbe69-31f7-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747360163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747360163, "uuid": "b70e6475-bc5e-4756-98db-55770284f6fe", "comment": "Malware payload", "value": "d77e042d2a633b1c9135d30bbd738317", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747360163, "uuid": "30db70e1-8613-4d14-bb91-5bdac0e2a3e9", "comment": "Malware payload", "value": "4ebe6d8b9b3b87e836c599b006767e6e3699a24cbe44d6a0e77b4d0e55e4002f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747360163, "uuid": "1657c7d6-d226-466d-9cb8-064dad01f7fc", "comment": "Malware payload", "value": "c1477cc21249aafcf10433f37a9e8986f5dc642a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747360163, "uuid": "80e17959-506e-44af-8b5e-8b20dfbff5be", "comment": "Malware payload", "value": "1924bdd7ecab9eced18bd6827aebb2fd7057d2769170c216fcc0ac13045d2231a2bcaff60c0c658f42d31b94f7007ba9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747360163, "uuid": "98ac77b9-526c-445c-9359-3f21bb20bfc9", "value": "T1C0747DD27A81FCD7CA25123C5AC2C226113CFED55BC24B07392673791E63AD16F8A61E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747360163, "uuid": "41c52529-43d3-438e-902d-13496db7e5e3", "value": "c5f49d131838d9478546ff5510f7e495", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747360163, "uuid": "a72601b8-12e5-4d4e-b1d4-62854125a52e", "value": "3072:XIAhbslwqBaM8jtZ5hfq+PrinmnWFQNNjUnv6XcARH:XIAfDDjfzfJjdXcARH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747360163, "uuid": "abbb5238-01e0-4a90-9efc-21335c07f101", "value": 352516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747360163, "uuid": "909d537d-8f0c-486f-a282-573bbac7ae85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747360163, "uuid": "9756a504-acc7-4ff2-af06-415075fe52ed", "value": "Oxirane.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6509d516-327c-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747417030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747417030, "uuid": "9130681c-40dc-46c9-aa89-c1a48b23013f", "comment": "Malware payload", "value": "cc647c1ee990c5bde78b95f5822007c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747417030, "uuid": "b2d45be5-5a62-456a-a30e-67922244f36a", "comment": "Malware payload", "value": "4f5de8c3d2d5502dd4d5a76be3875fff5018d4b4955c16eac2c9222ea5326db3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747417030, "uuid": "e8abce04-e0f4-42cd-8bd7-d79f56f9996d", "comment": "Malware payload", "value": "b7b1cb04d64c2a89a023c7c03740bba6e1746120", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747417030, "uuid": "5d6e58aa-5bb5-4b2b-9594-9fa50fb9a2f1", "comment": "Malware payload", "value": "a5bd3607d491fe22410931bffbfef636b552e4f918e3eef274ffc3ff5b82a2a9f1fe388f10919334632f61cf8d35fad2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747417030, "uuid": "1ca1e62f-7e41-46c0-bbd4-4ac2a667b6e9", "value": "T10115D542F28081F4C95D8D770268715B40DDC898971254D7B6CE9FFA9FE0AEA9E3242F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747417030, "uuid": "492737e4-c874-4b1c-9f94-9fb115ce124f", "value": "b9aeb3cda19719aca31e4b511c22ff45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747417030, "uuid": "987d8abc-f818-451a-bb20-f4238abe9f3f", "value": "12288:Rrq6rOAHGUPbzuekw3Eg07BupJF5+RZ0L0l34hYZ:1aAHjTIg07BupJF5+RZ0L0l34K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747417030, "uuid": "cf61cd40-af83-41c0-ae57-82f280935756", "value": 928768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747417030, "uuid": "977183f4-e5f0-4799-836d-d1f93204d0a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747417030, "uuid": "5e8dc6d6-de2c-46ea-8734-b954be47b476", "value": "Monocrotophos.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d80e0f46-325e-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747404338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747404338, "uuid": "278f7952-e1bc-4412-bcca-895145e4d00b", "comment": "Malware payload", "value": "2d455a240594b0c5607ffae6742606a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747404338, "uuid": "c68c9b4b-42ed-4567-94d6-621687dae339", "comment": "Malware payload", "value": "4ff5d47c90bbfa8cdaed399013269e3873e93cdd56a3ad0608857054e459467b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747404338, "uuid": "dcd55187-dc31-445c-9f07-c1b179c4b2e6", "comment": "Malware payload", "value": "df5afbb140abfd0bb6e56ce293180b62a788fc43", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747404338, "uuid": "b53e115a-41a8-41cc-9de0-d96f360eee3b", "comment": "Malware payload", "value": "00c7374383c01c7d514a774d83d52975a93ecb121f6935ced987626726c714019b425c2ddef361733edf7443eadc47dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747404338, "uuid": "cf0cf52b-f0c6-4e4a-86c7-3718173ee1f9", "value": "T1A3A52342B6C648B1E17228326B7867216A7CBD305F75CEDF67D03A1DE9605C0EB20B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747404338, "uuid": "94eec435-b8f0-4b52-919a-8ff27d2307b9", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747404338, "uuid": "ed3bccaf-58e5-4a3b-b4bc-8c62998c051a", "value": "49152:IBJLTpc8iYMljoCIrtufFEUPtPSfdjh/SXjlm:y9TFMlFIQDP4fdj4o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747404338, "uuid": "c7810f9d-9c01-44b2-9cc8-bdf285cade2c", "value": 2230224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747404338, "uuid": "ca41f268-87ff-44cd-9b6b-141bd60b2411", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747404338, "uuid": "de55eca0-7385-4334-a005-cbff1c3c7111", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6625f135-3224-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747379236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747379236, "uuid": "e22f25cd-6899-4521-98c9-d64fd11254e9", "comment": "Malware payload (Mirai)", "value": "57a8306a7e28d6df9ffbf87f65796e35", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747379236, "uuid": "6cb4fbab-6f3a-4149-9ab0-f6ab7eadc34b", "comment": "Malware payload (Mirai)", "value": "501a41fc45dc663773a623fce0598b6da4f107d76e8a9a5ed3439855009408bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747379236, "uuid": "840ed9fa-17ca-4188-bcb7-ff476df401bc", "comment": "Malware payload (Mirai)", "value": "dfb79e12f52af0e457b272f33ee02cf14d6a2593", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747379236, "uuid": "342c5fca-dffd-43ae-beeb-6ed3e1156044", "comment": "Malware payload (Mirai)", "value": "8e98667df1d5295e66a8bc0b2538cba429b01fe95e0ae03a0e8198e1a3af66a8ee06043e967f0a98acea1ecd0a4181e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747379236, "uuid": "a0a5ed1c-78e4-4239-b0ce-668bfc8f642e", "value": "T1F372CF3237A6B6A3E5700E3CE99C854913971F78C5BE307A210C8328ABC8E87127575B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747379236, "uuid": "3d45452d-f322-4432-b211-aee5aadf1cc6", "value": "384:Tb6QnsdPfxufPSBK1iHQ4HTjPzcqm/hymdGUop5htMM:XwdPpuf6BLXHTjbcqks3Uoz4M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747379236, "uuid": "9f5e0bad-245f-408a-8b43-f7111d4170d2", "value": 17536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747379236, "uuid": "66d5e955-8d09-4803-80e5-3860f049f692", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747379236, "uuid": "23c14e23-ae3b-4b90-b15c-315a050cdfac", "value": "neon.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3699b7e6-322f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747383880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747383880, "uuid": "6fc1f742-29e7-4c00-b326-b8a6e98ffddd", "comment": "Malware payload (Mirai)", "value": "b19a77b7e63c3dcd6ffa02550d1124d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747383880, "uuid": "b4f4cacc-a2ac-48eb-9cf6-e94a739e4a62", "comment": "Malware payload (Mirai)", "value": "5063ac9f44fabdad00a47545967353164737408209e79d5646d81f70301f6116", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747383880, "uuid": "e603ba55-326e-42cc-b65c-76acb7cf5f93", "comment": "Malware payload (Mirai)", "value": "e3e1b3f6c9fff729e9c650cd9fa817d5e57acb16", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747383880, "uuid": "1ecaa75e-22cd-4a64-b414-f183a560abc1", "comment": "Malware payload (Mirai)", "value": "b2179b9b9566d2fe2b406799fc8685ef094ffe0edc4799e481ed201e187f6c1d73f39de207c4da661bcdd0b32e58bb72", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747383880, "uuid": "f6123650-5083-48a7-8ed2-52e11fd2aa6e", "value": "T12CF20A96F882452BC1D4233EB79E6A1E3730B3D4E2CB7607DA644B6137A650B5C57D80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747383880, "uuid": "d68011a4-9b1e-4cc3-bb5e-461b6a253cc3", "value": "768:t/TtCBT97lR1rzSc24fsYbj5rIs/3ovU1bsQkPK:GBNlLzS3+7Is/t1bsQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747383880, "uuid": "6c42c0f0-1907-46ba-a2d0-7435d3f9130e", "value": 36620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747383880, "uuid": "463899d0-7b6e-4be6-ae65-18ee5ed7f352", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747383880, "uuid": "e1b78fef-b175-453f-bb1c-203c6b10ffae", "value": "neon.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e47ba823-3219-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747374723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747374723, "uuid": "10af437f-63e3-470c-a55e-5a2e6c433a8f", "comment": "Malware payload (Mirai)", "value": "40d6f56061f489ef7ecb34fd2b5acfa0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747374723, "uuid": "3d202d99-e4bf-4806-a124-33a879df5e6f", "comment": "Malware payload (Mirai)", "value": "5100834e4ecd0e196589b53ed8b5461f3695732b6d6575467d9f89d5df2ad444", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747374723, "uuid": "648457a8-1db4-4680-96be-9c576b02125a", "comment": "Malware payload (Mirai)", "value": "a30fadd892b8961d4aa8b7e1a6277dbfea8dbcd7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747374723, "uuid": "16124d2a-778c-4ea0-a477-0696b1575c1b", "comment": "Malware payload (Mirai)", "value": "d46702c91b23d50dc9d2d7b9cf9b06d3f4e26a9650516256e2002e338c25004746accf336b66a964f12a243c7bb4c612", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747374723, "uuid": "00e6f768-a202-4c13-963f-bd595b899eee", "value": "T13EF2E1FA461024DEC758A07825C19F720C720F72A4D2DC1B6A71DF8F59951BAF887DD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747374723, "uuid": "8bbcd700-ca9e-4a8d-9763-f808aabe26ce", "value": "768:vvdl4Wzq2jQiSuttEy8Z4qI60qe3j5YVJgGlzDpbuR1J/:vvdl4WlQ3XZVk5IVJud", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747374723, "uuid": "1e65513d-19a4-423f-999a-0fc2e7207919", "value": 34856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747374723, "uuid": "1a716ade-01ac-4e40-9f89-b8443b21b13a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747374723, "uuid": "2ba6dd01-ec49-4149-81f3-feb29db6448b", "value": "neon.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00922dda-3288-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1747422015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747422015, "uuid": "1d9c8651-3bfe-40de-a2a9-68c34aff1bbd", "comment": "Malware payload (LummaStealer)", "value": "5bdf4f3aa32819ec9f05733dbacb15ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747422015, "uuid": "d75854a4-385b-465a-bc62-190294f51411", "comment": "Malware payload (LummaStealer)", "value": "5125bdd56a603dcb3929a4bf2282467ded28ccfed837d908ad4eff4246f43e94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747422015, "uuid": "53901f2c-1db3-4776-a364-6ec57220535e", "comment": "Malware payload (LummaStealer)", "value": "3211853d6afe9e6a2e79da2d3c98dd2e597f784d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747422015, "uuid": "1b45720c-c878-49e3-a555-1b22328bcbf8", "comment": "Malware payload (LummaStealer)", "value": "5ce987448688333999dcd8abb206e03e7905d6332b36bd2b30810208b0a8410eaf543fb6f29f7034efe34c9b688bc552", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747422015, "uuid": "88e087eb-a5ef-459c-93e9-1e5bcddb7281", "value": "T16635F1A4C24664EFFD6340BA4A526642B96778728B281FEF2198E7772F133C05C39774", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747422015, "uuid": "bca85c70-206b-474f-a12e-b2c1ac278ef6", "value": "cc56030055f1b3ec9cc1fa678dfddfd9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747422015, "uuid": "0ef75ab8-2f06-4d25-8115-5314a9af6219", "value": "24576:B88xQ/Sz/clrxuG+ZS6u/w8v6ujD+ZS6u/w8v6ujQ:B88xQ/SzWrkG+ZSJ/w8v9+ZSJ/w8va", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747422015, "uuid": "b8f57913-51c0-4ff5-aa5d-b1cd906a2ff0", "value": 1059328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747422015, "uuid": "449402bc-ef73-492d-a04e-3dc0f3deb908", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747422015, "uuid": "92b955bb-3c0d-4e9d-ab71-0866e608e222", "value": "08IyOOF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f62b1f3-3245-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1747393451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747393451, "uuid": "136aa696-b38e-4df3-9d7b-9b3b4eae383d", "comment": "Malware payload (Gafgyt)", "value": "e7a7f2e06a36a0cda68f430e5fc972e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747393451, "uuid": "162c84dd-acc6-4b87-b6eb-e2cc80e2d9fb", "comment": "Malware payload (Gafgyt)", "value": "51c49dbd95054efbcdb4aea335e4547bfef8eb884bb9225f856208df71999452", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747393451, "uuid": "bdea6b47-7ea4-4bd5-a33e-8eca2f45c273", "comment": "Malware payload (Gafgyt)", "value": "1d39cb5214a93eed8eeb5151899301ace19dcf23", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747393451, "uuid": "1ab1ed51-ac16-4f77-89e6-3ba1ac60d130", "comment": "Malware payload (Gafgyt)", "value": "9bb83386c9d5ebaffa47b8ac816583ccefd0dc726eea6f2f7459e12566765faf5fb2f7c6663eb1349d120f1654f24f8b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747393451, "uuid": "c891a524-15fa-49be-810e-bdea4e84a5fd", "value": "T1CCD3C62E7A61ABFEE169963107F35F7083A625D227A09345F26CDB181F3128D5C8F790", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747393451, "uuid": "5b3902b0-de13-47bf-b65a-6aa9b9beea21", "value": "1536:DHfGlkuMau3GanIg2rK/c6U1J8iEHLfPti2dSImNEz7ugf7hoWlNDs5rj4hs29NA:Kx+/PtiJn8ugN9sBXoVmCBgAYiCh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747393451, "uuid": "da3513fc-785d-493d-90c2-b9fe3a3dfcce", "value": 140059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747393451, "uuid": "9fc3d0e1-5b4b-4505-b73a-5d597430852e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747393451, "uuid": "68c38e16-d1c8-45f3-a2e0-6c702853c3a7", "value": "rebirth.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "817ab0ba-3252-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1747399038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747399038, "uuid": "9c4cabb7-e657-424e-a684-8cd644ff2e25", "comment": "Malware payload (Prometei)", "value": "d77b8e49abdb8c2a42131f44a1fb746e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747399038, "uuid": "3e717ee3-9f39-4ed7-867f-ef20f18fa03c", "comment": "Malware payload (Prometei)", "value": "51c95a9fff7a555d74d75f5424f201e5931ce7d1b09bca570dffc300c8526027", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747399038, "uuid": "67fee7f7-4467-43e5-b041-98c449391d3e", "comment": "Malware payload (Prometei)", "value": "9e9c05a1793d6f0a846a000687cb6fdfcd874a53", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747399038, "uuid": "a90276f4-036e-42c6-be43-b69118432906", "comment": "Malware payload (Prometei)", "value": "8916151a49d62868d0e6803b9c13bc0c69c52dc34b6ac6087706c0b5bb9cb8d2e6d3e492a41649d62326c370dba3a6c1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747399038, "uuid": "d4693166-9f12-47a8-b893-77d11f7ed108", "value": "T199155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747399038, "uuid": "fcf5a9c6-8bde-4d8d-b16e-9bba5bd22499", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8MplX:qmShf4OTjMgXSJhBXEsVrmz9MOup1KhQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747399038, "uuid": "7ba09ade-c79a-4ed9-a6f7-4f2cbce24859", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747399038, "uuid": "141bd428-e62c-4400-b6e8-eff1038be531", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747399038, "uuid": "fe5b7ebb-eef2-49af-a3a7-3d984c9894cb", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0044b612-32a6-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1747434899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747434899, "uuid": "4cf86027-347f-4136-b174-5cedaa675ec1", "comment": "Malware payload (Prometei)", "value": "de51c46f8ae22eea783db2096f70422d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747434899, "uuid": "a2b264c1-3642-47e0-971d-ca451948e189", "comment": "Malware payload (Prometei)", "value": "51ce4316255a4d0913cee92f737f53536ec3e075b6925ee3342f23f8d07b0460", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747434899, "uuid": "7f3dab51-409c-4cfe-a41d-bbd69a2c9790", "comment": "Malware payload (Prometei)", "value": "f94748887cc02a1e5ae2131b27feb58202d286c8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747434899, "uuid": "4b6bacdc-28ee-491a-86cb-609102d1fd04", "comment": "Malware payload (Prometei)", "value": "ecfd704b39f33fb71a751e207efcbffd1b7c73312f1c0ce6e5a507acbbf0f6b621795328727637109739a4bcb74d226b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747434899, "uuid": "d501e7ff-e998-4c3d-9b2c-82e2fb2a59e5", "value": "T19D9423F8C87D2E3098169F3CBB1A826CF0A15772D9562B6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747434899, "uuid": "c275e78f-d638-4dd1-a7d0-5d6d80d4b99e", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitg8:25WOSACZSV6eKRH5EPiamb4DsDwwcs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747434899, "uuid": "564c4b31-b4e3-4575-be96-4abaf0d0675a", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747434899, "uuid": "6c18c01c-c97c-44f8-842b-0d918a6198a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747434899, "uuid": "5b14d386-1ae4-48ae-95ba-837c528b9e58", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d938e121-322b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747382435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382435, "uuid": "174549fd-a7a1-4281-bb16-b496e04a37b2", "comment": "Malware payload (Mirai)", "value": "0146a456955dec0bb205a1210d42babf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382435, "uuid": "103a9e2b-ea46-4d3d-af2a-7a2a7d0ba25f", "comment": "Malware payload (Mirai)", "value": "5277dee87acd226b9b72da9cc15d98b5f761383d3d240f7fbc4e061565ebee36", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382435, "uuid": "fd214aa8-2a5a-4edd-8398-1b01970bfbe1", "comment": "Malware payload (Mirai)", "value": "6ff4eca3c773953e8ede6a081792b6a350d51877", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382435, "uuid": "89959013-e34c-49b1-8147-35f99e66802a", "comment": "Malware payload (Mirai)", "value": "816c524162b5c5c0854b759f479394f41ce891010a21fb778462fb9b321a700fabdcee3ff71f450946eaef7e694c48ff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382435, "uuid": "c791a58e-e87a-403f-b899-893d2e2aed46", "value": "T135D32B86EB418A17C5D2177BEAAF41453322D754D3DB330689285FF43F86B9E0E63A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382435, "uuid": "680ea3da-8b9e-46b3-a726-42a2e8f0e511", "value": "3072:19Ck6/u3qi7+XqCHZ3UE6CI9SCakIEWLWYM/9jmOa/:1sk6W3qi5aUE6CIYCVWL9M/96Oa/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747382435, "uuid": "f04cfb4a-d9ba-4b51-beb8-52bd92abae6a", "value": 130018, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747382435, "uuid": "563d2494-7419-4ce8-8444-03c7a0354384", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382435, "uuid": "d0e11ea2-fce2-4522-8646-7ca92128dd09", "value": "phantom.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bfbc911-3245-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1747393446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747393446, "uuid": "5950294a-c335-4b39-ba60-a71357095196", "comment": "Malware payload (Gafgyt)", "value": "125c0f5ef8c2e298e0e2cf9012d704b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747393446, "uuid": "bff6fcae-3b3b-437f-93b2-76753f1f5612", "comment": "Malware payload (Gafgyt)", "value": "5280e6e07d991c433b0bb9f14b0f4dbbb1fc1db984daac83c36235e641a478e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747393446, "uuid": "91fdb823-6d7d-44b8-8db7-dff2a3c12a44", "comment": "Malware payload (Gafgyt)", "value": "1f530ced5a31a882d116861cf68b82c214ce1a8a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747393446, "uuid": "1b264917-c4e9-4ccb-8fe9-16a9f0969c55", "comment": "Malware payload (Gafgyt)", "value": "e5ecff16667464a45eaf8169b53da10ec0dbde4ed34f5ecfc8464bb11411a3552ecab69802e73d51d84f3ec4d05898de", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747393446, "uuid": "38454355-e056-4077-8048-c77f8b773c5c", "value": "T1C493398785719EB3C042AA7925FB89740713A8225B0F1F68612D9BF8070BDDDFC9E725", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747393446, "uuid": "12d564b3-29b7-491d-9f3b-b996a0784cf5", "value": "1536:TeDM+Vlabe0Ff5soS4yfafPdfmoDs2tSYVm+:Tj+Vlab/DDfPdm0s28YVm+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747393446, "uuid": "add6a547-75f1-4a21-84db-ce3e2aabed66", "value": 96317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747393446, "uuid": "2ea95015-186c-495d-af00-15942ad7d361", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747393446, "uuid": "9fabe155-d9d4-4680-abb8-63d8e8d17c60", "value": "rebirth.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "746a5eb8-32a2-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747433376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747433376, "uuid": "0b8bc927-7327-4db8-99a1-c8bfe07bd65a", "comment": "Malware payload", "value": "0da15548b00b0a3b80b86be42bf9a8b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vgszf", "colour": "#2A4731", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747433376, "uuid": "9cd5834c-c0f8-4356-9b8a-854ec9bfaf98", "comment": "Malware payload", "value": "52e8478bb2c7ee6ccbf05f9154ac4b7619b4d986aec5e41bbd8fa752f37040a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vgszf", "colour": "#2A4731", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747433376, "uuid": "28adbaa9-79d8-4d4e-b9ee-7b9d668f30b5", "comment": "Malware payload", "value": "93ee14a8361695e3ca7511d4e8dbf9b8eef58d99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vgszf", "colour": "#2A4731", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747433376, "uuid": "a26f73b4-327b-4150-bb99-1dacc14c628b", "comment": "Malware payload", "value": "16559189b6e4625635f4823872e029c6f3ca53efe105fc7be744e85577fc826183165ad742716fa8026d681d9aa49d3a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vgszf", "colour": "#2A4731", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747433376, "uuid": "10aff510-93c1-4ded-b706-09d7dae8312e", "value": "T1B2D3296763A510A8E5B7E2BC9AB60612E7B27C550774C3CF1360807E0F627D1AD3EB61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747433376, "uuid": "a1c4a37f-628c-4130-858c-a3fb52214d87", "value": "6ea8bb0838d47823d596fa2a5e748487", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747433376, "uuid": "7374a305-a237-42d9-807b-48c981cf5599", "value": "3072:s8OdtSZ+edx98aRPrkwANmJTQSaMm5/6sWtAPz/ENREa:sPSZ+eHV4V+WlnWi/IW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747433376, "uuid": "468c453b-e652-4541-ae65-ab5be4f85f0f", "value": 139776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747433376, "uuid": "cba1df10-3220-443a-80bd-2b68a96f0d64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747433376, "uuid": "972f77d3-f3a5-4f0b-94b8-6be4f47670bd", "value": "n1gger.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06a0c348-3232-11f0-8bd0-42010a9c0005", "comment": "Malware payload (MassLogger)", "timestamp": 1747385088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747385088, "uuid": "89e16a74-b63d-4de5-96ab-7af5e622a5d5", "comment": "Malware payload (MassLogger)", "value": "96fd99cff50a8b6fee2c9ec436431f2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747385088, "uuid": "14154dfd-5ca9-4581-bb75-c260f41823ad", "comment": "Malware payload (MassLogger)", "value": "53055b6d2651d5c6b4a0bf9ee2f50c73918e65c9d36acfd10eb2eefb0d3e957f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747385088, "uuid": "c8c3de29-cba5-43ee-95a1-f2c79769d3e2", "comment": "Malware payload (MassLogger)", "value": "a8ce7b365100b9afe30a86cc1f99ec3e36004a2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747385088, "uuid": "906e78bd-59a7-477d-88b1-add9a450df8c", "comment": "Malware payload (MassLogger)", "value": "c2cc34703dc3845286d74490c6ac8aa139b1781daf453f5404fe4a3169f151372a6787801cee01f038470e72be09e8ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747385088, "uuid": "7880c52f-23d0-4100-9d3e-29be0ed9bbb1", "value": "T11AB4F1192245DC03C0D72AB40DB6E3F81BBA7D8C9522CB479FE96DDFBDAAB052541342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747385088, "uuid": "40f77f09-dc6b-4cef-baca-f345b7d04a52", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747385088, "uuid": "11b83118-7781-4a05-98ca-31c619d80553", "value": "12288:gpMJEZJNe76JZOfpZPmJKSNADv/Yz/9+6KwueHw:wblqfEPNigj95Kx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747385088, "uuid": "c307a26c-6ec3-4bba-9fae-41fa12f6e8d9", "value": 538624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747385088, "uuid": "197ec87e-cdf9-4e4b-acdf-7eef552c0a49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747385088, "uuid": "a323213f-c416-4c5f-8ba5-76714e8e8e88", "value": "INVOICE#R09.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c567178d-3234-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747386268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386268, "uuid": "d09f28c4-8301-4c38-9101-8662132cd6d3", "comment": "Malware payload", "value": "5e62a4c7efa9ad572ecab86371b85d8d", "object_relation": "md5", "Tag": [ { "name": "196-251-90-185", "colour": "#01F3BE", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386268, "uuid": "fd75e8f0-2cb9-43d3-9cff-c96959600757", "comment": "Malware payload", "value": "5332945abf3f7074c6302906d615ea835aeeb89a396002a302d016d1a1514cf2", "object_relation": "sha256", "Tag": [ { "name": "196-251-90-185", "colour": "#01F3BE", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386268, "uuid": "02e48450-c969-457a-935a-8f67e3fe01dd", "comment": "Malware payload", "value": "df6c4ec6e6cad08d5bbed9f657fb1899cd0edf80", "object_relation": "sha1", "Tag": [ { "name": "196-251-90-185", "colour": "#01F3BE", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386268, "uuid": "e2cf90ca-211e-47a9-a58d-9a506587adcc", "comment": "Malware payload", "value": "d399bf19c33654cd31a9aabce866751fc6f9f1fdfd1c2d581f25446b31abdcc341e8ebadaae27199bcda523386f6419e", "object_relation": "sha3-384", "Tag": [ { "name": "196-251-90-185", "colour": "#01F3BE", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386268, "uuid": "61a5084a-0eb7-4126-899a-993660d50074", "value": "T16F51BB1117D60734E3F1DB31A4BE9A71A27B7C92F640C50D10A1425A0423E15962EFBF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386268, "uuid": "6cce7a80-0ff9-4e25-86d8-f9fd5ffac24f", "value": "24:8cwsHF8CGddSBmEXuHY9nvE583yoCj+7SZvMNdP/6E3sxn1EEdx/LuwsSyNCaEd:8c3Hq7dQBlXuHwvgo75ydx1EJ3JNR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747386268, "uuid": "e5fefb02-7c3d-4f50-83ff-7abae0494c89", "value": 2628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747386268, "uuid": "db92af47-bec6-40ec-b390-4893d8f5c507", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386268, "uuid": "84862aa9-94da-4811-8896-1cb35d239bac", "value": "Husqvarna-DOKUMENTS.pdf.lnk.download", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "473a730a-31f6-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747359427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747359427, "uuid": "fcbbf363-8823-4832-a688-af370ba3b01c", "comment": "Malware payload (Mirai)", "value": "d72f780496ebbebeafc180d0eee4a205", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747359427, "uuid": "8aad9de6-845b-498e-ac8b-78df67783428", "comment": "Malware payload (Mirai)", "value": "53aaeb84a1fa1ad7acac4353a5f59b65674d0e31f50347616a5f98e3622994df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747359427, "uuid": "4408aa65-fff1-4389-86de-e354b465a38c", "comment": "Malware payload (Mirai)", "value": "3c7af221f2eb47791d9088ef37dee5c23e78289a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747359427, "uuid": "a503cc49-112d-41ab-83b9-663f0b3efde0", "comment": "Malware payload (Mirai)", "value": "cd19c9d61dcef9904befccb927c136a0473c267b2fb7ecca6f86c6ed84ad21e78331d3f2eb99db548db142678c83c7ce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747359427, "uuid": "8b78810a-9f51-46da-b15b-1628a086b96d", "value": "T1FAE2D065E0552E94FD7BBD257EC0D3807AB30B463A1B5E4643C4EE23561796B2A13DC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747359427, "uuid": "510973e7-258d-4b94-92f3-db9adc363252", "value": "768:SuDHedWAcFQdOzsOMIyGs4mncxS77+MeWzPX1LoM4uVcqgw09P:9DHdidSs1RncxS7bDyM4u+qgw09P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747359427, "uuid": "2c98c88a-72b8-43d5-bfaf-98af913af494", "value": 32280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747359427, "uuid": "3e141898-7bde-46c5-8a07-cc0ef04ec6db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747359427, "uuid": "30160fdb-9c19-4fac-99fc-68f93c147652", "value": "neon.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1a2b7c7-32a3-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747433882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747433882, "uuid": "6f2c3913-b17a-45f1-9f6e-616f72e41710", "comment": "Malware payload", "value": "6a6505b2413d2c7b16c6d059448db9e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vgszf", "colour": "#2A4731", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747433882, "uuid": "be26c24a-549e-4b5d-9885-47bfa70c67ea", "comment": "Malware payload", "value": "53e3b72f8eb13acf3cb69d4cb124e8dc64fc541555c3c95cc8003b8046853955", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vgszf", "colour": "#2A4731", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747433882, "uuid": "5a9a2518-1ef5-435a-8305-b6fe89a952fd", "comment": "Malware payload", "value": "dfe6c6b6051c26326a12dc9d0d5701cb4728266c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vgszf", "colour": "#2A4731", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747433882, "uuid": "e66ca612-f31f-4af3-a2ff-66c4d81a784b", "comment": "Malware payload", "value": "b0f389e043259a43f8ccd1f188e82aa92b9a05669377a9447bad21191bbd0476951cbebf957db0d23924c477085f9643", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vgszf", "colour": "#2A4731", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747433882, "uuid": "f103cc54-7c03-4127-a91d-ff347de018fa", "value": "T126A4095AEB5220E1D872D1B888815316FA70BC7847349BEB729C85161F736EC9E3DF18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747433882, "uuid": "dbc6db82-25ab-4fc7-9181-37aada83c99d", "value": "ed928bd060b03bab412d37a11b9d26a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747433882, "uuid": "6f54509f-f0f1-4224-8a32-588e8e9f7868", "value": "6144:JIeh4+TOKGuTSuXCJ6AtCoZPhGL/TnJ+z5rsxQhsCI9t/tk7MP:jpPTxXihA+zBhsC2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747433882, "uuid": "0f55e7d2-ef7a-4b34-ae33-7886457ee20e", "value": 463984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747433882, "uuid": "b2895e45-3075-48d2-8ed8-d357a46df0a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747433882, "uuid": "98b6bff2-977d-4cc0-9f85-6eec276e75d2", "value": "AMIDEWINx64.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c285f41-322b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747382333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382333, "uuid": "b32c717b-6348-455e-b3bd-38dc143d531f", "comment": "Malware payload (Mirai)", "value": "28de95b2f652234430079934e2855102", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382333, "uuid": "ff77c466-9196-4784-b310-4b2949760da5", "comment": "Malware payload (Mirai)", "value": "542e96b5dc9ffeffeeb0853a4bdbf0e72a2217f64ff3cb1533d59b4039b86f6b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382333, "uuid": "469731d1-c528-4806-8fdb-0129db57d05c", "comment": "Malware payload (Mirai)", "value": "246b449f807f6e28497081bcd2dc58d033cade38", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382333, "uuid": "cf157e98-f96a-4a08-801c-d75839c0e8c7", "comment": "Malware payload (Mirai)", "value": "1742398eaac06b96627b0f75469b12d103e79f542d7ca50f1cdf63df9bc7aa1f0d8be9abcdf72f34095f0b07aa9ad00d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382333, "uuid": "26f32c1d-e7e9-4270-b223-cf4d9e25316e", "value": "T10DD34C46FB418F13C0D51779B6EF42453322A795A3DB73069A285FB43F8669F0E23A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382333, "uuid": "5b9e7c14-73f7-4edc-ad2d-765527d78e80", "value": "3072:BxioDMQI5nriaO4nt3qZg2IWu6b4JX7LkDM/98PmPw/t93:DioDtI5rRnt3qZgPWjWX74DM/9smPw/f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747382333, "uuid": "83f26090-ef71-459e-ad11-a71f786e7305", "value": 135877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747382333, "uuid": "dea2bbce-361a-4c88-8066-dafbee09b300", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382333, "uuid": "3b7b4e19-4190-4b9b-b2f4-0fb933077634", "value": "RpcSecurity.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b386eb80-320c-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1747369058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747369058, "uuid": "183c5a64-967f-45ed-ab61-69a18d05b6a3", "comment": "Malware payload (Prometei)", "value": "8e765e1ba1b797e7bcc1888247f1050f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747369058, "uuid": "497a5f79-29d2-4dc5-8cd9-1ad253cef50b", "comment": "Malware payload (Prometei)", "value": "547ee001a6fe4ee83564b3c214a5d8989ee3d6823eaa5a45a203bca166cb8f57", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747369058, "uuid": "c2208d31-d71c-4f20-bfd2-9a4c6648c0ff", "comment": "Malware payload (Prometei)", "value": "8ae7525d9ef42a89b1b2bef844b06adae575f483", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747369058, "uuid": "d14c339d-1787-4049-b362-cacd8f1a7afd", "comment": "Malware payload (Prometei)", "value": "7f547ae20eddb71d1b860b4f828af1b9ea25066af82b9ce159db553b8e00b880be850389dca86cf615130b6f97c061a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747369058, "uuid": "a3dd022b-1cdc-4ac4-ac3a-e347ceff6bd1", "value": "T1A7155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747369058, "uuid": "30da4566-3b7e-480b-a9f1-a6234f86fc8d", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mplr:qmShf4OTjMgXSJhBXEsVrmz9MOup1KhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747369058, "uuid": "493fa476-e98b-4f2f-912d-835172f7964b", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747369058, "uuid": "bbd68bea-3a14-45e2-bde6-cac41976666f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747369058, "uuid": "aa409894-b0a9-4226-8a30-5817d2950035", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb36ab37-3219-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747374735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747374735, "uuid": "75b74692-559c-48fe-9ed3-431048591429", "comment": "Malware payload (Mirai)", "value": "cf508998caea346f6719798b9116086e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747374735, "uuid": "b006e6a3-1821-418f-9748-dfea9ee795b4", "comment": "Malware payload (Mirai)", "value": "54ae73c31b04807a463dcf2a25bddefb046353151ded0f641ecff6cc3a446a58", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747374735, "uuid": "6bb565ee-8ad4-417c-ae44-4651fea90b34", "comment": "Malware payload (Mirai)", "value": "6000c63bcfcde3e5d39ee65fe19c397d415714dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747374735, "uuid": "7d3f9af1-1ef3-494f-8c77-e75cef240784", "comment": "Malware payload (Mirai)", "value": "f868622d6a45c4dfe1471ff262863bb85d518a0f7341b3baaaf4ba808aa3e88d68c123fe5559b9cc7d9ab9a36218df21", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747374735, "uuid": "63d43d45-7bf3-4f82-aca5-72462af0880c", "value": "T19093C71E7E329FBDFAA9823087B75A116B5923D123D2C685E19CD6001E7034E681FFE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747374735, "uuid": "0f62bebc-a17c-4b7e-9780-033141fbf64d", "value": "1536:NGg6+b/tktffmtDT7+ayy7gWvYUeARuleHmQ:NGg6+b/+5mtf7+aX7XvYpgHmQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747374735, "uuid": "3bc3d982-5dc1-4d36-934d-49d869353adb", "value": 88868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747374735, "uuid": "2a8f441a-60b1-4606-92ad-5aad3ed3634d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747374735, "uuid": "46941ee9-5fa2-42cb-a562-d746a1c18076", "value": "neon.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36901a6d-3220-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747377438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747377438, "uuid": "37f3fdd8-6898-4e24-be7e-eb9c86e4a596", "comment": "Malware payload (Mirai)", "value": "28ed7c0f84d2555dd6f59816c529693e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747377438, "uuid": "73c2f847-7423-460e-ad5a-c67e5bc0c2d6", "comment": "Malware payload (Mirai)", "value": "54b960a591dc1c805106f96a04ddcff5af1cce3d418e22b6c461d2e7c84703de", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747377438, "uuid": "520466ba-d0ec-40ce-b0cc-c05d62273713", "comment": "Malware payload (Mirai)", "value": "bd991b50ccbf24dcbda3b7d3c3a1e201e6c006c9", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747377438, "uuid": "ac0dd647-a29e-4fc9-b21a-7b767e48e8c9", "comment": "Malware payload (Mirai)", "value": "e237fcb7eff93de4fcbbc2dcc51fc42d616bca19adf532a3822b61aa93412b6d04422a7d2996358e8ec88fd71544426e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747377438, "uuid": "ec076e96-fbcb-4fa2-9970-a7e101905d2b", "value": "T1091128CDF7ACBD169378DE007459E208598489D075F8A7F1E0A5CB62A0AB231B874B66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747377438, "uuid": "267c8a49-847e-4fb0-a2ac-8e4072a21fe0", "value": "24:3J3V7933IW79wSIl79xNIejI679KLK/IP7919Is79ysI379ft9Is79mwIz79iAfG:l34WwH/DkqKLJh1y0y15fty0mZViFkYl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747377438, "uuid": "fcf0e2f0-5c1d-4801-86be-05ba90b53773", "value": 1041, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747377438, "uuid": "795963c0-3de7-4215-8ee7-39f06f64b405", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747377438, "uuid": "d0b6442b-6d4c-4f64-bf28-8dece301d728", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d72910b-327e-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747417795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747417795, "uuid": "8b7406d9-ac0f-444e-a48b-3279a711989a", "comment": "Malware payload", "value": "2460cdacd7e56559ffbded415d1457c3", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747417795, "uuid": "fff264e4-243c-48a2-9496-dc1266512809", "comment": "Malware payload", "value": "54d32240ed306cd1d3499295fe86943cdb760df93ab00ffa235da6132ac79893", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747417795, "uuid": "08eedee6-fcca-4b55-aca3-327586c6d6ff", "comment": "Malware payload", "value": "eebfb258dbbc6b12c5e85ef97e17610226939d6e", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747417795, "uuid": "06838d51-d94a-42e9-b119-cd4f679600f0", "comment": "Malware payload", "value": "11b213518b27b9cdcd8f90fbc2e687a4b8f99396527df4919a1819070bebb04e29e009fd34b32b2c769f465d5ed8b80d", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747417795, "uuid": "bf3a3c9a-0b99-4a3b-8075-46a3c61545b3", "value": "T10AF0D4BB48CBD84DB760154A8ED5F7187CD5014914A8D819D2FCECA8B52139FDC0A475", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747417795, "uuid": "619d0ec0-c2dc-46eb-a5e7-125bc48b4cfe", "value": "12:kxvsCk9cE3Mod/XUrUPJcCpVCNLpmF9WYI:kbxu/kYOCpVCEFI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747417795, "uuid": "cae05793-64c2-4f70-b51d-135d5d807b4e", "value": 497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747417795, "uuid": "f63d2923-4e7b-41b2-bcfd-b2d45a070ebb", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747417795, "uuid": "af8d8a9f-721a-4860-b6e2-b3e2c4a420ae", "value": "fuck_niggers_49.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3531d2ae-3288-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747422103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747422103, "uuid": "cd6fed11-1308-4344-ada6-b76732f33429", "comment": "Malware payload (Mirai)", "value": "99b49980afa0689ec4435bff4ecaca16", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747422103, "uuid": "3ee8a0d5-b5de-4c08-b736-5534c18b0b48", "comment": "Malware payload (Mirai)", "value": "55322f87cdff19beb7a3cacea2a7c482225fd21325fe452887ab21640b6c1f39", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747422103, "uuid": "f9764cf3-c528-4ff7-9912-5b0fd5492f39", "comment": "Malware payload (Mirai)", "value": "13785be2b8d8f1df8fe3bd45a6ffa6d46fce91ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747422103, "uuid": "b23da808-b325-4a2b-9222-eb94fa722c81", "comment": "Malware payload (Mirai)", "value": "c7ee5ceeab13b67ee8926637990185db4e0e600a3e59a83541ad7ba4048182a0eecacf2a50dfe6510bcd0018a58d4c0c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747422103, "uuid": "d21326f8-3959-4ee8-9799-bc5dd616291a", "value": "T10AB3A2197F610FF7E8ABCC374AD92746248C651A21A87BB5BD34D828F24B65F14E3870", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747422103, "uuid": "94029814-f8ad-45af-ae2b-8ccfee670fd4", "value": "1536:QUnYn15ZheQZsLp8aIb/DvuhsS2ZJTtOoGbh:QLnzZhFZ4p86J2/G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747422103, "uuid": "c26bad38-9533-42c5-9056-eaf13a56e1ce", "value": 108872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747422103, "uuid": "a2089fc8-5f78-4535-83df-c557287c7a40", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747422103, "uuid": "db4fc392-4c92-432a-8573-a9a1f33f863f", "value": "db0fa4b8db0333367e9bda3ab68b8042.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbcc0aa3-3228-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747381124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381124, "uuid": "4df4bdab-240e-4dc2-9dbc-237402cd82f7", "comment": "Malware payload (Mirai)", "value": "aede89ea3802addbdf5b2d53e24cd94a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381124, "uuid": "9150b824-e9b2-411b-8e24-18e4e324ef19", "comment": "Malware payload (Mirai)", "value": "55dfa9573fc96c5c470b5fd27c12d4a8b14b6d30bb586c64e6b90e6847557d18", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381124, "uuid": "e8d078bc-628e-4d3a-8fb0-013ec3e76765", "comment": "Malware payload (Mirai)", "value": "a60b201966316d356abfc2e6ae9944a152f958b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381124, "uuid": "21dc19d7-6bdb-4e49-a8d7-6d911cc262cf", "comment": "Malware payload (Mirai)", "value": "30457e0f04c251bf44c115e37f9efa93c0d72f092962a72a1eab9e02a8eb06c2eaf1a75c86faab8e0113198f6e66d60b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381124, "uuid": "1aeae575-b9b3-41c4-b06b-d4696f997b90", "value": "T13AD35C17B5C180FDC4DAC1744F9BF53AED32B1A91238B26B27D4AF222E49E205F1DA54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381124, "uuid": "fecac87f-65c3-4d72-8b28-29ef1cea7643", "value": "3072:79eSuygEPjt6qkWqVdKmDnYMb0gBd/gQyVGsdqml6haj:79eSuygEPjt6qkWqGeH2laha", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747381124, "uuid": "34435272-224f-4d8e-b1f2-46be18a11761", "value": 139800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747381124, "uuid": "6a652e40-3e50-4071-8bdd-d44db781e98e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381124, "uuid": "4e759254-53bf-4ea7-a1e0-937677c59683", "value": "main_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3abb670-3228-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747381084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381084, "uuid": "9a10ca42-80e3-444a-82c0-f2ab482b67c7", "comment": "Malware payload (Mirai)", "value": "9984d8813bc7304f89ae343cab451e72", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381084, "uuid": "213387ab-69a5-4174-bea5-18e68f24fbd1", "comment": "Malware payload (Mirai)", "value": "562f2347bcb4c403484c8810cfeea32fd4f1f3039d831a2ec0ab7d07ba1bb8d9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381084, "uuid": "61f21653-63af-4a68-bd43-7bd9c81a14c3", "comment": "Malware payload (Mirai)", "value": "4600ae510f33eca13d6a718258a8d5876ffc5cb3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381084, "uuid": "05384185-6df4-4f2d-9738-8a88a92840d4", "comment": "Malware payload (Mirai)", "value": "5440c88fcc2f91861025e4edf3c5943498525258968890fd81cbfe5b60afb23aaa9978b4ba3f70680a44d2a34deb5cd6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381084, "uuid": "53d932df-7c00-464f-afd2-69d95e218766", "value": "T1D40493202E398F35CAC1837992E22DC75DD942EE98A2D9949FD30984AD747807E3D93D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381084, "uuid": "8fff430c-132b-453e-b029-d3807017fe3f", "value": "1536:xfpqCmxNYj4tJKGtGTBmSlv7iFyZLsYk5WGpfaGwVuIt/cyWVb4RxtCEbfeF0DQy:BMIvlveFYsYUvjaZLLhskQ93+mEHwkG8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747381084, "uuid": "9e5417e5-e47e-4ed5-8bf4-00c7b3180dc3", "value": 183560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747381084, "uuid": "2a872d0b-a484-4a6a-9de6-d97face09340", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381084, "uuid": "119b0d18-29c1-4349-80d5-cb556fe2dde9", "value": "boatnet.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e337f118-31f4-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1747358830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747358830, "uuid": "175873d3-2e8b-4a5e-951c-d616d0648255", "comment": "Malware payload (Prometei)", "value": "6791bc27afdfc0b589461cc33e56d19c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747358830, "uuid": "e1ff8a97-d83b-427f-9320-f5c539f52125", "comment": "Malware payload (Prometei)", "value": "564a0bb5c12e8d21cffcedb5a7c82225c9b54b6cbb683164658c4e9b538ddc9a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747358830, "uuid": "cb2b903c-4e19-43d4-a7ef-4ecb1dacc2d0", "comment": "Malware payload (Prometei)", "value": "5d2c441ab0b5c8e9c17aa9fcc4afaec8204bb220", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747358830, "uuid": "b87046db-4f0c-4b8b-ac68-8826b85baf60", "comment": "Malware payload (Prometei)", "value": "99d968b626f57b9833a2e462af746439178777c88df47b5b84abfca98bcfb09295666678ea261805ebb87cf0c42bf3bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747358830, "uuid": "9f2a28fc-b605-4909-bc7f-87bf4e4811b7", "value": "T1A1155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747358830, "uuid": "93b993cc-9880-4e44-9a18-01cc9064454c", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8MplK:qmShf4OTjMgXSJhBXEsVrmz9MOup1Kht", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747358830, "uuid": "7ba84d46-3982-46c7-b4f0-48c840c0e34c", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747358830, "uuid": "4e4fbdbe-be71-401f-a828-64dfd8f03276", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747358830, "uuid": "f9d8ecc3-1b3e-4878-bd3e-d1dde353705d", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5691d7c-329f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1747432197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747432197, "uuid": "45b8df8a-422f-43c0-85b6-2c73a51664d0", "comment": "Malware payload (Prometei)", "value": "feb171c8deee2393c98091d6e3875e55", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747432197, "uuid": "611a4f74-9b30-4ab1-8af6-3c5e168f834b", "comment": "Malware payload (Prometei)", "value": "569850a94ca58e1bb8b92719f605e40cace6529f16a0c2d71674917459a97bdb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747432197, "uuid": "74b0544a-7f9a-4cb9-a768-d853f814dcb6", "comment": "Malware payload (Prometei)", "value": "1a6bcfa882f073545aef5b0f784000d1dd36293f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747432197, "uuid": "55f78f6b-cd4c-4c66-8dfe-dc2f8629e0f7", "comment": "Malware payload (Prometei)", "value": "224b4e09fe50184c10070c753fd16119808f2af273e1585f9adf4ed7173ee6cf28e2fb51ced627fbccf0f800bde2f59a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747432197, "uuid": "de281881-267c-415a-9866-188dfd9ab8ef", "value": "T1999423F8C83D2E3098169B3CBB1A826CF0E15772D9562B6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747432197, "uuid": "bd4bb049-7c93-4640-9872-d9e5416e9509", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitg/:25WOSACZSV6eKRH5EPiamb4DsDwwcv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747432197, "uuid": "a4e81d6b-eac2-419f-905b-25c217bd0bb9", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747432197, "uuid": "48dc1123-8996-49c8-9d8b-960609562756", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747432197, "uuid": "038a9486-53bd-4502-97e8-fd30b1bde427", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38e7fc19-32a5-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747434565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747434565, "uuid": "89b89f87-065e-4b79-ba9d-6ff69834d8dd", "comment": "Malware payload", "value": "97583e639bc02b33d2e96d28268c08e6", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "vgszf", "colour": "#2A4731", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747434565, "uuid": "d8768cee-93a8-4def-83f8-57e9dc6edae9", "comment": "Malware payload", "value": "56d480e49134546cd66e1b74c5de1c83329177a835453c3a9b431efc3e5269b8", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "vgszf", "colour": "#2A4731", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747434565, "uuid": "b6640892-ec87-4f6e-91cd-a61c1bc942f6", "comment": "Malware payload", "value": "a6730292e6a67aa6505b20082d17fada2d8ee31e", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "vgszf", "colour": "#2A4731", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747434565, "uuid": "6cb0e8c2-0c49-47e4-9d9f-564adf06e958", "comment": "Malware payload", "value": "d04e822a697d1ab0bdaf065ddbb744791be30bb3812e201f6ef77db2fd7965fad53d9068958f0bcc44da50c1b9f05a01", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "vgszf", "colour": "#2A4731", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747434565, "uuid": "768fbfa1-b88d-4f90-9a1d-9ecccacf6aca", "value": "T111829EE269217CD2F56B8C3AB1CC462BE2B1F7821791CDEF0268C2514F163D2397E561", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747434565, "uuid": "36b03fb8-3b91-404a-b06a-aede168e9850", "value": "6f5335d625f476d22e44d1985a47ff7d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747434565, "uuid": "e8c03869-a586-438b-9853-02e42c890f6d", "value": "384:UKWCL3Fd87WWM7Ss56211XryrnuAM+o/8E9VF0Ny3XA2g:UKWhyWM7S2rXryLuAMxkEFQt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747434565, "uuid": "06b6539b-a167-48e6-843d-32362fbcc631", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747434565, "uuid": "d96b4eda-a27d-479e-a6dd-04cf24b24f21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747434565, "uuid": "e1b76b52-9d44-498d-a4da-813c2eaa7204", "value": "winrar.sys", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fae54950-31ef-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1747356722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747356722, "uuid": "c209b12e-f6ce-4f3a-8071-857cca649798", "comment": "Malware payload (Prometei)", "value": "8d1ab3c63eea7d607f81a8940feeebde", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747356722, "uuid": "a8d6897b-374c-477f-91d3-699424050fd4", "comment": "Malware payload (Prometei)", "value": "574a47e58c51297e895008a01face62361683c948679524c2df1af9a4bfa9b40", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747356722, "uuid": "6dd153a0-c135-4a8d-a9a6-0a03283b337e", "comment": "Malware payload (Prometei)", "value": "202c8abb259d48fdf64f5ea892eaf91b2a5bda7a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747356722, "uuid": "1c08c165-1891-4850-9d1a-7eaea6e574b1", "comment": "Malware payload (Prometei)", "value": "c7fd9dc10edaa7138dde4c6a9f1f1f6609abd02b4aeb32fba789e63a4634433aa0596da74d3201285bccf806cfab27bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747356722, "uuid": "5841df1c-4c83-4054-a193-43fadc55c01d", "value": "T1BD155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747356722, "uuid": "ab8d9a3d-2415-4f37-b34d-deefcb1ca4c7", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8MplS:qmShf4OTjMgXSJhBXEsVrmz9MOup1Kht", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747356722, "uuid": "707cf073-3623-49e1-a594-34ae48127714", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747356722, "uuid": "3ae84644-c667-4617-a413-7245acea7a50", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747356722, "uuid": "5730c437-9ce4-4bc5-9c90-e7a40b31cf34", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfabe05b-326e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747411169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747411169, "uuid": "2ddc5aff-5e98-42c8-81f5-eff26a5eceb0", "comment": "Malware payload (Mirai)", "value": "0d1d099faa7bfdbaf59fa059ef9fc0bc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747411169, "uuid": "7fbf0a38-2dab-47c9-880d-7d7cacd9f75c", "comment": "Malware payload (Mirai)", "value": "574c8938d4d23e7aee4a0a3dacd27e43b4582cc15eed0696b149e7eba9c54e03", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747411169, "uuid": "f28ef001-f286-4537-a0d7-47281393b897", "comment": "Malware payload (Mirai)", "value": "0cdc2af2583a18cc268fd35a572d7239d63ec06a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747411169, "uuid": "97ce62c2-d8a4-44d8-b0a4-3c9d18ba5c55", "comment": "Malware payload (Mirai)", "value": "b5b5787949d182071ed899a289f4b6190ddae3e7dceb6f991407c38f89b03c4fe7b22c2e18937730eb70821fca6a144b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747411169, "uuid": "40fe36aa-d5f1-4e0c-9552-14b9b8e2461f", "value": "T1A3D2D0AD1B0013AED9AD40F826AA07E53CB54B14E4C3EE5F59C1BB92CE504F43A976C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747411169, "uuid": "01af3140-9007-423d-8e73-e70b45caff6e", "value": "768:2yvYLznDEB2iC+sDqC6NtxsLLd9AtQ4yOX2JgGlzDpbuR1J3:xYnnDEBI+smAd9AtQvVJuR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747411169, "uuid": "ff274b42-bff3-40e2-885b-bafb48d25fd3", "value": 30848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747411169, "uuid": "6b4e2c2d-0cf5-4880-a43b-ae1adc96f5d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747411169, "uuid": "5aea5eb8-00bd-41db-9047-19e47963a18f", "value": "z3hir.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f930112-3258-11f0-8bd0-42010a9c0005", "comment": "Malware payload (ValleyRAT)", "timestamp": 1747401505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747401505, "uuid": "daf4bdc4-18a7-4072-9cd9-72372ed3efeb", "comment": "Malware payload (ValleyRAT)", "value": "5ab6e95c928550875fd851541a485f8f", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747401505, "uuid": "c150b976-9893-4b54-91dc-d94131fbfa44", "comment": "Malware payload (ValleyRAT)", "value": "575110686772ced3b64f32ee735451ea7ae143cccb37863da04ebbe87ff8ecd9", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747401505, "uuid": "225377d8-d2a2-4a85-991c-1c6ee8307831", "comment": "Malware payload (ValleyRAT)", "value": "e5a2599dc4680758e88a5c4efe972c8cbd02977f", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747401505, "uuid": "5a974018-1c48-4e2a-a0f0-66612b942edc", "comment": "Malware payload (ValleyRAT)", "value": "14f4853f64d60dd190f07da2d629093981458e3a8e671d76e7a1d8e5f9dcaf70302b4e6b63adcb9165b0d3839bca8813", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747401505, "uuid": "724ee267-2e8e-4a35-a5f6-a6fb848d2dc8", "value": "T1914622A1B1420743E6E52B7B0D7EA5E523CD26581F0C78007A771E1AFBC47EA65868CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747401505, "uuid": "6e0dcd51-d3c7-42fe-b542-97d927f1cf96", "value": "98304:KJoy0djF6vHUOpy0Fl1+CxPyaEcO6Qp9FSHlkaCO/uEBVdWqlqe+VDOEieMa:KJw1F6vHUOBv1+IKJc6QHWgukV3+VDOu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747401505, "uuid": "65ff5578-9362-4869-9a48-68c6c58f4479", "value": 5689159, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747401505, "uuid": "c9a84550-e971-4dec-a0a6-8159ace884b5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747401505, "uuid": "666a973f-921c-41c8-bcc0-1abfe4a74e42", "value": "asasnxnsxw26897375.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2e27981-3228-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747381136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381136, "uuid": "09ab9e2f-d47a-4d04-865e-e4aaff7add97", "comment": "Malware payload (Mirai)", "value": "5ed21d041d4d7e44ff5307125416a83a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381136, "uuid": "0e15182c-09de-4574-a866-3ef9f9d0f3a1", "comment": "Malware payload (Mirai)", "value": "57cf117438cfd40a46cbda7a7da17abf1c7874a62e1416f5642b67e9680238ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381136, "uuid": "66377e6f-876a-4b19-a36b-2f15db5a8e10", "comment": "Malware payload (Mirai)", "value": "35dbff6cbdf130ca15458c28183cbfbf3d134aa6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381136, "uuid": "98ec585a-03a1-422f-bf0d-d61c460b74d8", "comment": "Malware payload (Mirai)", "value": "630e01043b16578f750737bdc27e7c8670c07339347b9a9d095077b608b33eed97af75b58813feecfb2bab5bac2b7676", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381136, "uuid": "ff42f286-c5d2-48d6-b3da-6183e5cf7aa4", "value": "T1F743F1D397EB8F85D17CE07E51BCACCCD5219585A080076E8B79F4B2EC98B21652D393", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381136, "uuid": "605572e2-3205-4ce3-bfb0-e80a7c972c0d", "value": "1536:732UPSH9IITzqYbzAMdv5uUfnPtDSAf+wnouy8tyR:7UIcqYbz3vkUfPtDDf1outc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747381136, "uuid": "1f1dcf65-bd74-49c6-ad12-67385b8a5f18", "value": 59184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747381136, "uuid": "e13bce1a-30c3-4aac-91e0-16b0ebf7ad43", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381136, "uuid": "d9e7e999-c814-4f2e-ad7a-da7491cf6a62", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d5b8853-31fb-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1747361531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747361531, "uuid": "bb6cdcae-ce42-477e-9e77-c4c035276f24", "comment": "Malware payload (Prometei)", "value": "2409e721591f672a2f02046518c6b37d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747361531, "uuid": "2e13b841-dac4-4f56-abcd-0d73eff3cbc1", "comment": "Malware payload (Prometei)", "value": "58c40fc3495688d8f9381a1c29a4737463b1c3d58c57c9d68b788393baea7145", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747361531, "uuid": "feb65ab6-4684-4f08-b7c6-c13f3045f3d6", "comment": "Malware payload (Prometei)", "value": "2d3f45f9995bb391dbb77e041aa768d125988dda", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747361531, "uuid": "f6948875-554e-4387-8550-a705ba2551d1", "comment": "Malware payload (Prometei)", "value": "d83f398de56f0cfad4952c3914ee5c6c411cc2610c4c40f7e80da86e076a532af3ca47d6c1da37905c7bf78d93fc5831", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747361531, "uuid": "cd819c5a-97af-4aca-82d4-75a3543f213f", "value": "T1459423F8C87D2E3098169B3CBB1A826CF0A15772D9562F6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747361531, "uuid": "7b8ea4bb-4c09-4886-be20-308d4fdd8c02", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgd:25WOSACZSV6eKRH5EPiamb4DsDwwct", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747361531, "uuid": "11c0ee5a-0d60-40f8-be6e-82d8053e7540", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747361531, "uuid": "19e31598-56de-4d25-8bf5-5f2228cd43ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747361531, "uuid": "c0273b48-06b4-4a86-89dc-9887d671e66f", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58cd3e79-3287-11f0-8bd0-42010a9c0005", "comment": "Malware payload (CobaltStrike)", "timestamp": 1747421734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747421734, "uuid": "5c33d0f0-d6b9-4bd5-afea-637e42f81b31", "comment": "Malware payload (CobaltStrike)", "value": "e865f60a461c74454ba80715da8cc8d9", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747421734, "uuid": "39e4090a-e101-4d86-bfce-968a606977a2", "comment": "Malware payload (CobaltStrike)", "value": "58c6957733081459bec81413b4d13af0f1f185f2efff4ea47897be570ba0ae28", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747421734, "uuid": "0ee57bea-8c86-4170-86e0-b9feb02df6a9", "comment": "Malware payload (CobaltStrike)", "value": "6f06909c83002c033e0c8786036c3c189bebaf4d", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747421734, "uuid": "1c474bfd-890a-48cc-b7f7-de31bc0d5340", "comment": "Malware payload (CobaltStrike)", "value": "e05f47cbb055688f3cc89de7d0d3ec038999c50191c9bb27d3c0b1bc2fb7e59b71789283ff0a1fb658ade2978da74787", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747421734, "uuid": "fda3bbb9-606e-4563-b214-abc03d36b312", "value": "T1226401A68A02D9D7F529F138956AF77990E45170CF8ED1FBB552E42C08A27E10C3DACC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747421734, "uuid": "9514462a-daec-4110-86d0-e331208de9b3", "value": "2c50c3a533d28a03342cc473839d6b75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747421734, "uuid": "2b1373c5-598c-4100-a803-96b0a04c9519", "value": "6144:0XO5YZHYJu9dYFc45ja18B55ylysOI08GP4jh04unk/iVJX/mfG2s5Ne:35YZ4Ju974ta1O5Iy+0zm4nkEJX/mfK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747421734, "uuid": "784c294c-c959-430e-9b02-fc81dcc5cc47", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747421734, "uuid": "49b43563-190c-416d-8529-b5d13b986d18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747421734, "uuid": "61182855-c17f-4d26-8ce5-e8e1a5091f3e", "value": "e865f60a461c74454ba80715da8cc8d9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8c3d350-3228-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747381119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381119, "uuid": "6ee4a5a9-d952-4df4-a150-987851cece6f", "comment": "Malware payload (Mirai)", "value": "699bb63ac1bfad0bc0e17cd8a88ff65d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381119, "uuid": "8ee6e8d3-8395-44c0-b1bd-1f92b189792d", "comment": "Malware payload (Mirai)", "value": "58ecf66746e2691070f08f29a446a878cec527ccffcddc46bb4eb3b122ea09e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381119, "uuid": "6dfa0afe-a9c9-4270-89fe-71b008b58cde", "comment": "Malware payload (Mirai)", "value": "45ee86c91bdae7e2a110d3f544d8287d9ac0323c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381119, "uuid": "c5660d4f-03d2-419d-aab5-b38b0f0af1ce", "comment": "Malware payload (Mirai)", "value": "defe2840874a00e928126dbff02da4c2836676231c6cc619bb3521f65bab727b58eb6901b9ac86bec042b631627a5818", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381119, "uuid": "a705023f-4611-4d16-a74c-5592fda227d3", "value": "T13EF395103A584F79CBC3437EE2E528CB2AAA42DD87E2F180CF975A5066B5B017D3D52D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381119, "uuid": "87c5c8ca-ca7e-4070-9651-a9de1bcd7481", "value": "1536:IrifGLQ2apCjnMcouS2qR/d7LdU1roTlLOTRr9LrnkbvwbV7b5Crd4BmfOV0jGNy:IrifhD90r0oNJs765BmYTPha/Oo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747381119, "uuid": "dbf6dd3c-d962-4033-82cb-ebf0de67e6ef", "value": 171028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747381119, "uuid": "0326180f-bf51-48db-9be1-d23922102cab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381119, "uuid": "1e9f10a7-a38f-4055-a1a7-c3f4c06c9009", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cae5992-3235-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747386414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386414, "uuid": "2d47acd7-77e9-43fc-b7d0-bebe9729a225", "comment": "Malware payload", "value": "b7847d98415d0826df5432529654e99f", "object_relation": "md5", "Tag": [ { "name": "196-251-90-185", "colour": "#01F3BE", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386414, "uuid": "33ae7587-a317-423b-bc63-fb4f5e735ae1", "comment": "Malware payload", "value": "594d02736e90dcf0d625edef3bbba5513246bcc5b794fd2b14bdd0c63db59bba", "object_relation": "sha256", "Tag": [ { "name": "196-251-90-185", "colour": "#01F3BE", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386414, "uuid": "601d2952-e337-4541-b5ce-017506a04806", "comment": "Malware payload", "value": "b1c0036c47024741cb2a272cf98f1a6cb534aeb8", "object_relation": "sha1", "Tag": [ { "name": "196-251-90-185", "colour": "#01F3BE", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386414, "uuid": "93b592ee-362c-4acc-a70b-f4491686f710", "comment": "Malware payload", "value": "a6c8ed700fa4578b409ffd21c307ecc510972299acc06478fc2f98c1a213d6529aa91753f574e3ceb0816ecfc57cdc37", "object_relation": "sha3-384", "Tag": [ { "name": "196-251-90-185", "colour": "#01F3BE", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386414, "uuid": "27c64720-8118-4910-9718-90e4875d84b8", "value": "T16351AC1617E40B34F3729B3262B35DA5333BBC82F951C58E529242690423A95A52EFDF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386414, "uuid": "a0c0c3d0-d770-4082-ab74-243659d6b93c", "value": "48:8YhiZ3bjdQBlXuHnvgr7thpZ0JVihmZWqvV:8Yhu3bGuHorJhr1hCW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747386414, "uuid": "20eb357d-65e9-41d5-9d51-a6d9728715be", "value": 2546, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747386414, "uuid": "b7c848ac-a117-4d06-92a8-98102389b56d", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386414, "uuid": "eec2fb7f-3bb6-4f8c-8ffb-3bbc5252239b", "value": "594d02736e90dcf0d625edef3bbba5513246bcc5b794fd2b14bdd0c63db59bba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f702569e-3234-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747386351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386351, "uuid": "8a04eba5-4f77-473e-8169-bff376fa80be", "comment": "Malware payload", "value": "02871a84b1af5330a354930adc867e4a", "object_relation": "md5", "Tag": [ { "name": "196-251-90-185", "colour": "#01F3BE", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386351, "uuid": "664bec2d-2185-481c-bd32-7fd4055e2ad3", "comment": "Malware payload", "value": "5985ed27ebf15b6645dedcbb12f28639a312b0c671c248756fded2b11ace53da", "object_relation": "sha256", "Tag": [ { "name": "196-251-90-185", "colour": "#01F3BE", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386351, "uuid": "968f53cf-32dd-4748-8454-12d975aeab77", "comment": "Malware payload", "value": "5b8fbd30da2ed4bdbb376636a52ca3526846ec33", "object_relation": "sha1", "Tag": [ { "name": "196-251-90-185", "colour": "#01F3BE", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386351, "uuid": "40217a50-1ee1-429d-ae46-3f89340d5b08", "comment": "Malware payload", "value": "1c6a8dae35af0f6e3ea492a5e85ed73d4afdc682599ce96bca587a2f74955f88222eebb1e659fb4e690ea87ffa74c401", "object_relation": "sha3-384", "Tag": [ { "name": "196-251-90-185", "colour": "#01F3BE", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386351, "uuid": "e24bf2c9-8a78-47d5-9fed-97462cafdede", "value": "T1E991F8961C0739ADCC524938F435A3482D19D3A7448782FB793927CC2C89B7D65603C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386351, "uuid": "fad4fc96-ee18-4634-86d4-2c67f5eaf081", "value": "96:g4Mi33rESpq7orgmLiixNxwTGUTXU0KA3dU9:HMm3wSYI3i2NxwTBTEJOc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747386351, "uuid": "ff187675-8b02-4def-98a4-1f19a0b919fe", "value": 4596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747386351, "uuid": "aae4ba0c-e2cb-466a-a269-254f4207a9d0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386351, "uuid": "97e74e11-2a09-42e2-92e2-8dbc94c8bc0e", "value": "Stereotypr11.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51b77aea-324f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747397670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747397670, "uuid": "b4211649-a241-4c1c-944f-550bba2c1b32", "comment": "Malware payload (Mirai)", "value": "eebd643201db5304d0ae1d69b04a52fa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747397670, "uuid": "a1ab4224-e661-4e20-ab55-f8a34f54acf1", "comment": "Malware payload (Mirai)", "value": "5996b2afd6c3ee59ab6660bbfa929eb889ba60914192fc8d3ab439a152cba1db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747397670, "uuid": "9bf37125-15ec-428b-9940-80d85ecc389c", "comment": "Malware payload (Mirai)", "value": "980648ca92c8896a1ca2f139776fbcb243430f18", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747397670, "uuid": "36147c65-06f6-4053-ad3f-5553a4f9c217", "comment": "Malware payload (Mirai)", "value": "ade673a2c8cbc6b2bf5d68ed511743bfb7fc9677d273a4857ba7e185278b1599a7921d344fbb293fc163fa2c5f3c88ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747397670, "uuid": "e184568c-bdd1-4dc7-89ce-1a7a6150423b", "value": "T1BC44E71A7FA10EF7ECABDD3742E91B0528DC640A22A93B353670D524F54B64B1AD3CB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747397670, "uuid": "5da0504f-3809-43e4-a8d3-95bc2be3fba5", "value": "6144:3Jz4rwAjBWMB6b8Wt+jR2wy8HnbhJ8izXn14g7ZP:3Jz4bbhJjzWG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747397670, "uuid": "55eb4617-a27a-4369-85e0-14e7ed1a4d87", "value": 255388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747397670, "uuid": "b9844c39-bc24-449c-ad99-b9fde3aaafe8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747397670, "uuid": "8e6b1f75-e9e3-4603-b376-a9d952b25d9d", "value": "Tsun.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0688b022-3255-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747400121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747400121, "uuid": "9c5af066-3784-44c4-98e3-5a85576cbe11", "comment": "Malware payload", "value": "ab67b9af84bb1bdfa9f7f147ac551440", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747400121, "uuid": "9eaea8c7-116e-4989-be6b-2f90400632fc", "comment": "Malware payload", "value": "59a11cabf85e8d793c770934920ca430e03a1133eda020b03cfae1f47c47f9c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747400121, "uuid": "d72a6870-ea74-4798-b18b-683d7a851983", "comment": "Malware payload", "value": "d57ce06b2eaaec71538d55b471563c7286075ad5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747400121, "uuid": "28d99b72-050c-488e-9602-313bbed6821b", "comment": "Malware payload", "value": "8559fc439154add04d49f00602a03d6d37cbca669ab42b4daa7f0eb5ce9980489e6555e2e2acae33b5f7418a58c45065", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747400121, "uuid": "1a5f94f4-1779-41ee-ba18-a3b0a5f6ddc8", "value": "T18CB6AF16E2F901E8D5BAD0BCCA575527E7B23455133497DB46A08A292F37FE0AE3E310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747400121, "uuid": "dfb57bc6-773b-4e5f-9679-7b0bfddaf29e", "value": "37b6975fd92ab187a69ca6f8945800ab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747400121, "uuid": "a9a3f732-d5ea-45a1-ac2d-3e62fdecd758", "value": "196608:p7at47TJ7z4OW1pBeGD7b0uAhCLJHG/F3x:5atW17zliPb0HELJm/Zx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747400121, "uuid": "be21425a-a839-4ce7-8d7c-91ef6c20222d", "value": 11386870, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747400121, "uuid": "2c59f6ac-78f4-460c-805d-53ef3ba96956", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747400121, "uuid": "cdf6299d-27ab-4509-98aa-e8f0a4730f82", "value": "ab67b9af84bb1bdfa9f7f147ac551440.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9546033c-31fc-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747362135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747362135, "uuid": "e89995a1-fc98-4f86-98e1-6b531a0eced3", "comment": "Malware payload (Mirai)", "value": "2a2e698d93fca6935a1faf85080b4298", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747362135, "uuid": "e6627bd4-ab03-4b86-bfe8-5af640d7ecb8", "comment": "Malware payload (Mirai)", "value": "5a0f08b970a41237d53b4dddb08880a12dd67dcfb72a7ba6b2654d13e0ecc2ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747362135, "uuid": "58f05718-8103-4b91-b67d-7800663d903f", "comment": "Malware payload (Mirai)", "value": "6fd2f08ee00529e6f28c7b49eb63efd43d81ebe9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747362135, "uuid": "df7d4845-d3d4-45c0-a093-4b85f4b33521", "comment": "Malware payload (Mirai)", "value": "679b19f3cd6220e454635825bcc1739762aabdf8e84a6e5115fcb78c5dcee01334e1e57b3b3429d26a6ea1da607c5289", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747362135, "uuid": "444641c7-587d-4e55-bccc-c4eb00010d44", "value": "T15AE2E0905512B426C720D835EB3947865B286BB9D0F6B37728484AECDDF98C3C1782E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747362135, "uuid": "18ef9bcb-6568-4946-abf7-98ab5c449647", "value": "768:reTTzV25+BIsu8yJsQdsaWB5bG1ZilYTKaTZsls3Uoz6:qZ2o+DXdsas56ZiUKaioz6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747362135, "uuid": "790fadb3-1729-4d09-8c0b-e32ec06852ff", "value": 33964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747362135, "uuid": "e39e8058-94f9-4ca0-9a2c-4c11880b1a76", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747362135, "uuid": "3cdc17a2-3fb4-4dfb-bb7c-c4b0a1bfa69b", "value": "neon.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41258194-32a3-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747433720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747433720, "uuid": "c3d6bf31-a389-4c50-acbb-ef4d0951621b", "comment": "Malware payload", "value": "01c378b3d417fd189285e07c0cc58304", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vgszf", "colour": "#2A4731", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747433720, "uuid": "60b447b1-1f6f-4dd1-a22e-6676c455f51d", "comment": "Malware payload", "value": "5a612ebff3975116dda23085e9d5ef62a1774638a627c3fe808c92fa7593d72f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vgszf", "colour": "#2A4731", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747433720, "uuid": "878ea4e3-936e-48ba-bd54-d2f76b359ee8", "comment": "Malware payload", "value": "e7a64dc0409132f401e7c039b96cb4401c0dbf9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vgszf", "colour": "#2A4731", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747433720, "uuid": "6a3c743c-3a5b-4737-942d-539e889cef4a", "comment": "Malware payload", "value": "b3b1dc3b12ad35d923b39866ed309d4e7f266793130cf99f6864653836ba76bead8677ec075bb35596784f5ff75a1b91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vgszf", "colour": "#2A4731", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747433720, "uuid": "a820ff0e-25e3-4700-bb93-8db4680f905e", "value": "T1EE65C0FE6158335CC01ECD789533BD06B276261E07A486EF36CAF6D02F9B4549A29B07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747433720, "uuid": "1ac1ef33-6764-4692-ab66-91545e7c866d", "value": "54944bc8872323a91e57d460730fde75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747433720, "uuid": "85ad999a-6309-4901-8dbe-26c5b4ebfa7a", "value": "24576:2eA8+0RdTUgsZOBXFIXgItDb1NTSceM0pTHrD9sdOBA1sITLzp3Jl8FYt3VIc6mW:7PRlUg6OBXugq1NTxoPCdIA1sITLl3oz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747433720, "uuid": "f563ab7d-fac3-4b0d-97e6-19a13f855ae2", "value": 1508864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747433720, "uuid": "dbcf8d73-c995-41e0-b564-aa50ab910d34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747433720, "uuid": "8911c67f-9885-4813-b8a0-49aaca4e2610", "value": "driver.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e09a9a0-322a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747381692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381692, "uuid": "e9c26432-374f-4c6b-a653-81c36cc0cf03", "comment": "Malware payload (Mirai)", "value": "543607ac47af5275d6fc12dac3e549e2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381692, "uuid": "011c3e7e-37c3-440d-a394-bd80a4e61696", "comment": "Malware payload (Mirai)", "value": "5aa098aa497d20013386d01c93fca770091b44ba7fa49c1505a6b39bc5c4839d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381692, "uuid": "316fa479-7b69-4b64-b669-577c78959805", "comment": "Malware payload (Mirai)", "value": "0eaa8b51f2b3d7336aa3527dae68b07447684902", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381692, "uuid": "babdf772-4760-44cb-ba10-68bae9fcafa6", "comment": "Malware payload (Mirai)", "value": "fd39a79fb6d5c9c8ec2e60c90c1f340fbc514a489217ca6b5e408b98263f211caefd96368aa9fa0f4cb50d0638894e9a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381692, "uuid": "a3e01767-928d-4a6e-b71c-b5c88b61e765", "value": "T1E1F2E13D67154EDAE32BD13702A487915EE90F92B483BC8E7269FAD66E60170349B0A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381692, "uuid": "e0b108aa-0a6c-47e0-921b-f97d3972c185", "value": "768:M7PJmVxTewk2MsCO0mg0H5ZgSxxKvoO1dJgGlzDpbuR1Jj:M7RUgs3YsZuoO13VJud", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747381692, "uuid": "659b4c80-522c-497a-9bed-288b80325375", "value": 35404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747381692, "uuid": "4f3ef568-1db3-48cb-96ce-34c257209c4b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381692, "uuid": "8fdcb93d-1d9c-45f7-a17d-d463eff53546", "value": "neon.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df53aa7a-31ed-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747355817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747355817, "uuid": "d11be971-d2f1-4b1f-96f5-92b709853744", "comment": "Malware payload", "value": "a91dbf4d5726c64288d7ae4f99575afb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747355817, "uuid": "d1cb76a8-7fbf-44c7-ad03-143614985759", "comment": "Malware payload", "value": "5ac5a02d93cda9b7515abb6e428f9d643fca07806d0efeba5f05cd84c5f5181e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747355817, "uuid": "abd40ed5-0f81-4e40-a4b3-9dc622fa64ff", "comment": "Malware payload", "value": "702430b2108d1638a9b28e4a0c7e676414b861d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747355817, "uuid": "5c0e805a-2c46-4c46-90f2-d1e303451f81", "comment": "Malware payload", "value": "4c030d67a0d560a3b167e5f0ee712a1c8f800f1dc7fb2e957f706c61234a4c4532db63aec56770f9fc09a9f30f49ecaf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747355817, "uuid": "fd900208-01fc-413f-9949-e4562f41b629", "value": "T17C5260DD98564E3BCCCF0B7948634D14B3B18188FB5F8F47CA0CA5682E4724DA89DB85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747355817, "uuid": "ed75feef-096c-457f-bc53-8c68a2fdfac6", "value": "192:jrNMls0tygTLdGO298GZCOaT/QQEzw/yRgvJoBo3iXslk:jyls0tyg0O2eGkOA/Qb8ggvJoBUeslk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747355817, "uuid": "cc03468d-7317-4a77-9846-c640f7fdf525", "value": 14011, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747355817, "uuid": "3d2cfe66-d5cf-43f8-878f-4f779a4a5fc7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747355817, "uuid": "e80ccfa0-99c1-4ddc-8fca-5d7a8c18f9d6", "value": "sshd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b549c629-328a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (XWorm)", "timestamp": 1747423177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747423177, "uuid": "88535c5b-2de6-4fb7-8258-0d41a5e0e964", "comment": "Malware payload (XWorm)", "value": "2daccfb60b45378f1bfa87d95f23674b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747423177, "uuid": "760757a6-d962-4eb1-9f12-9e6a38b15e63", "comment": "Malware payload (XWorm)", "value": "5ad1335c5ee3383a9df8dc9cbb6ae96d79e81485c7c239675bc2bbb0b9499d39", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747423177, "uuid": "7e1aed63-4787-4a93-95af-69fcf057233f", "comment": "Malware payload (XWorm)", "value": "e57c2abd9e6e807e591b4c8f7237c967f088a1c2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747423177, "uuid": "e5344fb4-0a48-4058-883e-34f8f13a6149", "comment": "Malware payload (XWorm)", "value": "030a9bfaa5837afc540136f7b1d7dc849fe8fe38088d27a67a8d673d6fb45c65927c9da1059f8d6f1a2b1f974a8863a6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747423177, "uuid": "1f795f8d-f74c-42c2-b755-1e0556bdb1b0", "value": "T19BC34373320578A356D794D2BBB54642ACE708E773ADC4FC1A8A63EF2329195FCC2914", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747423177, "uuid": "2c6c15d8-30f8-4984-bdb3-eaca9a322c4d", "value": "192:tPGL4LIotPpG6VIchWotCuDESR+kZ8KcuoKzkGoy1qlPEGvyii30GmJfzFEXw94o:Wca+Wv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747423177, "uuid": "52b89965-5238-433c-bdf2-f955065bf1dd", "value": 127018, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747423177, "uuid": "7c301214-bd2f-4615-94bc-4f31354edb6d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747423177, "uuid": "fb77bad5-0595-458c-963c-6165f67ad9a5", "value": "cc authorization.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f3dadad-322b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747382311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382311, "uuid": "b4005f54-943b-4f49-a8ee-44ae885932b6", "comment": "Malware payload (Mirai)", "value": "cc2a8fcdd3210e634e48195a2ff96ca1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382311, "uuid": "76094272-93fb-4032-8174-2bfaa84a6514", "comment": "Malware payload (Mirai)", "value": "5b7d546e624dade3a8fb0d67be45efc1c60d0797bd687812f956e13af9330082", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382311, "uuid": "8c5b2911-a01a-4aa6-bcd0-3bb7f6dd9263", "comment": "Malware payload (Mirai)", "value": "8bbb114c51c92e90c6ce1392cd1824ff8b4832d9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382311, "uuid": "2c8cdf41-e12d-4e9b-b2e3-e40ecfbd14e9", "comment": "Malware payload (Mirai)", "value": "84edc2e849954851a6382234e88ef0a7f8bf2ce0056f4bd71e76c7ff42405dd56610565c6e29ab9a99509e225b8b2e96", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382311, "uuid": "c8315d50-8dbc-45ab-a69c-01af3544b3c3", "value": "T149431917F94685FDC089C234177EBA3AE92331FE1229B26A67D4FB263DC6D611E09D04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382311, "uuid": "4f0f81ed-4ddb-48b0-a8aa-c6ac29c7e02a", "value": "1536:1XIY73si3qEToSRhINeQ/K6C8u50pfEHwNLJ:2Y7H6ETRhID/Kn5qEHw1J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747382311, "uuid": "c1b5a99e-cb3b-465c-baff-ce73b1025931", "value": 58480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747382311, "uuid": "61a0861f-6a01-4c26-8129-2965175779a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382311, "uuid": "c1ec394a-878d-4c5b-b267-fa1a57b0f766", "value": "RpcSecurity.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "267577ca-3284-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747420361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747420361, "uuid": "d065e7fe-618f-44c5-9c3b-60f67fa55ebd", "comment": "Malware payload", "value": "f616c5de69499d0378fc88ab963fd33d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747420361, "uuid": "f23ae029-36f1-4ae9-b58d-e2cf0a66cbe6", "comment": "Malware payload", "value": "5bf368cd76b827ffe63e9384ffa57f60250a115bea85b619c3d58625e42ed2ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747420361, "uuid": "d29c69d0-152f-40fc-9a10-c7a2fa85cbbe", "comment": "Malware payload", "value": "85fcccb9d15289f25c50a8415b7d4b1ce8a48ea5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747420361, "uuid": "2f620fc0-536a-4532-a292-f5a78e563a86", "comment": "Malware payload", "value": "655c1cc7de5c0d6f86f427920c62c2051e0e4c2465981e8c12972150970f63f2f6edb98068f66e69853cf8e21f1997ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747420361, "uuid": "aded58c2-f72c-426f-b4a0-5c449dad450b", "value": "T1EAD4235DF894F4A4D337467399D4E2318678EA08888CCB53F18B5E97BC16B327A1C91E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747420361, "uuid": "bbdd9c1a-7c31-46a5-b216-abec2cf213d8", "value": "b7aa01e7263a2be32db5b6f93337a38a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747420361, "uuid": "88850296-865e-4b27-8cd7-a84abec905c2", "value": "12288:6BKCoSyQ21u7LDd7ZDaaNlayjWRF9U18TiRL/ahsrCJx45K3Fi:ZZ31u7LDbDaaNYp9UOmp/WsrCzgK1i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747420361, "uuid": "e81cf25b-d7cd-4344-b119-045f8808f8b9", "value": 598168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747420361, "uuid": "33140c7c-76c4-4cd7-846c-042d93c9fdc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747420361, "uuid": "2f7f9769-c4b5-4796-ae63-c4ee297bdaa7", "value": "LegacyUpdate-1.10.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67db7582-326a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1747409303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747409303, "uuid": "13d93401-7878-4036-a13e-2076f02dffd2", "comment": "Malware payload (Rhadamanthys)", "value": "e84db67f8f30cd4ba03a0c9e6952628b", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747409303, "uuid": "b6a54113-19ed-4c4a-b25a-d91fb6589158", "comment": "Malware payload (Rhadamanthys)", "value": "5ca4552216ddc3b276e3cf2684cc5041b31931181a54d5cb62113bf6aaba1575", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747409303, "uuid": "3cb4e777-9d61-44c6-8ab1-1ff697ebfe16", "comment": "Malware payload (Rhadamanthys)", "value": "c24c01cc464db661ec5f5910411b7049793fc1e6", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747409303, "uuid": "7265c255-0567-438b-a1d6-b20f5cc61d4c", "comment": "Malware payload (Rhadamanthys)", "value": "6ccdbd6252e56d12bb26abfc68b0b5b8aabd105cd86dfdc79bd599a32fbab9b37af2df155c33fd605100844854e4cb3e", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747409303, "uuid": "96ee6fa0-f061-4735-8527-7e239252f9bf", "value": "T1AF363331F3966AB5C1D521760E8FE292BB32FF499F93910700D9772D59342E1DBA3882", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747409303, "uuid": "8038816b-2846-4c59-bf17-d718a7e3d1fb", "value": "98304:4W7vGjWo3O8qSH96AbVlxfpRavH9tMVqHRX2gSL2ZnpTLB1nHH:jvGjWosSLJfpgv7MWRowdLBxHH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747409303, "uuid": "e5de7001-0202-4c18-8004-36a973f86a7f", "value": 5062656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747409303, "uuid": "9cd2a1bb-f790-4f0c-83ad-3d4f43f6c6e2", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747409303, "uuid": "55f527b6-f0d8-4a5a-b6ba-43ef9ee7607b", "value": "SecuriteInfo.com.Win32.Malware-gen.24050.20684", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28054e5a-3277-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747414780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747414780, "uuid": "4046e745-a157-47d9-814f-c3e522f7abfa", "comment": "Malware payload (Mirai)", "value": "c80123da66b3cdafeb84aa6a533e23b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747414780, "uuid": "bcf9455c-b187-4ba9-bbc8-d7ff90ab4739", "comment": "Malware payload (Mirai)", "value": "5cfe957cdd287173203f190b1c695d99324ef3313d353c93afff575f97a9b815", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747414780, "uuid": "cb5b67c7-02df-4e41-ad66-48125cde0704", "comment": "Malware payload (Mirai)", "value": "c980870372662158637b2912b4cfbe39074ed0b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747414780, "uuid": "230960e0-ebb8-4dcf-8166-7f4e672c393c", "comment": "Malware payload (Mirai)", "value": "67db9540cad0232fa130ddd5b71c6535a95e494bb62ef091b2eaf3dd56ccd8f0b16e6a7ff8c86f22ba6e9e3fd0d7cd90", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747414780, "uuid": "4bf1b498-c505-4dd0-a8b2-9661be50acf0", "value": "T145F39D36C8257F68C2A1E234B0759F792B5395A492435FBE25B7C2718043DCDFA09BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747414780, "uuid": "e53e5a05-935e-424c-9da9-91f72c93ad64", "value": "3072:MyOjeVqVW4DiXsrDq0Zdm61/hvzaQ6We8k3u2y:MyioqDDiXsr9Zdm6Xvneru2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747414780, "uuid": "03a82105-b043-4d1e-9f1e-1b4426669244", "value": 161056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747414780, "uuid": "8741173c-cb91-44de-823c-f5b31f83380f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747414780, "uuid": "afac2ad8-278f-4e56-9976-21a736c7fc72", "value": "neon.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd7fff26-3228-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747381100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381100, "uuid": "e298b3c5-3cc3-403b-97c3-b914f39be063", "comment": "Malware payload (Mirai)", "value": "34d71e0e9738d311c2c4c63023b19356", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381100, "uuid": "47c6a785-5821-4abc-ab81-195a93a033bd", "comment": "Malware payload (Mirai)", "value": "5d0cbceb78808b0c446fb68075ac4c2427c53ac7d7ea6182720dc54f1254160b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381100, "uuid": "c62d4db5-6cbc-42c7-ab09-b6a81e92e66b", "comment": "Malware payload (Mirai)", "value": "73f990ff6f1ee7706a8650a78c445558da29c27e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381100, "uuid": "99378fee-f712-4376-9dc7-1cbb2d83f9c7", "comment": "Malware payload (Mirai)", "value": "584f1b282d4119404a68dd2471c31929a8e474d3bba45b03165de4956aee3323c93c60d2b960929b4c886aaf194d21ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381100, "uuid": "316835d0-789b-4842-ada3-7745fc49062c", "value": "T1D4438E26C8299D94E10DC634BD784E741B23F00C9626AEF69E8786964053F7CFB993F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381100, "uuid": "9e1509e7-7dd4-4087-8f62-e96fa423737b", "value": "768:XZame9eieaqteKc/ziVjwtGzdn048K86UwyFN36UVfvrC4CkoHuLC8v+79yfX:JamM33wa2VwtGGwyFN36UVHfQOLC8vl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747381100, "uuid": "66f11af6-a0d5-4249-a928-afb9d48b9387", "value": 56000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747381100, "uuid": "ea4ac594-085f-43f1-a2e5-f9cd24b33328", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381100, "uuid": "ed75e148-5635-4ced-b5c2-3546123e2bc3", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35fb0be9-32a3-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747433701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747433701, "uuid": "7e19ec63-0f8a-4d25-91f5-57a45c53ecb8", "comment": "Malware payload", "value": "75377c85ceb7a08ca3dab4815ad8a4e6", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747433701, "uuid": "8b56dea3-8852-455a-85f4-757df374928b", "comment": "Malware payload", "value": "5d137355d5a01c07b49352702cae2c492a929a8b95f4fd4bdadeecc7adf9ffce", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747433701, "uuid": "a95c8330-c40e-424f-805b-0a87421f1a1b", "comment": "Malware payload", "value": "c726a8d931c1a2ce3d03dbaae2b82ae5defac908", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747433701, "uuid": "660b34b0-93cf-4232-b658-809fcb4b6b36", "comment": "Malware payload", "value": "86dbe856e4b1f96e718cb9c157eb223bede981611bd2aaf19c6fc6df8bd9ffa058c78cb2d6d24b199bc056c4a82c9a00", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747433701, "uuid": "8473e9d6-bdd3-4e44-a48d-74b73f6afdc3", "value": "T1A9F00EEB0CA7C94DB99408864EEC62A0BE4441852468880990DCAC34F530A4E8C33234", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747433701, "uuid": "5fb1b02c-93c3-4565-8865-d35ddfdbabad", "value": "12:kxvsCk9cE3Mod/XU/JONxnWplcEWu1zOAYI:kbxu/kanWHcEWuII", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747433701, "uuid": "48e29433-75b0-41dc-832d-d40f9d441259", "value": 497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747433701, "uuid": "bf563455-0f1a-4329-bbc2-01f85f9a9a8c", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747433701, "uuid": "d01f9c24-1b31-4ca1-aae6-0ce9a669b9d9", "value": "fuck_niggers_49.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c92013f3-327d-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747417627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747417627, "uuid": "cf5ac1ab-37e1-4eea-8539-6abbd5cef0d2", "comment": "Malware payload", "value": "529eff8439f3ee485e8e22a82e34303b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747417627, "uuid": "1730cc95-a986-40db-bcb8-5ae0af6f94c7", "comment": "Malware payload", "value": "5d2032ed610eb0e6be9aa3fc96654e40035117bbb31a705ab2d5b116652a4c53", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747417627, "uuid": "e116eb68-e366-4b40-b239-d5331ec21136", "comment": "Malware payload", "value": "a1a77d481ab75d3f64e143db9b2e4e0a908c12dc", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747417627, "uuid": "cf78561b-f248-4a94-a818-9613b7655f62", "comment": "Malware payload", "value": "34785376662f40c62d78579164c63a0b90c3abecbe9f349801fe25e969f2704c2e9a934dcc47b8b35be1f286bbf87cda", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747417627, "uuid": "dc990a66-c1d9-4229-a58d-16b8d944f537", "value": "T12D14135C80F1D26CC8C935E32F5BC14EF29ABD3B5CDAC059E6E466A9152B70C672122F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747417627, "uuid": "b37dd4f7-30e9-4deb-937b-42e785d8537a", "value": "3072:R15iRYZpUkEfrDZJ4N9GhX8nip0ljo4Gjt6oHCnucyonF3PtJPoaphUfgYHr5:R1ha/cN90XIipzZjt7CTPLoaEfhHr5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747417627, "uuid": "838a30f1-8ad7-44f5-af82-1e9ce0e95fc4", "value": 197194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747417627, "uuid": "249175dc-0214-4971-aa88-f37354a8f24b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747417627, "uuid": "32dc025d-ba81-4171-8343-752322f7a498", "value": "Harmless Malware.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce234b5d-3228-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747381128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381128, "uuid": "53e1b23c-ebc5-4c6f-aa6f-7f9c9aa4da57", "comment": "Malware payload (Mirai)", "value": "04953bf9f1619f3198a83ab4f105409f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381128, "uuid": "5c83e6b8-451e-48e7-ad91-310e5c6a44d9", "comment": "Malware payload (Mirai)", "value": "5d67114b58dc908bd462e862e02c8403dcda3d83ec1cd85b3e254c25ebafd099", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381128, "uuid": "df1d127e-5d8f-40e9-b5ce-6e7a27c1cdfd", "comment": "Malware payload (Mirai)", "value": "d60d529746db5fd86846ae5d9d1bf0789fd83904", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381128, "uuid": "022a42fc-412a-4ef3-a458-42e76f47c57d", "comment": "Malware payload (Mirai)", "value": "88f13822821da33c4330b9f0f2e71f1c173fc78f891dec0c8a8ac1e0357681fa640ad777d30a53333e3cea0485ed9faf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381128, "uuid": "6bfb8638-cfa1-4995-a669-d7d5ff712c55", "value": "T1EA042945EA404B13C0D627B9F6DF42463333AB9497EB73069528AFB43F8679E4F12A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381128, "uuid": "c7067058-5b9a-4dd1-b679-1ff50d18ce85", "value": "3072:OLe6vhN1QIruCee+asuTuRebU7IVILAZQy38YhTfYo+M/Rvs1tlLn:ee6vhQIr1r+asuTuReAvLA738+x+M/RO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747381128, "uuid": "c135eee7-2848-433a-a94f-12c17630c639", "value": 181474, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747381128, "uuid": "15068d02-79de-4fcc-971a-54afb76ea603", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381128, "uuid": "49723b58-720d-4726-9ad7-0c5f782d1a4e", "value": "main_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c578fb94-3240-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Amadey)", "timestamp": 1747391422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747391422, "uuid": "2f271269-e75e-498d-97a3-a3d60aac0d0c", "comment": "Malware payload (Amadey)", "value": "0d81648f2a54a40be7fcb57bc3209aee", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747391422, "uuid": "a9e1a1fd-5ec8-4b0c-8c12-ba84f35db166", "comment": "Malware payload (Amadey)", "value": "5ddcb268ab3c6e2e8eb3370f990f48fc1825fd67c121789bb7df9e172860c00f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747391422, "uuid": "c2462504-2f30-4506-994b-3e867af8c990", "comment": "Malware payload (Amadey)", "value": "971859c5430c0d58f7f5df004898c07a4b19890b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747391422, "uuid": "db2cc704-2efc-4ae7-afb7-73c743b9bbef", "comment": "Malware payload (Amadey)", "value": "88c7d77b697e4cdf9517fb8368d68337eeee8fa6304ba7997de025b711a20ed47f39a9b17552f92926f0419efdf221ad", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747391422, "uuid": "e8f5694f-468e-41a8-b0ad-c03008f55bee", "value": "T176159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747391422, "uuid": "0e15b0b0-caa5-4b8b-8064-5a55c0fedc11", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747391422, "uuid": "42627b74-4fe6-4184-8177-a3a6addc0f96", "value": "24576:6qDEvCTbMWu7rQYlBQcBiT6rprG8aM3b:6TvC/MTQYxsWR7aM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747391422, "uuid": "2def888d-283d-437f-a902-62885e4951df", "value": 961024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747391422, "uuid": "19205b7a-ece8-4c09-996d-143380c1ab61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747391422, "uuid": "f09198e6-075b-4e34-bc8a-ea1016806a30", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54fe9912-3265-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747407124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747407124, "uuid": "5d82397a-9fb6-4948-b628-ecdc52825332", "comment": "Malware payload", "value": "f7c1b488b0e0f3ee12f198586d4e3275", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747407124, "uuid": "538fd55d-fd85-4325-9dfe-36ac51099f18", "comment": "Malware payload", "value": "5df7d07776d8fa42de7e0516040f9049da2bd29a90b82952b2b57bad65b6c931", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747407124, "uuid": "7c382cf1-65fa-40f4-ab6d-722fac6c5abc", "comment": "Malware payload", "value": "eb82d04fab49eb25ea0673c7f894c73a4d891725", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747407124, "uuid": "9c8ce49b-66cd-406a-ab8f-3bc3da650a77", "comment": "Malware payload", "value": "e50ed34e47d61466ae3487843e0958ad5ad5e8230b69227dd243a36e3df6bd299dfb7ba4fa6cc9658ca15a0770174aa5", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747407124, "uuid": "39f8021d-d31f-46bc-83d7-3c65294658e7", "value": "T11AE733E97FB19D3BC8BB513A66919212B11D4C64C6DB91031702395CACBBAC48FC6EDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747407124, "uuid": "46679ff4-4080-4ca3-8252-9515bfa5d7ff", "value": "1572864:Z+AV8YX2fDhxJw+sWCaXpHYRSa3/jctL1VkQpMAoPmXJ5:YmXGDvCbWXXp4R7/j4HkaMfPg7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747407124, "uuid": "a321b648-92be-456b-928c-0f1b7aadb41d", "value": 69609184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747407124, "uuid": "a4e86bbb-5f64-414d-a42d-6bd752248419", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747407124, "uuid": "1ad69b9b-74de-4334-9582-0258665ff487", "value": "5df7d07776d8fa42de7e0516040f9049da2bd29a90b82952b2b57bad65b6c931.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3139a856-3236-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747386878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386878, "uuid": "601dbd2e-e571-499b-a59b-ef413392cb96", "comment": "Malware payload (Mirai)", "value": "a44087632b89576a47d40cc8a43f115f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386878, "uuid": "9445938c-c785-49c4-abed-a8c29c167fa0", "comment": "Malware payload (Mirai)", "value": "5dfacfcd3d2745c77ba2e4774ca2a250c1d844beb2b5b278696b82b897da0aef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386878, "uuid": "e9822ecb-6f5b-4510-9528-4bdb8730c09e", "comment": "Malware payload (Mirai)", "value": "b27ac78a549e3eb4d30b133d912203c4c8867484", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386878, "uuid": "121a129b-4dfb-4cea-8848-db3faad6d2b9", "comment": "Malware payload (Mirai)", "value": "2e82f498c8f6f39b0ef8164b9043e26288758c94f3d13ff2e3300e8538912c5f5e2531ea6f848aae6f559d10a91f737c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386878, "uuid": "0b1369c5-1638-48e1-854b-2956c861117b", "value": "T15D732A92FC918E12C4D621BAB81D258D336313F9E3DE72238F605B507B568A70D7BD1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386878, "uuid": "0dd68166-6695-4310-a1ee-c78fd554e1c5", "value": "1536:+pnbXl6QwCRpm9hq1pSrdR9MNU7j+uV0U7G8mQ+oMciDIO+hX8v:2UQIDq2RDMNGNstIO+hX8v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747386878, "uuid": "7d91ad15-9cc4-44de-993a-ae559f0ff69a", "value": 75060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747386878, "uuid": "00eae868-81eb-4f97-9333-cad86b0963a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386878, "uuid": "e554a85b-4aeb-43d9-b8b1-6fa7101bbf8f", "value": "Mozi.Arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43f12148-3248-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747394640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747394640, "uuid": "4d97dfd9-e866-48ea-a3e0-d4ef303a826f", "comment": "Malware payload", "value": "a7defc0f3adbc51a293e818ef3a84b4c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747394640, "uuid": "3fa4215d-02c0-4c65-93b1-1150369b1347", "comment": "Malware payload", "value": "5e3cbbd717c1bc485caea425c32699e83f109f0607491e36606eed8aba06a9a6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747394640, "uuid": "576faee3-aaa8-4415-97e8-8cb27437f69f", "comment": "Malware payload", "value": "04c9a37ef905c123dff03df441699d2025d38195", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747394640, "uuid": "36b044d6-46e8-4258-bd23-d83a6769b95c", "comment": "Malware payload", "value": "3b867e5396238f60d129dba3894f5b127ace4a7147c285b2db503d9adebd44a4389db3452338447cee3b3d9bd2c83f40", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747394640, "uuid": "72907c36-3c48-42b5-9887-a301950bd52c", "value": "T1A68312CFA4598B66EC7ACDF809DB59044D46621E738B75EF530CD59C2038B862C8E92F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747394640, "uuid": "374ef5a5-d65b-4bb7-b981-a7ca65ebebb2", "value": "1536:m3LqE6rUQWzVQR7iAGEcUT52Ii7pLqBNs4LOjcwf4nB6XuzGNy+iSc7tNUZM:mOE6PWo1T5Qz4LVMXuzVNScWM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747394640, "uuid": "c548a53c-8455-449f-95ef-e633aaa16113", "value": 85128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747394640, "uuid": "a71927be-ac53-4a9b-b07e-d35b193734f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747394640, "uuid": "1a261777-2c2f-46f2-925c-af8517e47996", "value": "i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b17fbbde-3228-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747381080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381080, "uuid": "42f9ffb5-d0b7-433f-a189-50b031548521", "comment": "Malware payload (Mirai)", "value": "011aa6820aa9afb96b042f2710d2a4b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381080, "uuid": "30d8f443-8f87-4455-9dac-06596a6cfebc", "comment": "Malware payload (Mirai)", "value": "5e4f5e12f7f10799cb2100296eaedb895b141d120af44e08f087455d53dc185e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381080, "uuid": "4b22e571-4e55-4dab-a5ee-ca8ee32751aa", "comment": "Malware payload (Mirai)", "value": "b0ac2a2230ac97a2d858b7d372fda32059d54f78", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381080, "uuid": "2917a1d9-95c0-4389-a511-efb629eca70a", "comment": "Malware payload (Mirai)", "value": "4c3d4ee939828ae0e880553dd8096e9fce8fb9bd2ec5823e20ebc2ebe120e9b1ed18bd25a5f6726c349f631626ad556b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381080, "uuid": "645d8f21-dd61-4a05-8146-2df28992149f", "value": "T1EAB35BB3DC26AF98C655D074B0B08FB92F53A59482471FBE19B6C2B44443D8DFA05BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381080, "uuid": "cb97fe3c-66cd-4bf3-899c-572b42848507", "value": "1536:WTW/VCxsHZusS2Li62C8vqKTR5/PPVGAto2WszrW+TNe7a:WytCxsSx62NFT7VG92Wcrbwe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747381080, "uuid": "353ec458-bd49-41eb-b332-a904cd2d55c0", "value": 117568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747381080, "uuid": "d5d707dd-43f5-460d-86dc-09d0715ca541", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381080, "uuid": "b21727e9-164a-465c-928f-8d7ec5257090", "value": "main_sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdd19c1a-3217-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1747373826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747373826, "uuid": "e55e86de-d4f4-4c46-abb5-bcb8a6bd8279", "comment": "Malware payload (Prometei)", "value": "4ebfc721032b8b8babf273b6c70da630", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747373826, "uuid": "b1707d1b-454d-43c1-8a4a-3ba34094ddf9", "comment": "Malware payload (Prometei)", "value": "5e5039b3cad238da70a3f244c2b50dcfb4b92504d77a77484de61b0326b1f49c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747373826, "uuid": "0610298c-183a-4c2b-89fe-540e7105fec5", "comment": "Malware payload (Prometei)", "value": "583fff23df6825eb48aa4bc771bb806ae8e6a11c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747373826, "uuid": "8f55ddd7-9158-4fe6-b8ad-3de4b4be68c4", "comment": "Malware payload (Prometei)", "value": "35d3e71a55bef085fba8f8554f11fd11728120af9f674d02ec85c7827994eb94fedf16de32d19c03183ac3ca0cb70616", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747373826, "uuid": "06d3be43-7fde-4dd5-8996-cd0dc072e303", "value": "T1E89423F8C87D2E3098169B3CBB1A826CF0E15772D9562B6AB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747373826, "uuid": "6b01c3f5-c3e4-463c-ac62-319b4f1a28d6", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgP:25WOSACZSV6eKRH5EPiamb4DsDwwc/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747373826, "uuid": "f332cc7d-99b0-4b93-b59e-24eeb6bd9fe7", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747373826, "uuid": "f0f820dc-ae32-4f4d-9f25-7ef33f9a76b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747373826, "uuid": "564acf3c-4b68-44d1-acd2-3e7930553b4f", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d76a4aa7-32b1-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747439985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747439985, "uuid": "65e9e4b2-ceb7-4b37-8300-822864696b8d", "comment": "Malware payload", "value": "b0413950815e3bdc8ee743dca162c5a2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747439985, "uuid": "a1a46f69-e9ab-40d2-9c94-b499cf31c87e", "comment": "Malware payload", "value": "5e9470f37c53b4d037d8efa55fd1af1b3dd80c28dd9e8f578b25c79d71a98201", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747439985, "uuid": "a49b8129-8224-4117-8ae3-9ad7db336a27", "comment": "Malware payload", "value": "8d3611cbf1b00b6f545b0d0627d6ada6423d6ccf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747439985, "uuid": "a9002d17-afc3-4267-a1e3-1eded53010ab", "comment": "Malware payload", "value": "b73509f91f5bef501a3b9606224a4da111a796e5cfc2e679d707b60a382620399bef4512ec3caf23cfc60821dc349a90", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747439985, "uuid": "b7ca03da-6ea9-4bf7-9b8e-3078b71e364e", "value": "T18B9423F8C87D2E3098169F3CBB1A826CF0A15772D9562B6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747439985, "uuid": "d4c8c811-ecfa-4bf4-8516-97465d928a2c", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgs:25WOSACZSV6eKRH5EPiamb4DsDwwcc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747439985, "uuid": "f02be9d8-d1b3-42ac-912d-beb393d35758", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747439985, "uuid": "378f39dc-cf46-45a3-b5e8-e5026b3e8b9b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747439985, "uuid": "140dd985-1962-46b0-b7b4-96ddc349979f", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f543f702-3233-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747385918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747385918, "uuid": "f820223a-6b16-4663-96e4-44075888d74a", "comment": "Malware payload (Mirai)", "value": "03feb1f00c2a77d979b5d1a805877824", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747385918, "uuid": "d1a941b8-ce7e-4a38-9de5-14e1d2eb282b", "comment": "Malware payload (Mirai)", "value": "5f1687c558b2c91d38ceb9a21d7d3f0084ceeac7936e02e30ff0ad411935d962", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747385918, "uuid": "a6cf7e8d-9294-44df-ab72-91a754be2447", "comment": "Malware payload (Mirai)", "value": "46717c89444993cf35b528c19a4e33224f3056bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747385918, "uuid": "836ba455-f893-4700-a782-239e94bc4c69", "comment": "Malware payload (Mirai)", "value": "c6016519e232277f3470d2e0b54465f42c5620dfdcb8506b0d2fef990023e600c4cde792f0e4044ad6c7221aea1d2784", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747385918, "uuid": "0941a611-71ec-4fe5-9d94-20ec681b1968", "value": "T1AFB39C9FF24B56A1C45287F007CB8BDE2E2322C16F4394E37D5E267A19751DB4906F82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747385918, "uuid": "cc7151ba-fceb-4371-bdbb-0f0f1cc97fac", "value": "1536:Gz5j457NwySlisP4VnVlBO+MGzxx4/ogj/LWd:mJSRwySlXKnV5MGIogjq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747385918, "uuid": "9f9c7945-94b8-4a22-82c2-a239669aa6f5", "value": 107836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747385918, "uuid": "a20488bd-3050-4e64-99e7-10c0508f9948", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747385918, "uuid": "ef753d47-79aa-4d08-ba01-8725576a913e", "value": "neon.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8c405a3-324e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (CredentialFlusher)", "timestamp": 1747397440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747397440, "uuid": "4858e31e-78fa-4568-acf0-451fefe54df3", "comment": "Malware payload (CredentialFlusher)", "value": "268cb8bd1306e71c24d7dbf14df847a7", "object_relation": "md5", "Tag": [ { "name": "CredentialFlusher", "colour": "#DA52E1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747397440, "uuid": "72d5fab8-c557-4e47-a85d-857d517bdd22", "comment": "Malware payload (CredentialFlusher)", "value": "5f5921b41de6d5afbf6ea08ae4ab256db61547279b23572f59f254361dc83660", "object_relation": "sha256", "Tag": [ { "name": "CredentialFlusher", "colour": "#DA52E1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747397440, "uuid": "bb477746-446b-48a0-ad50-5f157178c39d", "comment": "Malware payload (CredentialFlusher)", "value": "9571402256e2e2f95758feda0020d43b04358148", "object_relation": "sha1", "Tag": [ { "name": "CredentialFlusher", "colour": "#DA52E1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747397440, "uuid": "45825d7d-00e3-4519-bf33-100275171386", "comment": "Malware payload (CredentialFlusher)", "value": "368604af8f5cf2698ae034d7ac546306683053544599668281336997a8165fb8b5c29b71f33021400badf23530d15e49", "object_relation": "sha3-384", "Tag": [ { "name": "CredentialFlusher", "colour": "#DA52E1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747397440, "uuid": "29a581d9-628b-4550-97d0-f72e9028a631", "value": "T16F159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13A81DB9BD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747397440, "uuid": "6a8f1135-f6e1-42f3-9317-28a564ebdb35", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747397440, "uuid": "02fc6f1d-ddfd-4537-8fc2-5a82faa56fa1", "value": "24576:SqDEvCTbMWu7rQYlBQcBiT6rprG8aM1b:STvC/MTQYxsWR7aM1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747397440, "uuid": "7b8f5958-2404-4fee-bad7-395bf747285e", "value": 961024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747397440, "uuid": "eed6e524-aeda-49c1-8ac8-88ff5f690c8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747397440, "uuid": "eb286495-fd6e-4953-a291-7ba69ac2c7ce", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15973a6f-322f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747383825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747383825, "uuid": "c776cf71-dae9-4d17-ab4e-700a9b1c2652", "comment": "Malware payload (Mirai)", "value": "82ac9ee5aaee81a507c6e2b427e1147a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747383825, "uuid": "745ec510-8ea4-4e79-baeb-2be8ac339ebf", "comment": "Malware payload (Mirai)", "value": "5f6ee0934437595f5524ccb3458e43e50e191e5930441a28789c3924fd67f03f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747383825, "uuid": "29201323-0ded-495c-bca3-45c01bf14028", "comment": "Malware payload (Mirai)", "value": "cf27519054c372dce7d449b02fe1eec44aab4217", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747383825, "uuid": "6e389d16-89e0-4319-a108-ef874620f9cc", "comment": "Malware payload (Mirai)", "value": "4307a41de02a56471c55a27034ef4aded8b4298284882d1584203ffc96f762300f22e1b4d73694185e1d3b1363c4b14b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747383825, "uuid": "e6e96bb5-9012-44b8-9fa9-6f3c773aa856", "value": "T1B5835C3169392A26C0D0B97E12F74758B2E21B4E25E8CA1E7D730E4FFF51A506413AF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747383825, "uuid": "81999a18-af22-4ea6-9be3-caff5cd94eee", "value": "1536:KYHpONKUq1et03jRIpwXp/ra/SjPsIhJWsNr4Yj9heQ8:nxVJTsIXzp48ef", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747383825, "uuid": "46d9d377-ad54-4f85-bd8d-ab89a136cc08", "value": 80880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747383825, "uuid": "2d928d06-a56f-47eb-96be-e222238dcdc7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747383825, "uuid": "8d2e5fa9-990d-4475-86e3-ca8a66e4f565", "value": "UnHAnaAW.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f281302-322f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747383814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747383814, "uuid": "3f2eeaa6-3a3a-4b8f-89e3-d313ce4b8620", "comment": "Malware payload (Mirai)", "value": "fe6e75668e2bafe42e7a5ceba4454de7", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747383814, "uuid": "58056c7e-89e5-4b55-97da-c9fac1493b3e", "comment": "Malware payload (Mirai)", "value": "5f8f26fe7d067d475c31114d7cea3f2696191185a3c79885c35d20efe5a70f6c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747383814, "uuid": "bd61d24b-16c3-44b7-a2ac-c8ae83433283", "comment": "Malware payload (Mirai)", "value": "5fcf4b22be49b5af34a098d59b93664db226d6eb", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747383814, "uuid": "71c819ed-b025-4e43-b05c-ac41ebb06a3e", "comment": "Malware payload (Mirai)", "value": "9d6052b86f9a5837014da0f4acab687c0573b987b6a7cfa54db7dcb2da3bf722e782d5d7ba560d921a83cb7f3b84d0e0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747383814, "uuid": "fb419a17-2512-443e-9389-c32a63896e0c", "value": "T1F2014C9CE57CCB9209ADC58AF6B06104449190C7E1F49BD5F28D0820BF44E4D355320D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747383814, "uuid": "05d379e7-2d9b-4ecd-865b-1e44e58b7eaf", "value": "12:FzY8id/7JAC7akxGWi2jX0KTkkjJmtAnmtWGwnv:FzY8k1/sWi2jkwImmgT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747383814, "uuid": "da8e194e-79af-46e3-bcdb-34504aa4fe78", "value": 659, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747383814, "uuid": "07b31b2b-5a8b-4cb0-83e8-7fe27f01516e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747383814, "uuid": "a46497cb-3557-495f-89b6-17f3608077a8", "value": "o.xml", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bed970f1-327d-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747417610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747417610, "uuid": "f2fc7767-1b0f-42cd-94f9-c76cd4d90ca1", "comment": "Malware payload", "value": "69a49be0b4bb6e87e690c0d380d72d13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747417610, "uuid": "a527d40e-0fe5-4e7e-8c3d-4bc059b0f311", "comment": "Malware payload", "value": "5fcb2395b3bc3231e7ac413ee9d2888345cb201f8cb6f96136e2c8de87903482", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747417610, "uuid": "bdc39fb3-38d0-4320-be7a-80d69ce9ee17", "comment": "Malware payload", "value": "02aa9de42c3e93d106641b7d87bca68be9afbdad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747417610, "uuid": "dc54f811-6ae1-4675-818c-c6828c0e776d", "comment": "Malware payload", "value": "69812be7fa6e8e4942d3b182c6b2f22119a324c37f329b37518d706da0d89873d326ac1a3d9f9ff84c5ef2444d1ad6f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747417610, "uuid": "116b07cf-90d8-4957-8c64-2c60445548fb", "value": "T11426336791EEEDBCDA2350F028FBB3BF888383B91462465A97585090F283575678CF53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747417610, "uuid": "6cff57c7-45e7-4cf3-aad6-7679c5291dd5", "value": "05a03ed18d2e75f8c4f1c5bcf287ac56", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747417610, "uuid": "c3b6de90-44a3-4511-a478-5af3c511767d", "value": "98304:/8FHQcsibw8SPLeTtSQo5Z8DERxrfExYza/FvdV1k2536Y0g05kP9:UFwcXMHLKy6txVFdbz536YFP9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747417610, "uuid": "45da8beb-6c4d-4480-a058-1ec6929d3020", "value": 4772351, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747417610, "uuid": "b1a614bc-f4ee-4e14-abc5-4ead047f7902", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747417610, "uuid": "9ef5d404-a1ca-4417-b14a-1983b859d713", "value": "python_setupx69.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7671c8d-3275-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747414161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747414161, "uuid": "396d5644-1257-4428-817a-5f4aac6d1578", "comment": "Malware payload", "value": "057fcff4e3692ff6b4932d7c64c2b9ff", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747414161, "uuid": "2c717a13-d64d-4beb-9e89-9aafa0f08d24", "comment": "Malware payload", "value": "5fdc3556785d029bc2720cb2c30a1022f1b2ea683ed797b7043aedc10c5bd51c", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747414161, "uuid": "e7014f80-4ffb-4f63-815c-b5337a721653", "comment": "Malware payload", "value": "fcec16d53b04d87044fca774cf8a8814f6e554e8", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747414161, "uuid": "c3f28803-4b20-4084-8f5e-2f9509981c2f", "comment": "Malware payload", "value": "ee59060f70c949abadbf3c2a9decec448edecd1c631151ede735459c400f2527c80650a91e0c66980662afce7369cd17", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747414161, "uuid": "3d72dac4-2cab-4280-acf8-a0d921bb9dae", "value": "T102E7334DFF92D43AD83B113054968212B709DC46C78A9A0772847BAD8CBB7D58FC6EC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747414161, "uuid": "b0982a32-feaa-44df-905d-328e9e2b71e9", "value": "786432:kcAeQyENOT9wwXae56rOTucvtjKPHo2P6LLY1WZIr5PaV0K+4kpr1yeaKx/74C69:kcrUeOe5sOKsK/MDqaKd8YZGB+hOpIId", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747414161, "uuid": "60a1ba06-d604-48d1-8172-66d1357c3862", "value": 64449262, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747414161, "uuid": "ec26d7c4-59c8-4695-b16d-e53a11d1c793", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747414161, "uuid": "45abd117-7dd1-4109-a670-ed7eba39bea9", "value": "5fdc3556785d029bc2720cb2c30a1022f1b2ea683ed797b7043aedc10c5bd51c.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "349ceb9c-326d-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747410506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747410506, "uuid": "2fa9bcc6-1576-42f7-94ad-ff4c0c4f0e2f", "comment": "Malware payload", "value": "b2a737047180f7797a536260e399417f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747410506, "uuid": "80aa63e0-1624-46ee-850d-49116775338d", "comment": "Malware payload", "value": "5fe51276c79ff276e21dfdbf4d8e44cdc13a4d606668a8b89c0fdf7f42e37428", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747410506, "uuid": "b204a0ba-178d-4485-9bd2-b01c92e0b3af", "comment": "Malware payload", "value": "df0ea4ba2045cfd2ffa5703b95f2137c87d0ff3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747410506, "uuid": "757cebf6-f3a3-4c36-a037-7f11e2fb3efb", "comment": "Malware payload", "value": "d478bbd12c285610ffeeea2fa292e8e42a5c4f465922aad47c2b1666a5b2ff5e5c329e11c59f438dcbd34734309446db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747410506, "uuid": "21d8974c-69fb-4a5a-9321-77d9b64b1a86", "value": "T193D423DD83348071FCE96177A00EED92BCF586748BA58A2E29A3C58DBC193FA31D5345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747410506, "uuid": "690e1d83-397a-4887-9230-e69e45ac48eb", "value": "bd51a645a9c68bd03b2e51586e5cbdcb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747410506, "uuid": "d3733f9e-0894-43cb-b854-6c90ed579e79", "value": "12288:J1NqaBTMfL/Lf5NFOGeNf+JM4WZyLtcwGStIKw2w0LBOvYqA:1HJMfTLxNFOGeJk038A+LBOv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747410506, "uuid": "c28c31f9-5f53-440c-9a3f-2597c3ca47a1", "value": 609280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747410506, "uuid": "11dd1439-2e62-48a3-8298-3cbb54e26f5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747410506, "uuid": "450bc825-6990-48e1-b809-d189ff512ac9", "value": "Server.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd2dc15e-3287-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747422009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747422009, "uuid": "60938b4b-bf3b-4650-bf1b-b982c00f0344", "comment": "Malware payload (Mirai)", "value": "47a5e65bbcb07f5b51252d66d1de31a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747422009, "uuid": "d7ffef26-aabe-49aa-8762-785a398d23ee", "comment": "Malware payload (Mirai)", "value": "60066cf117c56eba4b54a187244f0a5c0190c25f5343663907f667a7ea4855c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747422009, "uuid": "9810e2b4-1d7f-445c-86db-ead747397f94", "comment": "Malware payload (Mirai)", "value": "ba35777de8f8ba432e3f8f43103c05981e146d0a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747422009, "uuid": "ad1e1bec-6d41-46e0-bcf1-437bbbf370e4", "comment": "Malware payload (Mirai)", "value": "662a9921318fefb0cfd46053fbb4a3e5a6feecbe942c5b7de15f83fe9727f4a3a73ed344fbe7f3528b58cf2f4ce4fbe1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747422009, "uuid": "8590dc04-936c-45f7-9403-ffc6777a3a26", "value": "T1D9E2F138C1C05B2AEC3B8AF44E5899CAF7A08A4B7A500C91B7DA9F16743E1F17750DD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747422009, "uuid": "d9625df8-1c2f-4962-beda-32db548cdf61", "value": "768:Z1bMzfgc1Ho1VgWufb7zxh9vYnXudfS9faFNJx9t4uVcqgw0RTWXS:Z1bMzf9IzuD7zlvYnXKfS9ijr4u+qgwU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747422009, "uuid": "5e279329-e6c3-4443-aba2-bed2727540c8", "value": 32216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747422009, "uuid": "787c936c-b100-4ee3-8904-9ec3d69e408a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747422009, "uuid": "61f3e6cf-334a-4092-849c-79ae3779e698", "value": "db0fa4b8db0333367e9bda3ab68b8042.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d60de79-322b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747382281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382281, "uuid": "ae4db3cd-5105-4a92-b823-40b2c0220aeb", "comment": "Malware payload (Mirai)", "value": "2d801050a55b45a298127aab68f7698d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382281, "uuid": "d0329f82-f8f5-4e33-8575-89accaee1697", "comment": "Malware payload (Mirai)", "value": "604795209b09226ddd8da23658006c70eb5f78a134f6ff6028f9613f6dda7537", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382281, "uuid": "594dce60-e086-4b8e-a567-56a593fa6b06", "comment": "Malware payload (Mirai)", "value": "973504d2075d293c26dd24a1889a74ba81fddeb3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382281, "uuid": "35a8c4f8-7a6a-4e72-aa7b-9d886ed05200", "comment": "Malware payload (Mirai)", "value": "266c17af4c2b951f89f6d8f75dc9c5aec8794302523c82b2f4b76d276c0ed189f15202a0ea58ce26c3b4885ddcae55f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382281, "uuid": "0f9ca032-d1dc-4388-be90-feff4ec30db2", "value": "T1E3C39D9BB38B0A61D86207F50BC79BDD2E6321229D1FCCE76C0D693B59791CB49063D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382281, "uuid": "1b5bbe37-741e-49d4-b138-028af9b89cda", "value": "1536:40KUF/b0+hCQawBGXUs3h/C12Pnm/M1im9PgYV/LW9:5FnsGB9q9C12u/M1imhg4q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747382281, "uuid": "30234069-3a70-4241-b93c-e0ea3e437cd6", "value": 124244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747382281, "uuid": "a4e66c04-26f9-4dc3-a68e-c05c469c6fae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382281, "uuid": "cc36b8f2-4e3e-43d6-99cf-8d2f4c8c2601", "value": "rift.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dfc1f99-324c-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747396482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747396482, "uuid": "5f21bc20-f8aa-473a-b827-2190e2891007", "comment": "Malware payload", "value": "13a6060bfe18cc30d186535941100cd8", "object_relation": "md5", "Tag": [ { "name": "1po56mdxc-localto-net", "colour": "#E5C76C", "exportable": true, "hide_tag": false }, { "name": "AgidCert", "colour": "#56D604", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747396482, "uuid": "0bc39211-b739-4d88-b7c0-d380c9beceef", "comment": "Malware payload", "value": "606da40f5ea64b848a6c8d277f6fd479973ddc1566d9e229c223a5620a9f103b", "object_relation": "sha256", "Tag": [ { "name": "1po56mdxc-localto-net", "colour": "#E5C76C", "exportable": true, "hide_tag": false }, { "name": "AgidCert", "colour": "#56D604", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747396482, "uuid": "2f5cc77e-284b-4a42-9d0e-9f7ecfa7a855", "comment": "Malware payload", "value": "9623b39a5e3133c81a26322a777ccffda1dae4fa", "object_relation": "sha1", "Tag": [ { "name": "1po56mdxc-localto-net", "colour": "#E5C76C", "exportable": true, "hide_tag": false }, { "name": "AgidCert", "colour": "#56D604", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747396482, "uuid": "0637aae3-1cc6-4beb-a7bf-474832c6f876", "comment": "Malware payload", "value": "1e25631aa9ccfa0faf1e0360e86b1e9d685c10a3f5f934ca1bf0f36cc43246619d971c659d1844764342c01befc13710", "object_relation": "sha3-384", "Tag": [ { "name": "1po56mdxc-localto-net", "colour": "#E5C76C", "exportable": true, "hide_tag": false }, { "name": "AgidCert", "colour": "#56D604", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747396482, "uuid": "b6c478e9-f55c-485a-9a11-7a046bb2ab8f", "value": "T1E38240A0D8E9382767D7267632BE49ADF17E9A75938AFDE220D21DCC400D141B3ED46C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747396482, "uuid": "69f30f93-af1c-496c-b1c1-045a2c27db04", "value": "96:L6g9LPcSQRIPwVosEO2R/VXQPGKbT1kuM/e1wjfxXOO9OOi/LOOijOOuNoOOOOOg:LfUdRIuoRO2R/VXQeCk/KAUNY9L/rfN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747396482, "uuid": "8995f9cb-3bc3-4ba8-9cdd-9febb88f5f04", "value": 18706, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747396482, "uuid": "36f0288d-b738-4b90-aac6-d93342ba100d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747396482, "uuid": "1bfe75b3-ed2c-4af9-b482-e6c29d17120c", "value": "FA-45-04-2025 (6).vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64bb22eb-3241-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747391689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747391689, "uuid": "a2c583c9-a76e-40d8-92ab-bf30a3137970", "comment": "Malware payload", "value": "4583e6906c61c3204a147fc2406b8a2e", "object_relation": "md5", "Tag": [ { "name": "security-check-u8a6--com", "colour": "#68A0E7", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747391689, "uuid": "55b08b88-e561-4939-bbd5-029ad58d16d6", "comment": "Malware payload", "value": "6070b734f2bf624917aff725d4f6e05c802609cfcd8b17c38bc4716074f09769", "object_relation": "sha256", "Tag": [ { "name": "security-check-u8a6--com", "colour": "#68A0E7", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747391689, "uuid": "30eab7ef-da78-48bf-8188-f32bf66824b8", "comment": "Malware payload", "value": "b0b6488ba20efedbd95ed66fe4173e6be4d4bd98", "object_relation": "sha1", "Tag": [ { "name": "security-check-u8a6--com", "colour": "#68A0E7", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747391689, "uuid": "73e12c39-45c6-445f-ba81-3ada29f675f9", "comment": "Malware payload", "value": "52fe92b58a0a0c4b5246e22c1ca50809ee56334c88710a6157ccb9ee9db859400628d1978269aa4905cbcf800ca68b92", "object_relation": "sha3-384", "Tag": [ { "name": "security-check-u8a6--com", "colour": "#68A0E7", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747391689, "uuid": "af0b94df-25ae-44d4-be69-4938899bc20f", "value": "T1C6B01292C030D07101F04E426105C004DD304020078A83075014C4303C78430ED0F34E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747391689, "uuid": "49772411-c980-4eff-a3dc-9e74ff3a9db1", "value": "3:3JyKFKuVIAHO13QgAZtdEXmHg8RIVIAHDaFOdUAHZIAvn:3JZFZ4xQgytdEXtxai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747391689, "uuid": "e8f3bd4a-ce67-4853-a53c-dcf474fccd2c", "value": 122, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747391689, "uuid": "39e1e323-888f-4ae9-8848-9a1d680db877", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747391689, "uuid": "059ab75d-9d60-4a6f-9284-01f71863c16a", "value": "verify.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84b17ec3-3279-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RedLineStealer)", "timestamp": 1747415794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747415794, "uuid": "31b9a14c-dc14-4f75-bb13-03d911c71cab", "comment": "Malware payload (RedLineStealer)", "value": "4f0205e869cd5e12cd102a210443938c", "object_relation": "md5", "Tag": [ { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747415794, "uuid": "06eaa2ba-5d65-483a-ac03-2c246a255b6f", "comment": "Malware payload (RedLineStealer)", "value": "61974b843ae371e0472abf494817311e209d1ad9d01505537b7a58a330e19dda", "object_relation": "sha256", "Tag": [ { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747415794, "uuid": "23f55415-d260-4e30-8caf-f4c7571d3bdd", "comment": "Malware payload (RedLineStealer)", "value": "0fb7a0ea87e66d067ba159743b9363cb55f27118", "object_relation": "sha1", "Tag": [ { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747415794, "uuid": "98e0e00b-d825-4540-9e9a-1899828e3cf6", "comment": "Malware payload (RedLineStealer)", "value": "65cbe8a560a5fec1edd831cfbdcf0af2d3bf0e887d2a2e1084e0fa0948de352775a5fb879d360f33b8f7634d66b736d6", "object_relation": "sha3-384", "Tag": [ { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747415794, "uuid": "8a5f5e5a-7c88-40ad-96c3-5ed9647a7059", "value": "T16095337EB096D55BEE435C291CD4E7F59134E31BA8BA484C9828582FF340CE1AC5E3B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747415794, "uuid": "579b8578-059f-484c-ad56-e9f1a52f4fa4", "value": "49152:PzYL9tiEh9P0xe00civDPEBCBjpv/onBiRh3u31Aehyl3xj5:LO9txh90IlcioBCT/oBiLSa3xF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747415794, "uuid": "3095f121-dd40-4204-b4fd-9082a4d07f6d", "value": 1962272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747415794, "uuid": "d343bae8-3931-44ad-8c78-21b6c1336e4d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747415794, "uuid": "483b4708-9c0b-4331-b1c2-3adf9e1da23d", "value": "RedLine Stealer Cracked.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "314a254a-3227-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1747380436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747380436, "uuid": "3c091c1b-cd2d-4ef4-98d5-dcb94c2c61da", "comment": "Malware payload (Gafgyt)", "value": "77ba9d64cbc964684b88543b0dfc6e62", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747380436, "uuid": "f2775937-813e-49c5-b4da-fe33cc00b4cb", "comment": "Malware payload (Gafgyt)", "value": "619fe32d388a495a0d238e85d0eac6408f81a680bace689d9e6b5378d82086e0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747380436, "uuid": "903d9cc9-76a5-47ce-a63e-ed4511c5aee4", "comment": "Malware payload (Gafgyt)", "value": "7a1536382637f3b1c0c9ec5971caeda1ab380299", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747380436, "uuid": "014d6b3e-df82-4d6d-85a5-eb3951d9e88a", "comment": "Malware payload (Gafgyt)", "value": "9674acb58dea4a63ca5b3a4d822b7a8baa89e02a2699d835e1a6afcd592d9b508e79e4c450f096d5e8b04447e2579dfc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747380436, "uuid": "151a676c-623b-4486-98a9-b1c898f55063", "value": "T1B373C61ABFA50FB7DC6FCD3706A9070535CC551A22E43B3A3934C92CB65B54B4AE38A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747380436, "uuid": "dfe36877-5bbf-4b21-ab14-79762bdf71ef", "value": "1536:RyEGawglClgrpNfpL6/wLhLrbM5KBdu/D5Gg9KZZMx2SbRkr:RfGawglC0pNBSwdHdu/D5NK4+r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747380436, "uuid": "efa9e85c-66a0-4696-a31d-00c796da2332", "value": 76604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747380436, "uuid": "91fba0d4-0d28-42ec-889d-98825dcff6fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747380436, "uuid": "50561e09-ab44-4183-8e01-23cc401ed656", "value": "gmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89146b38-3277-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747414943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747414943, "uuid": "dfd9c3d8-1606-4b41-bf63-bbdbcb5f8d4d", "comment": "Malware payload", "value": "1d0130e86759783c30222a379ff3caac", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747414943, "uuid": "5b1c78ec-040e-4b0d-ad88-7f880e49925e", "comment": "Malware payload", "value": "61a704a72bffa9a327a884f4f8cd812f114ea400db66a85988528e08b583ddbf", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747414943, "uuid": "23186b46-c327-4c5d-be46-23b51c6fcf18", "comment": "Malware payload", "value": "71dc06656ac25287f340f5bb308fe667399e3f87", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747414943, "uuid": "d4205dba-27f9-458c-ade4-8a380c8d8e18", "comment": "Malware payload", "value": "040d045852c0e39e3910fd4f689a567908c92e3f95b21269fe912a3ea3bcc604a501a9c86061150a265e3f39954165da", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747414943, "uuid": "fc473ca7-0a24-444d-8a18-1b6240260d7c", "value": "T1FFE73359BABBC52AE837C032A8958221B1154E0487D3E2076754BE6C9E77FC44F8BDCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747414943, "uuid": "7ab1c4d2-6060-4b71-98c4-2114c23e4844", "value": "1572864:YM8A6qnRhpE8X0IwlnyXmbkf15288X0x5l:JRhpE8k/03l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747414943, "uuid": "0b55572f-987b-4848-a8db-e57203ce66cd", "value": 66425571, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747414943, "uuid": "5d27607f-3190-4344-bf30-d0f0fc2e261d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747414943, "uuid": "d5fa2397-1329-405f-a265-ea955a273365", "value": "61a704a72bffa9a327a884f4f8cd812f114ea400db66a85988528e08b583ddbf.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d03223c-328b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1747423485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747423485, "uuid": "212238af-da1f-4d2c-9baf-77a717a838a1", "comment": "Malware payload (Prometei)", "value": "5f8ebbdf2c70cae5f18e10d3fafa0d0e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747423485, "uuid": "fcfdaed6-1e15-4865-a36e-7a8ec4641a4c", "comment": "Malware payload (Prometei)", "value": "620a7d8bd579e36220943787b4d43253afe1654287587f5e139c0182ee2d74d5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747423485, "uuid": "7d8d6c87-c03c-4d3d-b7c0-db2e64bd5263", "comment": "Malware payload (Prometei)", "value": "a5e50421b28d7bc6f468bbb83be65d12f4b1111f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747423485, "uuid": "75b77ab9-ec73-4818-9a2d-d945fb7b950d", "comment": "Malware payload (Prometei)", "value": "47435bcc79cec191246691848bc4e945d5980461a6d74f1b74761dbeca9b21b5085cb3030d2ce91cdefe8476e10988ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747423485, "uuid": "84a1ed40-cbfc-46c4-92b2-487d2da48b93", "value": "T1DC9423F8C83D2E3098169B3CBB1A826CF0E15772D9562F6EB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747423485, "uuid": "1e9d0e4a-6278-4b0c-82aa-e2d4918a47a1", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgn:25WOSACZSV6eKRH5EPiamb4DsDwwcX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747423485, "uuid": "214a591a-b93d-4fba-88fb-f83e28c744fd", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747423485, "uuid": "b1631974-aa4a-4718-8e6d-9a77929437d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747423485, "uuid": "aa921c4c-3d03-492c-b921-68e8f201188f", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b9dbe0e-3220-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747377446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747377446, "uuid": "c691e2d3-4b63-41b7-97ee-3dac1ff27441", "comment": "Malware payload (Mirai)", "value": "2dafd5cbfec610bba25d5e621488bd79", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747377446, "uuid": "a1f61c42-95e5-48c6-8d15-17eb813c51c2", "comment": "Malware payload (Mirai)", "value": "622a88831d43b8e8063961653d5c42d33acc8470157b8d4bc35bf213b6f0495d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747377446, "uuid": "c05ef051-83a1-47eb-8153-60f0bf71366c", "comment": "Malware payload (Mirai)", "value": "46e333631bf5f4a41d597a74ee33a8d33f7f162f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747377446, "uuid": "2a49e8a1-3d05-4f28-bab9-9842b8bedcc0", "comment": "Malware payload (Mirai)", "value": "babbfa1d7e46f8911d6d2b6ddc6804bae2cf7d731f813d0445e550a79bba6dd08174171613ae25196f4fe7869377e2bf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747377446, "uuid": "b7d6db45-d7f3-491d-b7d5-c50ee08049ee", "value": "T1AB332B03332C0F17D9961EB0253F06E083BEF95126E5B68A195FDB764A39E761082F9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747377446, "uuid": "67108a3a-a73d-4d40-96e1-a799c33f9dc1", "value": "768:lEyDRQL0NLBZkjRaNFO5q8VUYVA6LOe1Z4LIHPIRYbk4y0wC3ryHcYdk/Gmu:q01NDkjhWBPe1ZMaDy0wYrudk/Gl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747377446, "uuid": "9daf3057-5e03-4553-896a-5169d4911da5", "value": 53313, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747377446, "uuid": "468c1519-7f4d-4f7f-bd09-6d27b8ecb751", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747377446, "uuid": "31541f77-4738-4ce2-a458-f306cd1d31cd", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "158d0162-3267-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1747407877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747407877, "uuid": "cfe78880-6349-45e0-96dd-3724bcdcc1df", "comment": "Malware payload (Prometei)", "value": "7f82c71120b7adcd7bd3d7ec1d8a58f8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747407877, "uuid": "296b7ad2-c6a8-4d7d-9bdc-c392474778ac", "comment": "Malware payload (Prometei)", "value": "63161d4e5ac19a3bfcc7f722005456d4fc0034c8a8e1276d3bc6235c8d11ba9d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747407877, "uuid": "f790d50a-57bc-467b-83c6-01e8d6f03bed", "comment": "Malware payload (Prometei)", "value": "df455058d2f87a0ef0e27ae18612b55ff5fc95fd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747407877, "uuid": "eb92b1d7-0b75-4669-975f-0f540420722f", "comment": "Malware payload (Prometei)", "value": "5b0fefcf4a513bf48b7dfed15dd520833406a2d14fd0990fe39e7d4822ce84a94dcfa9be164898b6e52e008f3c4f46db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747407877, "uuid": "9aea9085-b240-48b5-8a94-8b637906ef86", "value": "T11C155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747407877, "uuid": "baa52bd4-28fc-44ec-a1fd-fd7d776f6aeb", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8MplJ:qmShf4OTjMgXSJhBXEsVrmz9MOup1Kh+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747407877, "uuid": "9d68aaea-1f85-44a6-9b89-a032aa499f3b", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747407877, "uuid": "3254cb87-2965-4673-88df-f20c40bb1d1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747407877, "uuid": "efb5221b-390c-4e05-84a3-add99979d7d0", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2923e35-3228-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1747381055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381055, "uuid": "93a81b1a-7dfe-4171-b2e9-7a2c67950e2e", "comment": "Malware payload (Gafgyt)", "value": "58bdaecf0d385942274596126c33269e", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381055, "uuid": "0309827c-2ae3-4b7b-a390-d84877d547c7", "comment": "Malware payload (Gafgyt)", "value": "6317a7241ac4bf092366f1cf50c814a8adf15b4c67493dac44bfef6a7947e50b", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381055, "uuid": "9a6fe1f6-a863-44be-895a-45366c9bc560", "comment": "Malware payload (Gafgyt)", "value": "a6ebda4413a5a2300c4bffd7acb1f88df0e43251", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381055, "uuid": "595b3d24-76bd-4ef1-aca8-fac1296e10d4", "comment": "Malware payload (Gafgyt)", "value": "88855e131df551515558df57bf6bc38010ad3cd5d65633413adb24b80ae8dac44314b0a79d13e333e990b450c93293c9", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381055, "uuid": "2b128933-856e-49d8-bd33-72a4387eb0cd", "value": "T10A3186CB21A63A787CA5ED2F72BA4D4074D4E08A15D76F899DDC38E941CEE08B444F93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381055, "uuid": "61e977d0-9ecb-435a-82c2-925bc35df1e8", "value": "24:vCcUC/TcsCMGCL2cJCdaSCB3C2yCt/CYwCmfsC6OCg1QCGh:vEWTcsJGMJCaSAc0gYJOF1Qj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747381055, "uuid": "c15381b2-0448-419a-bb56-f1d94f3a10bf", "value": 1702, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747381055, "uuid": "da942c6c-f3af-4556-826b-992da817f8ec", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381055, "uuid": "fe573a83-3085-4a80-92fd-3a59e2f3d5a9", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5079f1fa-322c-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747382635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382635, "uuid": "310350e6-56d1-4ca4-9149-2f70a810143a", "comment": "Malware payload (Mirai)", "value": "7035bfcf33ec44b0d2a4dd3d7bf43ad1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382635, "uuid": "bfc51c9d-6576-40c7-8c90-f5d688ff2fcc", "comment": "Malware payload (Mirai)", "value": "637a697a07231300dedd5df49ec4ab00d33fb8b659d2a2e03c55bc88eb68ae2e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382635, "uuid": "f8b8d6be-a4a8-44da-9060-31e1dfc3fea5", "comment": "Malware payload (Mirai)", "value": "502fd5b978af204b27724bebd0d37bd35c79dfaf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382635, "uuid": "c3fa734e-36b1-4cbe-9389-9d3109d1e202", "comment": "Malware payload (Mirai)", "value": "20a8c7b66935a3cb13f0e962e8b9684abe1896d483a561a9b04295b407c45fa285e40063a5814cdb2216989d975a645f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382635, "uuid": "f35dbca7-1d00-419d-b26b-7eb98b5ce976", "value": "T142E2E130C0692DA7EFDD5FA14DD497E0A3E40F58B7D4CEE489AD9E0163422632D46749", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382635, "uuid": "dc5ef050-83ec-4e69-98e0-6e3641a4ee06", "value": "768:+Qyq0U0odb62r8A02TBbuK3ztjbOYYyxhemun6iqXDrdk4uVcqgw09W:aq0U0odbKA02lp9xQ9nu5k4u+qgw09W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747382635, "uuid": "2c049acf-4991-4b78-a1c7-72ebc1f45819", "value": 32848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747382635, "uuid": "bfaca5e3-9b33-418a-9f86-c06bc9477208", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382635, "uuid": "7aebaa50-e386-4b15-81f4-d467b723afc2", "value": "neon.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8323275-32a2-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747433490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747433490, "uuid": "bf1c373d-4919-4645-ba8f-281eb380e7f7", "comment": "Malware payload", "value": "29953bbec2d7a4c58c31a034efc8e7be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vgszf", "colour": "#2A4731", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747433490, "uuid": "b160e7f1-4051-4c0a-bf43-30e8220a698d", "comment": "Malware payload", "value": "638bfb452ad5c2ce2bc9aab6a7dd65665b886d79abd1ce66e617d33781036764", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vgszf", "colour": "#2A4731", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747433490, "uuid": "90924746-e422-43c0-af04-2c18832a030f", "comment": "Malware payload", "value": "139448c6c1b92988b1914fac83f40af287c95d63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vgszf", "colour": "#2A4731", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747433490, "uuid": "2c952212-321c-4da0-9a52-e50ca3d96f3e", "comment": "Malware payload", "value": "1066f05dc20f9977e6484747a0dc940436d62000650ece320c08e7955c2e3d590c7b38a3db3998b7907e97421d4095eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vgszf", "colour": "#2A4731", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747433490, "uuid": "06b360ca-8568-440f-bc6f-9df62edc8b12", "value": "T1CAE36C53626415FDD19BD239CAAB5A66F771B846032287CF039082761EB2BD07F3E352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747433490, "uuid": "be7dbfbc-4e6e-4948-a07b-54223d17fc65", "value": "c43a23fdc659ff0c38c8a234b154ad4c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747433490, "uuid": "61e6356a-c1cc-4b5c-9e28-24a3aeb6947e", "value": "3072:ref+LkSVYYSHWUnkXlfLa12D3H1M7CPizU312D3H1M7CPizU0jqZqe:re24tYS2Ik1WQr1M7rU3Qr1M7rU0jqZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747433490, "uuid": "2f7fa4d4-0413-4b6f-b989-cfe33fd1c389", "value": 155136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747433490, "uuid": "a6ddb876-fb3b-4f19-a6f8-16bb219c53aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747433490, "uuid": "d3611b39-d018-437b-9797-905aefce60b7", "value": "mapper.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5abc73ba-3235-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747386518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386518, "uuid": "25685ec2-5bad-4dbe-89a8-2a0cd539984e", "comment": "Malware payload", "value": "348c8b48a541d6da0090fb1bb6a36083", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386518, "uuid": "d877aaa2-2645-4067-a49d-0116b98e9e73", "comment": "Malware payload", "value": "639e824e329c429a53d0e64f3a4f254131443a669da93a59a755fb7171d49745", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386518, "uuid": "69f07255-d4d4-47fc-96b4-571e20efd037", "comment": "Malware payload", "value": "6d88a8dc1718aed372c0c0826c8fd19441563b44", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386518, "uuid": "a68b1174-8746-4d79-ba53-37e8c9949a84", "comment": "Malware payload", "value": "ef2744cbefb1d22e43f5e8eaea36f180f125151e5bf6b535d9a1a834268c66b5aa7e5b129afe6b2878e64eb750adfea4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386518, "uuid": "e144f3a0-9e98-4852-b555-69e9c2e1fcba", "value": "T1F05123CBB0D808F01CC8B00C5CDD159835A8820711A5AEACBC5AF95DEF3849E52F87AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386518, "uuid": "319bec81-5236-41f0-9745-ad23fa9a4274", "value": "48:lzBtwj46ePFm0NIflgbgFpbs4NLEpKc68IX389cKUL7JO2NJFyARMaXOUz3yzxkM:lzz+XePFm0UlpAwdH8iKUL7YyVYxkm7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747386518, "uuid": "59cd050a-0f46-4a88-b203-4f15ca10a9c4", "value": 2693, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747386518, "uuid": "75a3d8a5-0126-43a8-b0ba-d42eb05eb4fb", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386518, "uuid": "1794221c-8940-42a5-8147-9063a7ff048b", "value": "fSidEOWW.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c56dab53-32a8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1747436089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747436089, "uuid": "5850212f-a3d5-489a-8cf4-a4eb84bb5e06", "comment": "Malware payload (Prometei)", "value": "fa44ba820e4f69b4b286ae516ee6d07d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747436089, "uuid": "270ea0f1-2e2e-4f3e-b3b9-f925dc8ac2ce", "comment": "Malware payload (Prometei)", "value": "63ea84c95693aadfe5bde0aa72aa2b9ce9ce6a7c46e372c3c08119d28018f515", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747436089, "uuid": "d35dcb81-de30-4a57-a4da-071bacb845d0", "comment": "Malware payload (Prometei)", "value": "f6839769fbb755268d7a05441444389db9bf3cc7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747436089, "uuid": "1f3f7405-c5db-447e-ad5b-397e0bcf3461", "comment": "Malware payload (Prometei)", "value": "c80deaed7f497a51ac6966f906955bc9e5fe669ee8f72a60174ef1f69ce6246059654f232177383198f7fc9c32799b17", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747436089, "uuid": "42bbbc9c-1596-48a1-839c-09958b3a58a5", "value": "T1059423F8C87D2E3098169F3CBB1A826CF0A15772D9562F6AB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747436089, "uuid": "a88cfe2a-6cd8-4281-9877-5ca1d205eec4", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgm:25WOSACZSV6eKRH5EPiamb4DsDwwcW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747436089, "uuid": "0ff82c97-4408-4c1e-bbbb-47dcdaa84798", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747436089, "uuid": "6bc229b1-623d-48f9-9f01-17215799bf72", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747436089, "uuid": "d95b8d39-5483-452a-bcc1-241055eea048", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ed06838-320f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1747370231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747370231, "uuid": "54a158a6-77c5-43b2-9444-fb2f94e2577b", "comment": "Malware payload (Prometei)", "value": "2045af5a8f69086ce781b4121587f0dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747370231, "uuid": "a2c8c95b-a351-445a-8bd7-2f674de7399d", "comment": "Malware payload (Prometei)", "value": "63ee770238e3598a4c5f514b02eb9695cc8b664ed1a12b63d0b66a3fc1336cdc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747370231, "uuid": "ac46f6a8-0853-4217-aac3-01dce3f0b50a", "comment": "Malware payload (Prometei)", "value": "98945b4413d596a8fcb552189b6fe0bf8edaaade", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747370231, "uuid": "e6388249-3f00-4657-8ccd-ee2a7201a814", "comment": "Malware payload (Prometei)", "value": "7e38c6723c11f0d5150bb83d98f62d9620d9ad84f780bcab8d9066699ed80a37ec09cea4039444eb5571660c4e06a24f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747370231, "uuid": "29b841c1-31b3-4f08-abd0-c6c7c8bec3ad", "value": "T1DE9423F8C87D2E3098169F3CBB1A826CF0A15772D9562F6EB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747370231, "uuid": "114bb962-75f9-4b3c-a2e6-3198c26cc865", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgO:25WOSACZSV6eKRH5EPiamb4DsDwwce", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747370231, "uuid": "18a68466-31b4-4c44-b52f-397b4758a867", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747370231, "uuid": "15a81b33-c0a1-46ac-8756-ccbb702e5f77", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747370231, "uuid": "328e9dfc-6372-42c3-9360-213d6383d246", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e7051b0-322f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747383840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747383840, "uuid": "66e5e7ae-857a-4b82-a6bc-bc625a9fed50", "comment": "Malware payload (Mirai)", "value": "5465dbeac50989c883454a49384b394c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747383840, "uuid": "85adfdac-981e-4075-93cc-44ae868d44c3", "comment": "Malware payload (Mirai)", "value": "63ee7ba52ec735fdb92db76a33102d6b85fdbaf9f7e5b8ead474cac8a9d71901", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747383840, "uuid": "ba4162b4-a868-4415-bd94-b50c8fdb9bfd", "comment": "Malware payload (Mirai)", "value": "bf1e32afeeedc33ce00886d4475e8058aaa67bc7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747383840, "uuid": "e42e9724-4dac-4216-8554-ebf6179c2911", "comment": "Malware payload (Mirai)", "value": "2f9b1938c418065942013a3f97a9647388dab8e85be00b1805543aeafbd905cb0882fdf2b31e719ec6b1e855f4754ec9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747383840, "uuid": "86b11510-fcd6-4c61-b68e-6abb53b23dae", "value": "T1CA735CD9A8025D3CF84FE6BE94224B49E920331557D30F2BA69EFDD3AD731649E01D82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747383840, "uuid": "b8d680ff-a2c2-4a56-a642-39193265adb6", "value": "1536:WHDeWyl9edhLXxY0qwyagBdbrfKJ0FG8YF:WjeWy+5YFwjwdCJWO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747383840, "uuid": "9546e0f6-0a12-44db-9723-c9b1d100b710", "value": 78816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747383840, "uuid": "6aff0df3-a3bf-474b-b479-85b8035dedec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747383840, "uuid": "84aee179-f9ba-422b-bfd9-54a446b7184f", "value": "UnHAnaAW.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55b13242-3251-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747398535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747398535, "uuid": "e0b95ffd-8d00-4b76-9b2c-f2ad54cc4d9d", "comment": "Malware payload", "value": "1d4b3fa2ca023b274d6f507d74f6ab86", "object_relation": "md5", "Tag": [ { "name": "InvoiceXpress-zip", "colour": "#B98988", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747398535, "uuid": "e8ca26d3-fac2-4dbe-8646-4dc98c1a91fe", "comment": "Malware payload", "value": "640290f746a3f5cbb876c89ab54dbf45d6b2fce34a0959354338d6cfa9e05c00", "object_relation": "sha256", "Tag": [ { "name": "InvoiceXpress-zip", "colour": "#B98988", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747398535, "uuid": "63bfd30d-4c68-4a78-851c-1ad75c25bd54", "comment": "Malware payload", "value": "18babfb721a904422e17b52da02b0b6c360f3928", "object_relation": "sha1", "Tag": [ { "name": "InvoiceXpress-zip", "colour": "#B98988", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747398535, "uuid": "6c822263-8640-4283-a12c-a801c4462376", "comment": "Malware payload", "value": "d2c0ccbfdc907a8c7998f5ed96819454004d78c895ea128ee7a1139c829b64b2ddabfc6afc21cc4648d398ee34adaf9e", "object_relation": "sha3-384", "Tag": [ { "name": "InvoiceXpress-zip", "colour": "#B98988", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747398535, "uuid": "00e117b1-775b-4d99-b72d-be0cda1d757c", "value": "T1C7460227AEDAD528DD6744B379C28241643F15E8BE0BA07F13905DC58A60C8B4BD2FED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747398535, "uuid": "99117026-a718-47dd-ac2e-0327c91c93f1", "value": "98304:GN40q4w9CSCRjZgMdaJ8IPvsyxgxsiAbqnlvDhaJLd3lLJcloRVPIiX8r9V+f:E5eC0dLPvFmdAbqlELF8uRVQRY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747398535, "uuid": "302ca12d-3d24-4f72-bf37-43666bcf3e2d", "value": 5580343, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747398535, "uuid": "5ff12e9f-a58f-4daf-8613-d75e26d76eb5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747398535, "uuid": "437c11f1-236b-4a46-bf60-019cc86f07cd", "value": "InvoiceXpress (3).jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "147e1f93-3236-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747386830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386830, "uuid": "23846c4a-9827-4e92-a670-39a100edf41f", "comment": "Malware payload (Mirai)", "value": "2429d4e1825d481cc8c01150fe7a738d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386830, "uuid": "adea43df-5f8a-4caf-9a93-098ac80aaa5b", "comment": "Malware payload (Mirai)", "value": "641eecf750c1d3af733a6ba2bdd380fae3d8b56aa8f7800157ad0d9477fed887", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386830, "uuid": "e2f503ec-cfa6-4ef1-a656-52fdab84a542", "comment": "Malware payload (Mirai)", "value": "b6064338d0a95eb89dcbd8cd74b0560932e3de96", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386830, "uuid": "f925a7cf-e442-4f81-bfae-647e964e5755", "comment": "Malware payload (Mirai)", "value": "6d256eb569e022673fb2994d2f3491317f543554896a1eb6c9822c8ebb092d83363d20285f6f089546573f06674e3474", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386830, "uuid": "001f752f-134a-4eaf-bea4-b5b0ae300fda", "value": "T1FC438D32D4280E59C1051570665DDF7A2F93E1C5A3A29EB313A543B6E843F9EB809FEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386830, "uuid": "f99e084d-53de-4e3c-83ce-d5a0e4d7eea0", "value": "768:Ra/Wtynv4eAylKNTjF83kmt27SFV659GpEXbH9tsmkRLJVIL2CRGoBlLB/CU7w:Ras4yjFPm+SFpET/kRL0L20Br/CUk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747386830, "uuid": "e34b73be-7e35-4c15-9097-66a4afdbd867", "value": 55524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747386830, "uuid": "426fd137-ec3d-466d-a420-5db6aa344d16", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386830, "uuid": "3f9e7121-910a-433d-b46a-c972bff6011a", "value": "Mozi.Sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "741d3eff-3276-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747414478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747414478, "uuid": "2c063673-8202-4826-a000-02f59d3518b4", "comment": "Malware payload (Mirai)", "value": "37624c91c2e8236db6752d67825b5ee6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747414478, "uuid": "54f66286-ebdd-42ae-a1e3-d52ddb93f411", "comment": "Malware payload (Mirai)", "value": "6443ac1a5d36a272e791389108c38506213a8c336b1a224f9130a5cfd72ac6a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747414478, "uuid": "f28872b7-047e-4463-8715-ebeccc2c5261", "comment": "Malware payload (Mirai)", "value": "45f49301602750d0550d307d778bc45193d81369", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747414478, "uuid": "74be3429-2108-4ced-9d39-7c871598e5dc", "comment": "Malware payload (Mirai)", "value": "e6fed5834f76b7581818a6e44ab89ce5d8e816b246649806398ce0ad3247bf34920aa4e4ebb69a34923288a59f4f438f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747414478, "uuid": "36ea7413-1be7-42b0-9136-09d5bd7fa9d1", "value": "T12404BEB3B74F1491C86106F81BCF9F5D2A3351426E1B86E76CAE323A2A770CE59067D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747414478, "uuid": "d626e993-fc99-40a3-a362-a5c9550953e6", "value": "3072:wn47vOnN2gkCdBvxAI2inFHQ6JcvuZ1SdqFjfogbCw87TjGZT1dq:wn4WxdZSOFTJayS0FT5CX7Tj61dq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747414478, "uuid": "f15bbcb7-2571-40f3-a1d1-1f15d605eb9b", "value": 173592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747414478, "uuid": "c4281962-4a2e-41eb-a9d2-92e12fe5b232", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747414478, "uuid": "f43cfd36-1698-4d1d-8328-83bd0109c40b", "value": "neon.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a55c58c-3264-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747406650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747406650, "uuid": "e6e74e60-2a0f-4123-8947-1f0f976c7118", "comment": "Malware payload (Mirai)", "value": "3ab2bc08045817234257617f8a1ee5b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747406650, "uuid": "530aeca8-fe58-4a0a-b375-bf4d3c961550", "comment": "Malware payload (Mirai)", "value": "646359767d65f23b7dc289121169f00027c8e0ae4ace14f3da4d42d64b54603c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747406650, "uuid": "ad8dc9dc-d869-4f8a-98b2-4973315edaea", "comment": "Malware payload (Mirai)", "value": "378ac1182d301858091865c090f0170c80ce6a11", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747406650, "uuid": "0b388768-00d5-4190-8a9f-b50cfab1f684", "comment": "Malware payload (Mirai)", "value": "cfed10978b9bd674ae00c51f800567d5c5ff54fbdfb738b6524332d805c0dea4bf2507c7e29a30e9931985e7e2223ac7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747406650, "uuid": "04f8792c-eb0b-4767-8926-a9e4c1c2903f", "value": "T17BF2D0309594ABB196718D72EF2F024232974FEE8056232416599378EECB03F75BEC99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747406650, "uuid": "c9ccc559-a28c-4b75-bbdd-430d59166f8d", "value": "384:esoMGNYU5Uq6PWZMw+j65fAhkBSsKmmYngYPfbd9l3av5agghRRhzSwyCWr2/hyG:es2Fmq6PWuj65fxPfbYmTvyCxs3UozE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747406650, "uuid": "219ac13d-b28d-4427-80be-9b5950e4ec8e", "value": 35016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747406650, "uuid": "2e1c3f4a-8fe1-475b-89d9-f5784622758a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747406650, "uuid": "5c47f75a-5a2b-4664-a371-9c6f0427552d", "value": "neon.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7447757a-325a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747402452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747402452, "uuid": "ba7648ce-894d-454a-ba56-e5920d159604", "comment": "Malware payload (Mirai)", "value": "35bdca84ffeabf2fb89acc2d273a0b2e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747402452, "uuid": "a1d0b9e4-8c5f-44c3-8d4d-6c64f107654f", "comment": "Malware payload (Mirai)", "value": "654eae00d640a259b84731e9897f028fb951f68413fea90e2cf0dcba35f245f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747402452, "uuid": "a88c2c0c-7cd8-4743-8cd1-1aafc172e877", "comment": "Malware payload (Mirai)", "value": "636b251815287c9c304da702318ae5265daeaffc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747402452, "uuid": "5f3d57d6-bda5-44a3-a051-c85795010dcc", "comment": "Malware payload (Mirai)", "value": "004751501471b44e3d746a74ef972e24ee60680fdf728593526715524002076490d0a40fd1360ad206db83fdce42b5ff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747402452, "uuid": "fa5923f4-7876-4f5e-a594-9de16027f9e3", "value": "T17E3302D00762178C8365D9793CAD301E8424251F32EA2D102D9BD18FF55B726ACB6EFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747402452, "uuid": "eabf6d28-6c2e-48c7-ada0-523c4aa37bba", "value": "1536:87vbq1lGAXSEYQjbChaAU2yU23M51DjZge:8D+CAXFYQChaAUk5ljh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747402452, "uuid": "44911dc9-5872-4e3b-a1de-707b2e3718a0", "value": 50760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747402452, "uuid": "8b3049d9-2860-4426-8036-fcc2595f190b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747402452, "uuid": "9fd20edf-e839-4785-bf3b-06b86aa7f0ef", "value": ".i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93809381-322b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747382318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382318, "uuid": "64a7e329-53f6-47c0-aa6f-9e47ed3e6b9e", "comment": "Malware payload (Mirai)", "value": "935a9598e78a194abfb7b1e666f70410", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382318, "uuid": "9cf9700b-0d97-4929-99c1-b969056ba492", "comment": "Malware payload (Mirai)", "value": "65506b27812f475a3cc4a5ebf620dd42a47630ab515e853178c0747afa20f4d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382318, "uuid": "a6161994-4f4d-4f76-93db-b2cad31d0217", "comment": "Malware payload (Mirai)", "value": "630b4b202e9fe192df3f12d3e7bdc9b30a00795e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382318, "uuid": "2a35c5e9-d760-4f80-adbd-cf76d1385758", "comment": "Malware payload (Mirai)", "value": "d30251eef9d914cff65fb45c10388e5045d9f0e2ec431a5bf5ea2d714790f03069f69573d8a9b87c2e89cd93f7c44e2c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382318, "uuid": "654766a1-6cd8-473f-98a0-edda84d36967", "value": "T11304E71676C38CEDC053C7B55A8E946B71B0F12F822E503367B1EAA03F1DDA1A9A7351", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382318, "uuid": "1bcb83f8-dffa-4c36-991f-5fd37e1894eb", "value": "3072:6D2nR8chKhMScJqCKTqoE45zM5NCUXAWBlbZd+C6rpqPQmPOLVPU8oJDHX:F54q8W45z+Pl7mrpklPOLVPU8oJDHX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747382318, "uuid": "7884687f-02f1-4f69-8cb5-c92c5d6466ae", "value": 175488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747382318, "uuid": "38059e3d-2f0d-4c97-a59a-bde19a07fac6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382318, "uuid": "22c9d205-dda9-495d-892a-49c102dcb22e", "value": "vvglma", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb0c0161-3227-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747380667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747380667, "uuid": "9de6fa9d-961f-4272-900b-f16fcd21209c", "comment": "Malware payload", "value": "3c6a70b2f841503980b9ebbd3d49717d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747380667, "uuid": "b0148e7f-28e1-4c5c-9e0e-00d2a552e37c", "comment": "Malware payload", "value": "65cfbc6bf37685996beff8734ddb7df6db502be6a4f6b9d2ab01a6d9bda33898", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747380667, "uuid": "6197eb0b-e86c-4fff-8315-9feea6c3fea6", "comment": "Malware payload", "value": "406998490e7ee2fce78ad91f0c650f3eda6a3f89", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747380667, "uuid": "583cb3ac-468c-4cde-8a74-d79c98fa995a", "comment": "Malware payload", "value": "e33c62ca7d873cd86146fd538f2a918123659a65c77940cbe13cd6a2f9a2d7eae5eaa5a60aceb567b70c8861e09d4039", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747380667, "uuid": "f89baf7e-ec71-4baa-ad2e-fbb3d9c17c27", "value": "T1AC264B6396D74CB9C9D7A7B476C313766738FC248F396A2F5604C9212E43AC06E1EB90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747380667, "uuid": "f012652f-0783-416b-bd2d-44d82088a234", "value": "380e6757582731ea614f4f226e5a2d10", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747380667, "uuid": "fa987ec8-6560-4649-8ffe-4104869b1201", "value": "49152:5AOOsd2+05XfilqUrIqCtwqojyotYoqcYmkkZ4uq30oUjmnlyUE0LgqmD2lvm6qm:5VrxZ4uq30oUjmnlyUE0LgqmD71pwnL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747380667, "uuid": "e5a1e1ae-dbb7-4f15-a732-d73508d0bec1", "value": 4469979, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747380667, "uuid": "43f47817-999d-496e-a28e-8e114d25893a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747380667, "uuid": "5106cc9a-655b-44ea-938a-458d0bb693d7", "value": "SecuriteInfo.com.Win64.MalwareX-gen.29154.25409", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58b922d6-3233-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747385656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747385656, "uuid": "b2952172-0524-48d9-b2e0-26cb22892c1a", "comment": "Malware payload (Mirai)", "value": "196230f125b20f54eeafd36b30fb9ccb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747385656, "uuid": "4424b28c-46c9-454c-8bd1-7a7e68a63215", "comment": "Malware payload (Mirai)", "value": "65e2de0f24ca11d9d58bd340b32e0430d9af3c02924359cc523e79534e1e0ad6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747385656, "uuid": "95bbff57-4b8f-42f7-b69b-5f17c2023002", "comment": "Malware payload (Mirai)", "value": "d5686e6e491a675e51cddebd7b7ebcc518a7446e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747385656, "uuid": "bf714969-442c-4259-b2b6-4646bb75d1fa", "comment": "Malware payload (Mirai)", "value": "69259eb85b5084030de169f1c75efb8a0d15f6269eee07bd68963f6156fe01ea2e0f39ffb852d3b013619a3b2c2dcc69", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747385656, "uuid": "5aee2a0d-7a98-47a2-a3fe-9632a4cd6948", "value": "T139633B55F8819B23C6C1027BFB5D028E3B2613E8E3EA72079E25AF21378751B0D6BD55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747385656, "uuid": "4f477f4d-8842-4fdb-8ebc-4e700dfec6ad", "value": "1536:jBfg7LJxeGQPRHQPUhC9rIdooXEMK7vE+:jBYXJx9mhCWmtE+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747385656, "uuid": "a59aa715-c87c-4578-9111-b061d1c93ca2", "value": 72920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747385656, "uuid": "fea1a4cf-0b16-4da6-9e42-a741d6f7f2be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747385656, "uuid": "c00582da-6412-4a5f-ba91-03ba8d9219d5", "value": "neon.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5966113-327d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (KillMBR)", "timestamp": 1747417648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747417648, "uuid": "1d3ce9b1-9f13-4efe-a898-36f51a58d854", "comment": "Malware payload (KillMBR)", "value": "63d835764d036db9502a8fb315895b66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747417648, "uuid": "3aaab980-4b35-4b94-bc63-32301668184d", "comment": "Malware payload (KillMBR)", "value": "65fd5041c1a1c4115b0c59995221023486f02e5e5d8e313c3e48f3a42ef9a623", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747417648, "uuid": "b3d1364c-7ed8-4b04-965e-1b1ceb2112b2", "comment": "Malware payload (KillMBR)", "value": "7c4ba2d13098df8d56b587eab64c0a450da624ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747417648, "uuid": "5a179315-4128-4b67-a246-8c3fde585c59", "comment": "Malware payload (KillMBR)", "value": "4f5d4850793f83864588d232e254eef6a5983238e189560c4821dfcb8cf740bce8d85d972ecd8c4cd66bd5ec65d0ab42", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747417648, "uuid": "fb8bb2b1-a95c-4f68-9004-5adc82e495cb", "value": "T19DE318DBBB959C97E911433C05D68329233EF7D09B834B131E24BA355A13BE07ED624A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747417648, "uuid": "ee3a4ce8-a662-48c3-bae5-739cd79509e6", "value": "24bde11bd72542d361212e5651d435d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747417648, "uuid": "90c6b4cb-1ddd-4554-b48b-324ab69b544a", "value": "1536:rijjhUZ5OSaY6kGsiyFmaEXRY1EeWEawTztRmUvMFMQiNARVc2YwpMwuy5:rrZEkHoY7awTztRe5RK2Y7wuy5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747417648, "uuid": "5b39f080-450f-4d44-8dd5-486d4f801473", "value": 149579, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747417648, "uuid": "01375363-3648-40d0-83cd-c20e10f3a2ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747417648, "uuid": "6539fc53-0f61-438b-a04f-bc076d2019ae", "value": "ASiANoiAndRO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "527ad2bc-3222-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747378344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747378344, "uuid": "3be677c4-6a5a-4113-afb5-a0f6a66eecdd", "comment": "Malware payload (Mirai)", "value": "373a787811191d8ee95356d6ff9733aa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747378344, "uuid": "711619f3-bf5f-4718-a562-882fb0b0588e", "comment": "Malware payload (Mirai)", "value": "663c0b7f6c57663c0d72e9ed2e759e30c3abd8b0989005a00ef70c857d369651", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747378344, "uuid": "d3222c54-8e94-4b43-8303-91ede1c784f8", "comment": "Malware payload (Mirai)", "value": "53a7599ef3a5e40bd221666d637958258f2ef320", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747378344, "uuid": "1367d0fc-47bb-4517-9aaf-3ce07cdb6840", "comment": "Malware payload (Mirai)", "value": "1424dbe2d6188640bc664444830f26fe56841399490e15079c35c5f34f6dc3fdfafa0a0c2e6403219c52fe6afa5a900e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747378344, "uuid": "719ec67f-7568-4c92-9351-41e2bb18e97e", "value": "T1487339CBF800D97DF80FD37B4467490AB930A3D117831B2B7763B967AC761A54826E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747378344, "uuid": "7f67f41e-0737-4cd4-88d9-577cfcdafdaf", "value": "1536:6MmEUGWAW0448CnlA9q0k6Q98cmlPICqqHXC+VJJFSqqc5UnukGzliP:6lEUHzm29Dk6QR2gBYCUJfMnukGRiP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747378344, "uuid": "f8fc31dd-2c26-4b16-93d4-863de2d218d5", "value": 76188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747378344, "uuid": "30a9f948-acc4-4568-a90a-23aa39b27871", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747378344, "uuid": "dcb78573-3700-44b8-946f-4f681acdaebc", "value": "neon.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ebf1aef-31f9-11f0-8bd0-42010a9c0005", "comment": "Malware payload (GuLoader)", "timestamp": 1747360809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747360809, "uuid": "7e9da960-50d6-417d-87bf-77d7443b2e78", "comment": "Malware payload (GuLoader)", "value": "9a57c83b3ae8652ebc22ad72ffef5ea5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747360809, "uuid": "5ad57735-4eb6-4a68-8fbe-ee2902e40560", "comment": "Malware payload (GuLoader)", "value": "668b34fae64114638c8c3320885c2baa4addd223587bb9ecf17292ee83ead09e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747360809, "uuid": "8f964364-a33b-401e-8a96-4671dd9c188d", "comment": "Malware payload (GuLoader)", "value": "80756ab0bb1b55542d5e50dea1f9c195b4ff9e27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747360809, "uuid": "f9a8205b-c8cb-4e08-902e-6d688536e09b", "comment": "Malware payload (GuLoader)", "value": "cadd97786ca1023dbc59fde2782a59681580a1a77f903738b93d907446db2926094e835e7bddf59f4e45ab2aa1ba27f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747360809, "uuid": "abebd5d5-b335-4b7b-9b0c-419c8d3fa834", "value": "T12415232977C5D226DEAF0F3235C228726AB885062CAD228FFFE0DD5D7801115DD6672B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747360809, "uuid": "1a99e8b2-f700-40fa-89c3-2325ad99681a", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747360809, "uuid": "95e28813-eb19-45b5-828b-0c4c472c3b1c", "value": "12288:4gyJrk+RF4fT+Zvg4xpUQhEgGvVKTr95UE09QLnxe8L2zP6Ni27ITrY7YDft7js:4gyJrbRy+R7RyVMhCK7U8gYi27ITYG4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747360809, "uuid": "e8640cca-d390-4438-9edc-bfdd3a429dfe", "value": 904736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747360809, "uuid": "aa846966-30d0-4599-9456-acc2b1e2bcd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747360809, "uuid": "dbf679fd-e946-4099-b43b-bfc3f2e49901", "value": "z1Document_PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d32584f-3228-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747381046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381046, "uuid": "00031ea4-00b5-4641-8b8f-d3c024fda988", "comment": "Malware payload (Mirai)", "value": "fb3a53b2cc2ab7db49db0e1aff5c1de1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381046, "uuid": "236bd42a-20c3-4233-a86e-d0edc7417f82", "comment": "Malware payload (Mirai)", "value": "66b8f1be308be9b495459c1a921ca256ad4144c90355ec04a0559638f6feba9c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381046, "uuid": "1ae7be19-1a35-4b5d-a680-0e0e4943dafa", "comment": "Malware payload (Mirai)", "value": "02a60d7b8c33b3f1cdd981b025ceb8ea4653e392", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381046, "uuid": "0b29da5a-852b-4d78-ae23-6c08bd7a2820", "comment": "Malware payload (Mirai)", "value": "fa2b4af1b1d3bc73b337b1821426ef96352e5a443f37ad222d8d684ad1620a781eeacad18be57e7eb3fb38afa85ea8bf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381046, "uuid": "bc42a128-f214-4cfb-8940-05e01efc3167", "value": "T171D2D032804C3B72F3B22936DD3741439AAD1F3C81E7F9A296156A486CE7082E564D4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381046, "uuid": "627ba32a-c3d4-4d82-a271-6d62aba27f03", "value": "768:JWfqCHsF6at08FqjMCmRdtzjUUxPissWFq3UIyu0:Mf9MJt0qHzxisuX0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747381046, "uuid": "80db0dd3-91a6-4bf8-b06b-abed640421ce", "value": 29272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747381046, "uuid": "2da45014-2679-40a3-aa5e-c3f025a21fa7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381046, "uuid": "b12347e0-896b-4c82-81c3-a2171561d6ba", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "505ce761-3222-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747378340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747378340, "uuid": "b84c5465-2672-4789-a804-3a5adf618cde", "comment": "Malware payload (Mirai)", "value": "2be4587a37daedd625db74bc0187d39f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747378340, "uuid": "920c7728-4079-497a-b97b-a3eeced7a54a", "comment": "Malware payload (Mirai)", "value": "66c9a5d17a172ace337279fd708055438cca1682eca7ffd117b6a72c6203f2e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747378340, "uuid": "0a45771f-603d-4ac6-8fd5-817beb45cc17", "comment": "Malware payload (Mirai)", "value": "bc2ecf5f5c1b1141ca4e4a4b97c43c1563ee95dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747378340, "uuid": "0736f7cf-5890-4e6b-90b3-7d75e70d43a7", "comment": "Malware payload (Mirai)", "value": "4a4336f6dfcb7695e195915f1a5b1e0d22330b55873f09e95608ab66b90e4957560478391ed757d40690e6527fc4f91b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747378340, "uuid": "e1f89136-9aeb-4d1f-92ab-ef5e48f0e0a1", "value": "T18FE2F1D555CACD22C030F237ABB0457737EB5B7DC1D4733222091F3CA98252E95A4A9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747378340, "uuid": "24d3b3f9-5833-4581-add9-f36ee208be6a", "value": "768:v4G5hcJg6fpLciOUjLUeC3JNaz2s3UozO:wG5iympoz3JYbzO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747378340, "uuid": "323b0f10-4d47-4236-86da-302b2cf8a748", "value": 33988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747378340, "uuid": "fb8afd93-89d5-4b44-8118-317125792296", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747378340, "uuid": "143916ab-8694-44cc-9628-33240c9f329e", "value": "neon.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "978f6119-3276-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747414537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747414537, "uuid": "bd8dae2d-6f4e-42d8-b25b-3e8ca1d82977", "comment": "Malware payload (Mirai)", "value": "0cca325e687ccd1002085da86fc4f8cc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747414537, "uuid": "4a9a0f54-3fa1-4cfc-910f-08d2f3c7fda9", "comment": "Malware payload (Mirai)", "value": "6857374437baf664305c06707518d741e1a4cc3b5b3fd51c0d8faaeca1682d6e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747414537, "uuid": "017787b4-96c6-4a40-8621-b4ba1b3967b0", "comment": "Malware payload (Mirai)", "value": "89c95772d923b979e8cb17daf6f26d97726cf406", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747414537, "uuid": "efe263ae-42d4-4fbc-a077-446c0628811f", "comment": "Malware payload (Mirai)", "value": "8d4a67cc347d66584778ffbbc661d298d4c571d19a9dbe9b5e15c17b08e56e452f7a5904cbb236f491f705d6d1af1725", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747414537, "uuid": "f9db0ef7-a291-4766-a63a-1e2f38635284", "value": "T18D34B81E6E228F7DF7A8873447B78E24A75933D623E1D585D1ACC2101E6428E641FFB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747414537, "uuid": "858d9616-7e19-49e5-b7eb-f87a4b6a3172", "value": "3072:zM9EZMI3o0hb/zfwR+1NHVMIwzEY7F01Y4vfXCmZspzHwF1GeKEY:zbZMInDzfwR+z+zEoYnyZpUF1pKEY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747414537, "uuid": "539dbb93-f41b-44f4-80dd-e26188a5c9e0", "value": 235220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747414537, "uuid": "63afc767-cd46-4585-a37d-7f6bc705e3a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747414537, "uuid": "acee3bcf-b2ad-47dd-ab75-ba0d3a2dfca4", "value": "neon.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b14d9689-322b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747382368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382368, "uuid": "e2710987-0849-4ffb-9402-710a79e594d5", "comment": "Malware payload (Mirai)", "value": "2284f4703893ae8d7f6866cf86b2a9cd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382368, "uuid": "ff15008b-6687-412d-a28c-3ee125ff2195", "comment": "Malware payload (Mirai)", "value": "693378e0183ce1eb1aeab9b94f46ad3ed37be6be445a023baad9035409f3a5b3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382368, "uuid": "2542c723-d9a7-44f3-8cf6-c1df0d07db72", "comment": "Malware payload (Mirai)", "value": "b57d603f9cfa877a09bcd15f9bd0870f9a46e7ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382368, "uuid": "9bd4aad4-051e-403d-92c2-4055e3fb2437", "comment": "Malware payload (Mirai)", "value": "f592fe2ccf9b8ce55928dde3dcc8f146d18bad623108a89ceedd01730c586669742467aa57635a8ef7d0eb3c9d46dc9a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382368, "uuid": "e65d33f6-b39b-4e56-86a4-bf3c232548fc", "value": "T17D433CD5F801AD3DF957EAFE44624A0DBA21721150A30B2BA36BFDC37C332A45E16D91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382368, "uuid": "9612f9e9-6f94-42d1-8334-6105ff8eeab6", "value": "1536:bFyTOn7IOlZFa2x+qEbYbKup7X6Y3fG8ce:bFwN2xJEM/gYPt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747382368, "uuid": "c7a4dfba-68ff-4e35-ae0d-ca963ba8fe2e", "value": 57244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747382368, "uuid": "141eb70f-1d4e-4c9a-a1c8-2990336a72d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382368, "uuid": "ec600ec4-3519-4243-8d6c-2f7c0eb11420", "value": "kwari.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb89940d-3228-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747381178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381178, "uuid": "a215bbf9-5336-4eae-a87b-f505f305b92f", "comment": "Malware payload (Mirai)", "value": "3440407cc4378a3339a4633b89b4659e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381178, "uuid": "7eb7231f-6eec-454d-b9c8-14e5000b46e8", "comment": "Malware payload (Mirai)", "value": "694c3bcc537296590dffdaf3faa1fcaf9625424539f13e71f09fbac96c5a8fbb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381178, "uuid": "85f148d4-0d44-42c3-a451-817809ace3b2", "comment": "Malware payload (Mirai)", "value": "0eddd7ac0a2425d0988fb138e9d20b648bcf62e3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381178, "uuid": "f809bb6a-e8f5-4006-98fe-3c5489af9694", "comment": "Malware payload (Mirai)", "value": "cdc0925abebe85a4a03b3d7ed44e078b6ed59dd662a88639debcc358fa8859cfa75fe64ebb905e1d2c75dfdb6bd742d3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381178, "uuid": "e0a64974-2dc4-4e43-a8f9-5d65fd0382de", "value": "T12573A50E2E359FBCFF98863457B74E21964833D93AE1C645D15CEA011EB024E781FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381178, "uuid": "e99af338-73a3-4055-beaf-bf21fd6db10f", "value": "1536:LdBX7mdj8pbr7I84aK399ZxwO79Uw4ptO/XkMitf0xq8z5P:fX78jy7I9ZxwO79UdtKkMyf0QQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747381178, "uuid": "9ce2abfb-de0d-4d9c-9369-316370758cd5", "value": 80188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747381178, "uuid": "0f58e549-dded-4e12-be6a-44b9a57c811a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381178, "uuid": "bac5a083-2227-4af6-839c-6dbd02856da9", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c12563c-3236-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747386816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386816, "uuid": "8b3962e4-5674-4b00-b078-b64c494ea74a", "comment": "Malware payload (Mirai)", "value": "dcf84010682d3881c51583de87347f5d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386816, "uuid": "8fa69abb-1884-4e5d-9e64-d8b4ca5bd3ce", "comment": "Malware payload (Mirai)", "value": "6951afaa147996c45f2162b707dcc30f94eeb34f6a7de009ca18c2d478a23f8b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386816, "uuid": "ec56ad1e-1e24-433e-bc63-db40fd22baa8", "comment": "Malware payload (Mirai)", "value": "e8a98ca589619615f7f7db5df8bf12b13d355753", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386816, "uuid": "d4ae353c-1aa8-4621-bb39-901b03e28573", "comment": "Malware payload (Mirai)", "value": "4f31d9a163d2941398d199d1fdf9f3198550602167e3ccd1a9bc5b82615547cac6f61e3d8896e79fa25b404e736b94fa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386816, "uuid": "03ae69ca-d46e-4a62-bfa3-80845498fc06", "value": "T116C2D1A85925828DC39DC0F597C047D02D395E63B503DC88EFDAEA034D184F83983AEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386816, "uuid": "98ec9267-1bfd-4272-b6e5-79cbc867051f", "value": "768:z7HmLCGYG/vulStznRinOnspsyMcptRJgGlzDpbuR1JI:z7G+GX/Gl4n+OnsscptjVJu2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747386816, "uuid": "d3048b8e-cba7-4f72-a3ae-126ed6266f25", "value": 26840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747386816, "uuid": "7ec1a4ab-4f0e-449a-b8a9-70c947ee9df5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386816, "uuid": "683cea2b-55dd-4722-8e54-8174c2947385", "value": "Mozi.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b572b149-3261-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Latrodectus)", "timestamp": 1747405568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747405568, "uuid": "696a56e0-eac2-4c1f-86a3-356a74c1a29f", "comment": "Malware payload (Latrodectus)", "value": "bbb2eb34fed468b8ec5cd0be88f9acbb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Latrodectus", "colour": "#156C04", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747405568, "uuid": "6575aa22-4102-40f8-84b7-8b0c9438780a", "comment": "Malware payload (Latrodectus)", "value": "69af1d10dd1dacae362ab8fd4e5bcc97ddb363cdeb06a4bf1bc3db4dfc68b1e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Latrodectus", "colour": "#156C04", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747405568, "uuid": "2192c6e6-65f0-409b-9ee9-be398d51b8f0", "comment": "Malware payload (Latrodectus)", "value": "6b0c0a35d0020700cc2baf744eb3b2a250945bbf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Latrodectus", "colour": "#156C04", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747405568, "uuid": "2ef9c48e-10f8-47be-a0f9-e7ab834c80c5", "comment": "Malware payload (Latrodectus)", "value": "47b842fe516e33bcbde564c8d6ab48eab7e1649d912a4cb33d6ab5a8ff64f6f98cf2aff7194b2d27d032fdb8699d4678", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Latrodectus", "colour": "#156C04", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747405568, "uuid": "e1c5e56f-d4bc-4f68-b0dd-ad55052b5329", "value": "T1A1958E56E37540E8D0BBD17ACA579613EAB034090730ABDF96A4DE517F13BE2A63E700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747405568, "uuid": "5b1902c9-1669-46fb-8471-0ea5040b683d", "value": "3765aee2a76a4886e70915c41193dd1b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747405568, "uuid": "9b49d5c1-eecc-422e-8b21-432751037820", "value": "49152:D8Gt/xpMse6b/WClEuBKH5jRfyMwUTig:deUWClEe6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747405568, "uuid": "43d6a47f-71bc-4942-9941-83ab0599a120", "value": 1907472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747405568, "uuid": "9281abc2-f24f-4ac5-81b4-7be4d9073966", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747405568, "uuid": "b636e601-7292-4ff0-a5ef-ab8ba6334eb9", "value": "mwtsp.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df659e92-32a4-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747434415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747434415, "uuid": "e43eb51e-d090-4f37-99d9-3a9680edcdca", "comment": "Malware payload", "value": "269ac57a61e437a1352dcfa2d33c2f9e", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "vgszf", "colour": "#2A4731", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747434415, "uuid": "af354629-11cc-4234-8506-7205b9373800", "comment": "Malware payload", "value": "69b7334cae60474e66ee6a2d0f804ecb7c891379def3869fab350082ff966199", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "vgszf", "colour": "#2A4731", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747434415, "uuid": "ff1ad595-74b5-45c0-aa9d-35f900ee5df9", "comment": "Malware payload", "value": "6087ac03c907e4b069dd8b0e77b1329c24c6ae93", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "vgszf", "colour": "#2A4731", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747434415, "uuid": "510e9eba-9b12-4bd0-aa64-524e35ea7e46", "comment": "Malware payload", "value": "d208398c601668553738dcfc6c52057a311c64990896bb436df50927cc8d0595848e8639373960c19d477fa54ac7324c", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "vgszf", "colour": "#2A4731", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747434415, "uuid": "4c40c34f-fefa-46de-ad87-5b96a7e3f4f3", "value": "T1A3828DD35B216CD7FA5B4839A1CC8A27E5B4F3822382C9DF1259C2460F527D13A7CA61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747434415, "uuid": "54082eb2-e6ee-4da4-936f-678679989b08", "value": "6f5335d625f476d22e44d1985a47ff7d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747434415, "uuid": "be334d2e-4f12-417f-b7cb-e7a265eceb74", "value": "384:UiWCL3Fd87WWM7Ss5621bSAM+o/8E9VF0NytgPrG:UiWhyWM7S2lSAMxkEG6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747434415, "uuid": "d240b94c-c92f-4574-98fc-ff1b1f6ff996", "value": 18976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747434415, "uuid": "f55d9583-e58f-4fa9-9215-c547e01217bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747434415, "uuid": "289c6f63-b6d7-4bd2-9819-f74698d4a07f", "value": "fortnite.sys", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaee4137-322b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747382358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382358, "uuid": "bf6d015a-3c1d-450b-8abc-95f538ecb2fa", "comment": "Malware payload (Mirai)", "value": "5556543f1dd7911afde31ec80cdc8e28", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382358, "uuid": "0cf6da9b-cb73-40af-9e46-0d7223bb70b0", "comment": "Malware payload (Mirai)", "value": "6a6c47f0763669813241f46d32f9c9c62370e9efbffa33e4de8c3449f74e920b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382358, "uuid": "80df2239-9ecc-4530-a07f-9d18aa24f829", "comment": "Malware payload (Mirai)", "value": "874810a989764b77058f431e43ced3737f680854", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382358, "uuid": "e651820a-a783-4ac3-acda-1c87a67d242f", "comment": "Malware payload (Mirai)", "value": "5d54ac9ad1db2314565739c475a3e7d69ac1770e22d84b35a2f325935cab1f347a140c722b8037e4cc1bfbf2a549d4f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382358, "uuid": "4f0e7c0c-2775-45e6-9d5e-606981e2aa28", "value": "T1EDC2E06C23164ACFD67F98B213A047E19D099E217D539C0936CBFA93CC8C6E25DC21B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382358, "uuid": "3455030e-9674-4b93-bca6-4024470be4b7", "value": "768:wyPqHNRpu2PY1Sl3gRsdVDY2hZrllbeJgGlzDpbuR1Jmv:wwqtRzPYoasdhnRlbKVJue", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747382358, "uuid": "9b884722-47eb-44f7-911c-70ad980dbbb0", "value": 26220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747382358, "uuid": "2335c413-d205-4409-8388-a00d5e326c21", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382358, "uuid": "282631d1-bc34-48e4-9c17-410959771b34", "value": "phantom.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40b3f05c-324f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747397641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747397641, "uuid": "91949bc4-eb1d-4b9e-ad89-9d4cbe54dd56", "comment": "Malware payload (Mirai)", "value": "850491aacfda5b6f759fac8c8e79ed77", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747397641, "uuid": "50912d5e-b0d8-4a0f-a33a-d03f2dc98e70", "comment": "Malware payload (Mirai)", "value": "6a889a1fc6489ff0adb0fa87cc61ae0a42b569e8cf89b469e725bdad760ca785", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747397641, "uuid": "1fc70385-aa2c-4e0b-9561-537e80c74dc5", "comment": "Malware payload (Mirai)", "value": "842a23339b4297dce94c8bddc788521531c0e5bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747397641, "uuid": "f5da07f8-0bd2-45ee-b5a7-da3c4a0a8e5d", "comment": "Malware payload (Mirai)", "value": "538423cef88fbf137e72b6e629f315ff00cc1b6ce44b5c4242d5dbfa42f4b408c2fdd59e83b7a5457b8c3ed5efaa2b85", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747397641, "uuid": "94caa06e-dadd-45d7-8749-8f5393a55aa1", "value": "T1EA3302B25ABC0180C69443B5111F7ECD9668A187DA990C1E7289374B62FAFBC7D1C3DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747397641, "uuid": "d81ea0f4-6590-4f59-95f7-c2e3479065ff", "value": "1536:LnSrpq2YRdfTqhkDziQ3rBiruLzti6vnouy8rys:LSU2SNTqhkR+O5f/outL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747397641, "uuid": "b01510dd-3367-4851-a2ea-2e6b0a4fd437", "value": 53744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747397641, "uuid": "f873dec3-0b56-49f8-90ec-d45ab2fce620", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747397641, "uuid": "681ffc6d-a6db-469b-a234-cbe94568e785", "value": "Tsun.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "454eb2cd-31f6-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747359424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747359424, "uuid": "1cac27e2-7acd-49b4-a447-f18d74c11797", "comment": "Malware payload (Mirai)", "value": "d2e4ec26527fd9e6abda4764f0c254f8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747359424, "uuid": "2c762591-bcbd-4a6d-83df-dce40a13d9f7", "comment": "Malware payload (Mirai)", "value": "6b19433e2f1796d2255f5cc911a1fb36ddb04e8be759feb2c088f954fbd2f9b0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747359424, "uuid": "540560de-d762-43ef-b542-68cc84ff63c2", "comment": "Malware payload (Mirai)", "value": "c0e3c7e33e83d21fbb0541fd7404274042deeb52", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747359424, "uuid": "bbfeac55-77ce-4b69-962a-9b219a9813bd", "comment": "Malware payload (Mirai)", "value": "bf01b8d717b6b044c7a53914520c19f570933d50ca432a71246555af6391fe7e83a45fcdacbc764fbecfa968beb8d1d7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747359424, "uuid": "8660e72c-2394-44a3-aa2c-e0b2cb8a24e9", "value": "T11BF2F1EEF878588ADCEA1C3E708D05B49644609A364EAB412755BC0CEF2D1CDE4C965C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747359424, "uuid": "a73dc64f-0304-4642-8f1a-b441d9064a88", "value": "768:dSNgn5Es7+/o+nhYLSuI8AcKpfw5WEcnSUR/QWf:oNgnusJUhYOp8AtecSUVB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747359424, "uuid": "983e00bb-70ea-45a9-9718-0028587f7727", "value": 35664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747359424, "uuid": "baa3051f-bc52-4e60-b462-48afadae18c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747359424, "uuid": "665ebbac-537f-4b83-8a70-a29afd9a3cab", "value": "neon.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3db571c-3272-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1747412974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412974, "uuid": "c8276213-28a7-4b1e-aca1-f7c37db8fbaa", "comment": "Malware payload (Gafgyt)", "value": "27db6d9738da7ea5a96683686f75fc7a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412974, "uuid": "56229241-3eff-4218-b36a-2d1bb6f5b3a6", "comment": "Malware payload (Gafgyt)", "value": "6b7286b8df4715e9d7ede5a575edddd27092ef12c3a1a31b276299f0e6b168a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412974, "uuid": "f8a1eb40-ca98-4190-9418-a179588459ad", "comment": "Malware payload (Gafgyt)", "value": "61e8e2077b6ba4145ffdafb905e9b9d746153c83", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412974, "uuid": "d3b2a37d-bbba-4083-aae6-8b6d2631fb16", "comment": "Malware payload (Gafgyt)", "value": "05db53be9cbd20f797fd3f922c73a7e8f44981a865312f8035072eb8c7c689627084299b9301df4a8680b32bb766de6a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747412974, "uuid": "e451e910-55e0-4f83-afd0-bc367d13b8fb", "value": "T1FC54500A6761CEB7D89FCE7B02DA812110CDA84A119DBB2B73B0E61DE75E58F80C7D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747412974, "uuid": "9ba541f6-9e02-4973-bb86-6fbd0b1ad953", "value": "6144:AvpXYILOCMymdaYuojomT+rL6uYcGOkq8WEDv:aXYGXPAomT+rL6uYcGOkq8WEDv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747412974, "uuid": "00365aa4-2a2e-4fee-999b-f2cf65953329", "value": 288406, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747412974, "uuid": "79801131-2965-4d0f-9479-df1166730b04", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747412974, "uuid": "6715aa3f-aa03-499e-992b-c68daba5631b", "value": "jackmymipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73c3c8c8-321b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747375393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747375393, "uuid": "dc6d94fb-ec24-4295-bffd-0a04fcc71766", "comment": "Malware payload (Mirai)", "value": "4503926017924b412fde299b1b6921b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747375393, "uuid": "ef1b013a-fb35-4542-8e5e-65ed0980665b", "comment": "Malware payload (Mirai)", "value": "6c126e9b7956dbdb467c341224560a694e7e33a63e4df257484e56993a07c37e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747375393, "uuid": "8b751ae8-d5db-4c8a-8508-7d6a4f59ad7c", "comment": "Malware payload (Mirai)", "value": "49e04a642264f352b4c48e6f20f3069523f629f7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747375393, "uuid": "185d445f-4cb0-491d-9198-243026c14a26", "comment": "Malware payload (Mirai)", "value": "a9b9a3175632381757eaaffb8c08784a03f8bc53e559ecc8d989f9ae0cb9c41d03486183ceeee0abee0dac8cf6a88967", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747375393, "uuid": "d8137f27-501a-4d3f-bc68-4c5bb3b509d7", "value": "T1D593C749BB511EFBD85FCC3706AD1B0228CC699B22A53B367674C528B24F64F19E3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747375393, "uuid": "d4d4e567-2d3d-4e60-9e90-c74c6980a0f7", "value": "1536:XgLbtBezBAWcmONxhfyncQNML5SZRJxXw51qEEHovYKc0Z:XutcYrKnzNg5S/ktfYK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747375393, "uuid": "0d10af4a-4d24-4c84-b314-6bcb149855d5", "value": 88868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747375393, "uuid": "b5b66cf0-47eb-44f3-832f-f38829c3a9a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747375393, "uuid": "de3eed9e-ad81-4f1e-a43b-33c559789ed2", "value": "neon.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6886603-3228-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747381196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381196, "uuid": "af006f8e-98ea-4ce2-8339-7b199555b318", "comment": "Malware payload (Mirai)", "value": "24bbe82a98a89d30894e2b7c3d886eb8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381196, "uuid": "3870c324-ee35-4c0c-8318-6e168ffded98", "comment": "Malware payload (Mirai)", "value": "6cc09def9932920d3cfa6c5d016ece98625fa9e6b43c404f4832ddca42873d76", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381196, "uuid": "97f0f914-31ba-4f7e-8ee6-8c1f9a632309", "comment": "Malware payload (Mirai)", "value": "c3746ec670c6ff4dba70febede9a677f0aea75b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381196, "uuid": "0d4eb264-2f17-4d35-8086-f3ead4eb41ac", "comment": "Malware payload (Mirai)", "value": "c8529a0ade764632090de1c5bb5d920f28c3b834c19277a49d05a592f4b67efcbd36cd647810241c064dffef2b65a3ce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381196, "uuid": "8e076284-e3c5-4e7b-b791-5eb936b7960b", "value": "T12683B5097FA50FB7EC9BCC3349A82741288D501A31A97B35BE74D918F25B35F1AE3960", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381196, "uuid": "e0559fe8-ee70-4c64-bc85-eb80c098bce1", "value": "768:4umq+AgMrOmGIxDokglniEjx3RckF5J0edecAeMScAGHJXid84DqEw3S79yfX+8:4umq+hMWn4oykFE0RATScJ+DG3x2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747381196, "uuid": "f25b8424-4ed8-4075-be89-54536c3295e7", "value": 83900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747381196, "uuid": "b80135ce-5719-40fd-8599-f7fbbfeec79e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381196, "uuid": "7ece9812-f28d-4860-b43d-62b80c9e9d4d", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2b86fe5-3271-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1747412516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412516, "uuid": "b8300433-d33c-4278-9c3d-9ad3b4130782", "comment": "Malware payload (Gh0stRAT)", "value": "183c6560a29184576909f3cb7def114e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412516, "uuid": "30487b58-fbbf-452a-9987-0045026aa53e", "comment": "Malware payload (Gh0stRAT)", "value": "6d0d5b0d4b6a0c4a99f227d38bfe87bd10079034bbd41c90c34a8244aab55a84", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412516, "uuid": "029dd91b-64ac-45f6-bda8-1abf8462f71a", "comment": "Malware payload (Gh0stRAT)", "value": "8fa0313653665afb22f01a2683cdc7cbb6024e74", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412516, "uuid": "82015693-cc72-4371-8766-39747787a710", "comment": "Malware payload (Gh0stRAT)", "value": "6e53dce59b4a5449a359abbcd8ca686b6237a8b15fdad1882f8be18866f578f993d5f7d263c6d38345d7e60c9226ecdf", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747412516, "uuid": "5de19697-2b0e-44da-a7ba-6eede1a289e2", "value": "T162E5C319BA580D26DB57D332C205F1A7ADE8D3A0852F83C2E988F7DC5425483EDA61FD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747412516, "uuid": "7820625a-4be7-4b4d-b160-9b4768ec9f7b", "value": "3ad6c094037460413d9c9cca158104b1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747412516, "uuid": "4156faee-cf41-4db7-ae08-afe192dd113b", "value": "98304:dq2E0P9WeWgvsFJ8yVtbl39yeSUT0R6sGeY5:dqp0AN8eSUT0RjGei", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747412516, "uuid": "4aac13c5-a73c-4297-844f-eabdfa674f55", "value": 3161600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747412516, "uuid": "1f5b705d-c409-4597-98b7-e16b37a17956", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747412516, "uuid": "1a545af2-a49c-4052-8172-5491bc1f1bb2", "value": "SecuriteInfo.com.Win32.MalwareX-gen.16273.8999", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9163d464-322b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747382315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382315, "uuid": "97b0652d-e7df-4a98-91a8-ae3f127bfb1d", "comment": "Malware payload (Mirai)", "value": "6164afec0a8fcd1485999107a5f0e433", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382315, "uuid": "14a216dd-d166-4cdd-8e90-c1876cce6d16", "comment": "Malware payload (Mirai)", "value": "6d657dbe230161903110efceb689182d561d45adc9236122254b4d682c7b36f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382315, "uuid": "8e14ec1d-e03c-41ee-a6d6-cc8e5ad74140", "comment": "Malware payload (Mirai)", "value": "a1dd93a344c75e73dac65b49769a565df75a49fe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382315, "uuid": "94144609-3ca2-4468-b89c-9ece7ea7fb73", "comment": "Malware payload (Mirai)", "value": "5512a63bba22d9a49c5d4bdb9f3da476ec13d589ca4997888089b47af11c2e51975ab56314725225c0cb1285f99891dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382315, "uuid": "55197250-d7d0-4c13-b990-533d38c3972a", "value": "T1AD435B52721C0E17C4A31A70263F5BE08BFBEAE021E4B685699F5F968935D331486FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382315, "uuid": "22479d2e-37b7-4b3d-abd3-d38e1f8a9662", "value": "1536:eF6QcATQdskHosl9k1dP96RT0bI666hJa105:tqgtJHk1dP4gbI6x4G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747382315, "uuid": "dae032c6-0288-4663-bd07-552a85f5afd9", "value": 59764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747382315, "uuid": "912aa820-8fff-4c5c-9e25-3b2f95a1c182", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382315, "uuid": "ea969f42-ba1f-434c-9661-49049a98e105", "value": "RpcSecurity.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd3e4a7a-328a-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747423191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747423191, "uuid": "c1fa9f1f-5496-4e88-bc98-0982ad7d86d9", "comment": "Malware payload", "value": "ce3c33ee170c1de5e027ceef2c184214", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747423191, "uuid": "b2662a53-e9f8-450c-943d-632caaa4a320", "comment": "Malware payload", "value": "6ddee61bc01db09d1044294981f43eb8784637bea43e19c3648e7b532e5eb3db", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747423191, "uuid": "1f5cbc4b-f85b-46af-9438-e81822148f71", "comment": "Malware payload", "value": "f671ed9ecfd9a813b52da88e530d7fc1c8d27cda", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747423191, "uuid": "ccab382b-7ab6-41a0-98c8-991d2f1cec3a", "comment": "Malware payload", "value": "6a5ed041b9725b564362d05fffd564f25f220e49e0a222d5de4bc5f45ecff2301f9d5e8f4da9e30f0a34612c913de1e7", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747423191, "uuid": "682ff827-0f5f-4077-905a-d1884b375cfd", "value": "T1F003F1E6C7BABD86CD53BB2EF23C6325415D052EC8B5C884F641700A99E4749E1E4ECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747423191, "uuid": "8d33f7bc-f8a2-4a74-a35e-373fa2a011c4", "value": "96:/gP4sVAGlEHB4sVcJ3RlEHbDvidfJaYWImHpW4sVRw4sV3/dlEHdwP4sVF:/gh2nPUUbDviLfnGp6QN/odwhP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747423191, "uuid": "b14ce13a-1dbe-48db-836d-1d129e6051a2", "value": 37699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747423191, "uuid": "c8e762d2-b6c1-43bc-a05d-3e6919d9615f", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747423191, "uuid": "a9289934-3ed3-4bc1-aea0-8dba6f65b7a0", "value": "nextbestkissingbestthingsformebetterwaygood.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88364aa6-322b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747382299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382299, "uuid": "b83954eb-c0b8-4938-8393-9ab2220e229f", "comment": "Malware payload (Mirai)", "value": "eae2348b5cd715af6ff4f40d83427fb5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382299, "uuid": "a1bf6fa1-5808-4be3-a534-8951a2866f22", "comment": "Malware payload (Mirai)", "value": "6df5829e703a1ff94b32cd2301adb1155d660bd31297c47c4c3a3f6fced18141", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382299, "uuid": "4c4d562e-ae41-4f34-be7c-8e3f5891fc8c", "comment": "Malware payload (Mirai)", "value": "a9098cb378a6a0e7e2bebb69290184fcea2d4d67", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382299, "uuid": "1646233f-da8a-494a-a3e2-736e49b19941", "comment": "Malware payload (Mirai)", "value": "c17c8131f2e31e177781b5add8f2644ef27dc041e5aaf4d7b1d4a0c978e01bd23448c069b5b9959a6dc43c73c3cee6e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382299, "uuid": "6fcca68e-658e-43a5-b7d2-21a89bb9f980", "value": "T14EB2D06442A899A1CB350534C67C42DFB35F9BB6D2F2397B3629204C26878897978BC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382299, "uuid": "4f7dbf70-4c2d-4866-8276-53e7b426227a", "value": "384:tHfeqjh7fKiQ+Z9pkioTC0na8E2F8hh64xthjQ+/Kn/X7mjEYc4Y0rBhymdGUop2:ptFDmWUkWhEzD06GK9PY0rBs3UozE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747382299, "uuid": "38d18399-1f9b-4f00-ba5c-d937c93a9954", "value": 24036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747382299, "uuid": "808e2474-a775-4484-98a5-70feddda02e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382299, "uuid": "f5149cf6-4bee-4f1f-bf2e-f382e77daf82", "value": "kwari.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f119291d-31fb-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747361859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747361859, "uuid": "2fc26d19-eee9-410f-bb02-0af3eef33f27", "comment": "Malware payload (Mirai)", "value": "4624a6198dadd930faaf52cfe9c83b0a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747361859, "uuid": "e3f5dcf6-84fc-463a-8afe-2b24e36f44ad", "comment": "Malware payload (Mirai)", "value": "6e79ed7207d039a7c81bfcd82c0d9151d8b5f6be42bff8b2a08929f2e300b32f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747361859, "uuid": "91ed8232-6aa5-4ea2-9f04-8918856f1a02", "comment": "Malware payload (Mirai)", "value": "cdc8871bbb1296a825ee644323686fc342a3a8fe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747361859, "uuid": "37342f11-8cf5-412a-b605-0fe42f77fcdd", "comment": "Malware payload (Mirai)", "value": "4c50e045969286b323d7ccfa68e332fe892dcab0ea7e9fddd81272457c76d16fa0d074a4d35ce3e05a533eb64a19bfe0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747361859, "uuid": "ffe831e3-6d55-4034-8930-b5b487675fce", "value": "T127E2E177F3A22695C14E103685FBBE0D02BB893C0A519A66F48C3513D9DA721BB35398", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747361859, "uuid": "2d9d4845-ed22-4b72-b0f0-8840f52c852e", "value": "768:+lv/UW08imS4+dud5Aymy4oKh9LKmIjcZyU7AeOAAMnbcuyD7UHQRjN:cUGr5+ohmFt8j+yU7bOenouy8Hy5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747361859, "uuid": "897bc5b5-3541-43c1-a4db-161c8ad5f27e", "value": 33208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747361859, "uuid": "05ccc1b4-535c-4639-81d4-8695e1bb7f97", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747361859, "uuid": "f8795f59-6fce-40bc-9e1b-42524549f2df", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fffa7d14-3272-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747412995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412995, "uuid": "1f2e4388-4172-41e8-a8eb-ea7949698fa2", "comment": "Malware payload (Mirai)", "value": "7f394c89d0a68bedb00e4f3ee1238a7e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412995, "uuid": "71d673e7-fc78-4932-91c0-594dcadaf28c", "comment": "Malware payload (Mirai)", "value": "6ea282d0d09fa6289808b8f4db24cbc6085d30b7924b8c4981b69690b97a573a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412995, "uuid": "1a3d2dc6-2694-4f2d-a6bd-5c87db291bcb", "comment": "Malware payload (Mirai)", "value": "05842873441d11681704ed745035ae6cbb8cc1ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412995, "uuid": "0b0d07ce-79d3-413d-a55d-3281dd6a0548", "comment": "Malware payload (Mirai)", "value": "4d3a799a129eab64df6bd5b0aaec324f1f41f08259593f640a4de8b7b6702ee6795d0fc099fd06417325f32b8e31e430", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747412995, "uuid": "0622a592-3a6e-4543-b386-494011464fcc", "value": "T1C62308C27941B639C3D1577BEEAF014E3354A7D8D1DA3397C8280B947A8A90F0D67B46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747412995, "uuid": "9e72d923-b027-4f9e-b4a7-7f8a462f1c2a", "value": "768:sJeKpHsmyayL1ScT+GRvFES1un1wnjvsDoCerCw7sC/vnX+6k7wCVy/rCxHghW1D:sYFmSJScT4MjvR7sCnnXPfhWt59seb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747412995, "uuid": "f0e75339-b8bf-4a22-81a7-15d6e204bed5", "value": 49140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747412995, "uuid": "3ca0dd6b-7922-4c65-9b47-ec2c6553f56b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747412995, "uuid": "16f2651e-f47d-46c2-838e-983af2a47c6d", "value": "Josho.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b101d86-322b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747382331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382331, "uuid": "4aaddb22-6bc3-440a-84dc-f4f21a58dfb8", "comment": "Malware payload (Mirai)", "value": "5f50f206550c4531057441491699387d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382331, "uuid": "427b2ea3-43b3-4908-8f81-428679afcc2b", "comment": "Malware payload (Mirai)", "value": "6f46b4d75e9b41d112592a55f0a70f813e917426b8e1ce5031c39a8580ee4945", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382331, "uuid": "437e48ab-4228-402f-a8b8-762e7795f834", "comment": "Malware payload (Mirai)", "value": "fd4429840d10b99f57d2683d3407c4c512c930a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382331, "uuid": "dd1ac8be-d7f1-499d-9d33-5ef1374d4bcb", "comment": "Malware payload (Mirai)", "value": "ba960ab9273f1f8bb51f03e7d1b4510d4bf0f93b517d05a6ba1572485331903ea83982659f4c919b5800b9e700d09569", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382331, "uuid": "6ee658bf-1e67-4007-a397-bfd4bd57af83", "value": "T1D5533B25AD792E26C0D4B57E21F78710F2E2220E26B8C51E7CB21E8EFF04B5065577B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382331, "uuid": "425b3dc8-ad72-4273-96da-16fd73a08041", "value": "768:VaYoQW1sgtq98oSWANyrk5K3YneVMAb6WsreAgOmdMcyPD5aO+neS6L2:VaYWmgtS8oxANMk5K3YeV/b6vr7LIng2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747382331, "uuid": "4b8175ee-0297-4361-88e7-80c6586dcc69", "value": 61508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747382331, "uuid": "65f18f7b-2bf5-4651-bc4e-d63fce441064", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382331, "uuid": "f92ac001-4fd8-4334-bfdd-b75555944eb7", "value": "phantom.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f098878-322a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747381693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381693, "uuid": "49fd7dfb-b170-4187-82dc-53d77c97c7aa", "comment": "Malware payload (Mirai)", "value": "251e761de34cb5be6a40503e98a22213", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381693, "uuid": "c9974bba-b537-44f5-91c0-dc97f100a003", "comment": "Malware payload (Mirai)", "value": "6f531a4de539c93acc90ad33486c807ad77c2b85e4e7e0f9eaac75d707ccd6ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381693, "uuid": "23847d85-68ee-4057-9fbf-e27b907a36b8", "comment": "Malware payload (Mirai)", "value": "5f73dcf2486bea624e34c6d6e113d20d366086a1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381693, "uuid": "876cb910-7b65-4e2e-aa00-154b182ba001", "comment": "Malware payload (Mirai)", "value": "00c2f805ac43dc491fdc19da3d8f7aa6b8ecbd1e5018e0cf26ffee9dc55906f53fd1c707cb773c9202dc96a474c30e03", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381693, "uuid": "325c7629-64c8-4588-9cde-88969b5ee3c7", "value": "T155F2E09EE669B946EE7C6CB8311D07411C14B0D026CB936D9B2218ECFA8C41FF8E64F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381693, "uuid": "4464449c-9108-4ad8-8933-dd483aaf62c8", "value": "768:8U8epdpeht637QxtY6j+mes8A0KOdLZzGoNwIlWbu:57FGQ7Qxe4LethjyId", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747381693, "uuid": "68e9f682-041b-49ef-9a51-fd784f2794f5", "value": 36272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747381693, "uuid": "97436aa5-8410-4eaa-9e5d-b42dc69bf6b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381693, "uuid": "55940c54-caf4-4696-a6d1-1212e7deb87d", "value": "neon.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9020e2b9-3239-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747388326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747388326, "uuid": "c7bb0baa-e37e-4154-b64f-65e40dc69e84", "comment": "Malware payload (Mirai)", "value": "73f9dd5f73fd469812805f72559aa61e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747388326, "uuid": "66e83c06-c632-4dd7-a484-9e4423853fb3", "comment": "Malware payload (Mirai)", "value": "6f65ad8a1b85c698a402b8e7f489abaf067d23ee823474848bc178be67463802", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747388326, "uuid": "7cff74b3-1882-411f-bb91-6c1de366324c", "comment": "Malware payload (Mirai)", "value": "b81f048ec82881e6cab260c8618bb7d75aa430f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747388326, "uuid": "7cff028b-1fc1-44c0-ac08-a0df7cd63699", "comment": "Malware payload (Mirai)", "value": "e0ff722432d7a0afceefd9a0c8ee68a17fb7c775d8deea619fa8aa66b67edbfadffe9dd501c02397543f7173bd19ce20", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747388326, "uuid": "ac752616-9fda-4dec-ab6e-37e644025b6e", "value": "T18AA3B50AAF610FBBDC6FDD3B06B9070535CC551722A83B3A3974D928B54B54B4AE3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747388326, "uuid": "baa96c50-7801-4b05-a3d4-3f6983f54ffa", "value": "1536:6VINcAC3rhgwLiivE2BoEd3BOOIUTiPXWZ9q/apAdQ5KBWSA2C:6gcAC3m5EBOOTGXW61+A3C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747388326, "uuid": "3de8652e-0999-4202-a5f0-c9e1b47ef6e5", "value": 98476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747388326, "uuid": "224604a2-e3ed-4d6c-8a1d-91cd3697ed18", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747388326, "uuid": "ff132d74-054a-4901-b95f-45cbbad39567", "value": "fmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b641d84e-3227-11f0-8bd0-42010a9c0005", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1747380659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747380659, "uuid": "2f238987-537c-464d-85c1-317f024f59cf", "comment": "Malware payload (SnakeKeylogger)", "value": "479bd8ec0fe70c78dc90f05d982530b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747380659, "uuid": "83e9301f-995d-4d5b-aebc-8509486d985b", "comment": "Malware payload (SnakeKeylogger)", "value": "6f90790d085ea598fdb12764de104de640b1141a4ac4973e02faab9699bedba7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747380659, "uuid": "15672ef6-6d44-42ae-95ea-691ed3e019a0", "comment": "Malware payload (SnakeKeylogger)", "value": "c5e94e4aa958052c18c92d39c717cb37d428ffa6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747380659, "uuid": "cc1e5b58-c27f-4cd3-9f5a-0ff70419d3fb", "comment": "Malware payload (SnakeKeylogger)", "value": "7c6d442235b06c95ae11d42671388d55e9067d57d60454616c9f133f8792e901f1f66e5192038a5cd1d68ac9c8ae38d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747380659, "uuid": "64ab322f-6112-4ff6-ade3-072ba0854771", "value": "T1E1C402183649DC07D4A316B409B2E3F41BB52E8CA821C7C78FEA7CDFB9A97466506347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747380659, "uuid": "426039a1-7685-4953-aab4-263d299f56a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747380659, "uuid": "d4f30b3b-bd77-465f-b6f0-88af2b06df2e", "value": "12288:IpMJEZJNe7anyzgVisz8WPTC9nXuVXTRhYHOFeYNPsEi:4b9yArPTKnCXTXAS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747380659, "uuid": "8e9d743b-1c45-43f8-b091-9d35dc720ef6", "value": 580608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747380659, "uuid": "3fe21a23-3073-45c9-a6a7-b9f13f0db42a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747380659, "uuid": "6a70c26d-7cd4-458a-8868-bcc823868352", "value": "SecuriteInfo.com.Win32.MalwareX-gen.15782.12390", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af22dc21-3228-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747381076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381076, "uuid": "8a122b8b-6bc9-4243-81c8-8b9dbe92adb6", "comment": "Malware payload (Mirai)", "value": "fe5712d0f358a16018dab276d270e088", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381076, "uuid": "10baee6b-38eb-463f-a5f9-9df4c3e3b9b9", "comment": "Malware payload (Mirai)", "value": "6fd4f0048fdc1b2f986e05790d6f82d8940ac73bb95ab06857281229b9fc9e06", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381076, "uuid": "a27caa6d-e8e9-433e-b2dc-e205139f7f97", "comment": "Malware payload (Mirai)", "value": "b2c1ff0ac34cbaf50f22536d8b2f1cac7b226da7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381076, "uuid": "fb6e9903-3180-43ae-bc7e-1246df525962", "comment": "Malware payload (Mirai)", "value": "207e3ed443ee0f17305bf25d2cdf6950129b9109be467ea4f9b099f767065276536b9a97074ab308e5359f1e1ab677d7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381076, "uuid": "8557bd3c-61fd-4538-a15a-2799c7331a84", "value": "T1D1C2E1A1E1B62ED6FB7A7E901F75C2C177B04E5EB7778CD22558AF0404A72170B056C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381076, "uuid": "f7e926db-7b56-48f7-880e-85c46ea46b17", "value": "384:lQez9/6Jgn9yMGEGHV4u/DT8HgPEt6seDYc/OKM4uVcqgw05VxJc0/:yG959yM0HWubJsWDYcGR4uVcqgw09S0/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747381076, "uuid": "e29aa385-371a-4cbc-ac85-113ac574092a", "value": 26232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747381076, "uuid": "02491b08-a210-44fd-a6e3-c19b3fc9d933", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381076, "uuid": "35b79023-6e91-4ed4-97ef-a9671b023185", "value": "sora.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b47a9094-322b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1747382374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382374, "uuid": "36b5b6fc-c164-48c4-ae4a-b5aa051ba42f", "comment": "Malware payload (Gafgyt)", "value": "bdbde5ebc3e87846fc90ece273cee95a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382374, "uuid": "7c7509c7-cfeb-4277-9d48-90c5b572b26d", "comment": "Malware payload (Gafgyt)", "value": "705e51c4eba1bac796a8d80a7bd3c12024f230dbc7c6680eb68e723e5adb00c5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382374, "uuid": "972a2205-676d-4c6c-9b1a-e3a4f2e6edec", "comment": "Malware payload (Gafgyt)", "value": "4143e461ca9f1cd0091884bb3855610e7072afcc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382374, "uuid": "cc3f37c6-5158-4697-b3aa-4d4280e484e9", "comment": "Malware payload (Gafgyt)", "value": "9c397f3d9804d22c7db305996440ae49d819050b5ed0b642b40fb44cbee5179976d06e33c2e88bd9287423b738ed0d65", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382374, "uuid": "c2ddfbcb-7c98-4dd4-b101-482fc12a5de0", "value": "T16D04A8449CA45B6FDBE3ABFBF74471CE727646891F833309D3284AF013816EA9919253", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382374, "uuid": "5338d319-2f59-4b5f-970c-e97906825b0d", "value": "3072:ZR+4AGXq11zXqwL5SJNZf1t3aLUUGPNZibtNf8eNgJs12Jhvc5PsEsEUxxQLjJlH:Zce7Iwa9jZxLbV15NooO5Dt0DR1M4X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747382374, "uuid": "f530a02a-aec9-4ac7-80b6-846ab31c6319", "value": 189171, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747382374, "uuid": "020b27e8-c70b-4a88-a3da-804fc314c769", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382374, "uuid": "e232542e-1aa9-4ee8-95ec-e5f724c0bc75", "value": "qtmzbn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "532923a0-3289-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747422583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747422583, "uuid": "1c4e5712-2d22-4370-a54d-0f4e9e476e7d", "comment": "Malware payload", "value": "9761f5ac3856a5aeab0c1ca3e0203709", "object_relation": "md5", "Tag": [ { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747422583, "uuid": "e9214180-1858-42a1-b1b3-a5f4d7a21d07", "comment": "Malware payload", "value": "7085f3dda26b773120d4da2362f5a2e95af799dcec8ec580d36c9d77a6abda4d", "object_relation": "sha256", "Tag": [ { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747422583, "uuid": "ca96c9a1-682f-46c4-a05e-33db2dffedcf", "comment": "Malware payload", "value": "118f5885c26532ea23a586f440bcf2d3e1876f0b", "object_relation": "sha1", "Tag": [ { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747422583, "uuid": "f5942f13-0406-4c81-9281-4348f52fc647", "comment": "Malware payload", "value": "52a51d982d0f0eecfe3bd30e268e90c9e3507dbec824296fb3906ffb8b7c1cdaf5bd1f8025cbe53e99c867d7b73b5e87", "object_relation": "sha3-384", "Tag": [ { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747422583, "uuid": "362fa1e0-eedb-4b80-a5b4-1ad983c9bed2", "value": "T19013D01EC418F83DC9C38A7E749B54A6F30E80859706275B7609E3A46F54EDB93227CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747422583, "uuid": "f703d0f0-f2ea-438f-9749-39ab894fd98d", "value": "768:Y23p2mXH1++5JNgKHi3JoymvMBMRUkXlB8hv5:Xp2mXHc+5JT90BMR9kX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747422583, "uuid": "63eb22b6-81e3-41bb-b672-3c56ecdc2342", "value": 44247, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747422583, "uuid": "3d93595a-20af-4399-8862-5e36b4b3fc24", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747422583, "uuid": "d2afd91f-0bd5-4f20-b7be-9cb5df04e84c", "value": "Example.docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1147b83a-322f-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747383818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747383818, "uuid": "cc2b6dce-4b3a-41b0-a5d2-41a07485702a", "comment": "Malware payload", "value": "c11497ee4d66edefede6151a3d854098", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747383818, "uuid": "2ffcd2cb-d775-44cb-b4f5-9805ed81748b", "comment": "Malware payload", "value": "7091db1bbbd03450c8512369104a753f8acc82e9efa7027f81b97f801a96923c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747383818, "uuid": "5a6867d8-a272-4338-9488-a11e6ffceaf1", "comment": "Malware payload", "value": "784f670b3667454687f6de6ca6178f21eed47a2c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747383818, "uuid": "a4771a12-98a1-42ac-bc60-f2f0d324dd3b", "comment": "Malware payload", "value": "d07976eebf4c61e7867bab155de678d337ed19388c08be8ed63ad8eb022f7d1aca3bdd23b13844944e96922e44a8b6f2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747383818, "uuid": "8b63a345-d4e4-4719-9fc8-3d0c9ed2eb3e", "value": "T1AA830A06A9419F02D4D631BAFBAF414933137FB8E3E97112D920AF5427CA9DB0E77612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747383818, "uuid": "71da6367-6641-4af6-be7f-a1732ac75741", "value": "1536:rAnYMxECGzq7s0EOkmSda1yZTK5pJVCt9lOcilx3eisPY7Db+l3aPO:kxE9zms0EOkmSdacZTK5pJzvx3eisPoq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747383818, "uuid": "7d29b9c0-2a8a-46bd-bee3-95bafe13c204", "value": 85872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747383818, "uuid": "ee20db4f-5aaf-4158-b4a5-1ba9041dcfd6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747383818, "uuid": "60020e92-d7ec-4733-a62b-6c54bf4ba5fa", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ba17696-3235-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747386520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386520, "uuid": "0ac0487a-eae3-4082-bc0a-8e040b4d4c36", "comment": "Malware payload", "value": "fb164758f6c1eb0fb9961882027d9277", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386520, "uuid": "4131db88-e3e6-41d6-88ee-fbede46b2e6b", "comment": "Malware payload", "value": "70e98b83d6572e7d0e83bc7c47387e81689a0e86875a38410afd9bb762bce47b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386520, "uuid": "3359dd47-2170-40e9-b5b6-fb8e547df560", "comment": "Malware payload", "value": "e9b3e5620185f6f5ceaf6075c8f28266b35ca1c0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386520, "uuid": "f2d65f62-ae50-4f6b-8ea5-ff769d37b5c9", "comment": "Malware payload", "value": "ca87a9e82d6500202e6278211fe79646500a42902dfef14f5e48b83d6eec0aacc4c56dd57778baeb5d6d5cbce5a67f12", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386520, "uuid": "0ccc9240-4628-44b7-a4ec-642ec647b212", "value": "T199E02BE29030E93377F5088E9605E59CDEA226BE3BD0010794515C7012B96A4871778C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386520, "uuid": "6e45e326-9a3f-4d09-a50a-2cc402c08447", "value": "6:m3FZ4xbSiWF2zxaGrFgz8JAQ2/Vlo5QeBbQdQYOtocDFz:m3FmRWgA+Fe5Qmb8UWYOtX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747386520, "uuid": "add74f92-2182-400b-b655-a6140e6fee7f", "value": 292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747386520, "uuid": "21930664-bc7a-4521-9a2d-b80d36312cc7", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386520, "uuid": "774f4109-0018-4b2a-b95d-51867b04bb7b", "value": "88822.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b960709-325b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Formbook)", "timestamp": 1747402840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747402840, "uuid": "393a02bc-8a02-4c48-aa0b-3444a42f1e55", "comment": "Malware payload (Formbook)", "value": "d612742a825254d2942e024dacc3c7b5", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747402840, "uuid": "a4021160-045b-492a-8db6-7ade6b791c81", "comment": "Malware payload (Formbook)", "value": "713af9510c2b080774d1af7ffaec3750729062852928974dbaacd3bf5c2e6476", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747402840, "uuid": "de96efe7-eecf-451d-9e16-26e55f7cb624", "comment": "Malware payload (Formbook)", "value": "b680b3e40fae0870815aaf592a80bf139bc4db41", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747402840, "uuid": "4d21960b-bf97-4792-bf2a-3e2e39d839c3", "comment": "Malware payload (Formbook)", "value": "a5b89918c8d665c01db391ee264120afa73bb3380838326fe2ad6c2e2ef49178b9e172c6b392c44c8eb072a90af30042", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747402840, "uuid": "a7e2a09a-4e3b-4342-854f-ce80e173aaa4", "value": "T1B385333804A1EEB4E92423F6F122FCF2E718756A4EFB32750A9D5EF815A4F447709095", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747402840, "uuid": "81930628-a474-4dab-b24b-233264e2c4a4", "value": "49152:sFpxlWOhroRmYdIOEsb6Ja5mkxCOUYeaSwJa2aj:+xSLLEy6JzDjYSj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747402840, "uuid": "ccd33387-e701-41e7-8fd9-1cd14295ee26", "value": 1741032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747402840, "uuid": "22685561-3d15-4187-a504-d3381c1112d6", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747402840, "uuid": "e63dfd05-0ac0-473e-95b1-60c987629b44", "value": "RFQ CF14521703_25903.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e02c4400-324c-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747396620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747396620, "uuid": "5242abcc-7446-49ef-8875-3247633709fa", "comment": "Malware payload", "value": "d7f738503c069ae92a62ae0517d0c972", "object_relation": "md5", "Tag": [ { "name": "1po56mdxc-localto-net", "colour": "#E5C76C", "exportable": true, "hide_tag": false }, { "name": "AgidCert", "colour": "#56D604", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747396620, "uuid": "33684f8c-fbbe-47c4-8b9e-5999793d4e7c", "comment": "Malware payload", "value": "7157bb576a086d98e393b3b997d27e6fd68ddfb43cdacb85cd4fd1b145fb1a92", "object_relation": "sha256", "Tag": [ { "name": "1po56mdxc-localto-net", "colour": "#E5C76C", "exportable": true, "hide_tag": false }, { "name": "AgidCert", "colour": "#56D604", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747396620, "uuid": "6622a903-82fe-463b-8352-31418492a9dc", "comment": "Malware payload", "value": "1baf98438eec0e138376ed62289d87076db4b20c", "object_relation": "sha1", "Tag": [ { "name": "1po56mdxc-localto-net", "colour": "#E5C76C", "exportable": true, "hide_tag": false }, { "name": "AgidCert", "colour": "#56D604", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747396620, "uuid": "7615d273-297c-4cb8-8391-68c6059ae033", "comment": "Malware payload", "value": "67588ac49e80a7d7db34d2b117b7b062edf1395b62104cefdc6dd91dc47e369d527bbb3f5fba24cd4519d18fe61b718d", "object_relation": "sha3-384", "Tag": [ { "name": "1po56mdxc-localto-net", "colour": "#E5C76C", "exportable": true, "hide_tag": false }, { "name": "AgidCert", "colour": "#56D604", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747396620, "uuid": "a6f32d34-c225-4ff8-a7f7-8ee285de68ee", "value": "T1BD46023BAEDAC528DD6745F352C28299642F1568BC0B907E83E05DC5CF61C8B0792FE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747396620, "uuid": "17cb60aa-27ee-4b7f-b5cd-cf299cbe863c", "value": "98304:qUNAaad6kUlPPITyUM2NHw/EnRQJlvJhaJ17Zll9clKRDPacXCv9PzQg:NNad67pAyUM/cnRQ/q1licRDi5d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747396620, "uuid": "daf69933-0459-4494-867a-dd70c4ce4566", "value": 5580363, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747396620, "uuid": "fe5db03d-1408-42e1-82eb-69d4bbdecbe7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747396620, "uuid": "92bc189d-cc64-45e7-a30c-69b90b46753b", "value": "InvoiceXpress (4).jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8de6aa7-326d-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747410755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747410755, "uuid": "a5ae48c2-fab5-4925-a499-67b98802e18e", "comment": "Malware payload", "value": "fd333b3b8a82bb7de7f191c4748db00b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747410755, "uuid": "06037d57-5afe-43a9-811c-31a3ddbb20b1", "comment": "Malware payload", "value": "715defb279b04341fdc48d927e629079662da381d51bce7217d55c375220e678", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747410755, "uuid": "ec9a5d43-01d2-41cb-9ebf-6b7d4b325b48", "comment": "Malware payload", "value": "555be90439cf5fb71af7599f03a064704dde93d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747410755, "uuid": "3a23c7a2-e543-49e3-8b0d-7200ccd03bf1", "comment": "Malware payload", "value": "c8ab17da2ad59e8b4a4cd5db0e162c9ce9878b642ffc860ec8f533e0b40cae03018271387654e1f795c2725f04abdd39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747410755, "uuid": "5306418b-265f-4e40-8bf8-c14a7dd1ff2d", "value": "T1D976231273CDC331CB66A2737F69AB146EBB7CA45631B85B2F580D78AD60171212C7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747410755, "uuid": "d3e37452-6681-46a2-a9ba-405f8913f03d", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747410755, "uuid": "d18d0a9c-121d-408d-b0d9-dc6e0ea6ed8c", "value": "196608:ljtJd4sHEXgYNBUORNgm785aVox8FEEtVF8iy:lXd4BgWBJG2YaiMVk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747410755, "uuid": "46265050-f808-4965-9f08-a86c8ccc5813", "value": 7395840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747410755, "uuid": "0b56c971-5273-466e-87e8-2704c9aa8bef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747410755, "uuid": "79066f15-b68a-4e59-89ce-211022b3ee90", "value": "888 RAT Private - Cracked.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7ff6148-3234-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747386218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386218, "uuid": "ecc2dad2-7a9a-4f08-af1f-ec2f0b81c3ed", "comment": "Malware payload", "value": "fe68f465a1dc4055713f968dfac48eed", "object_relation": "md5", "Tag": [ { "name": "196-251-90-185", "colour": "#01F3BE", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386218, "uuid": "fcef14f3-9510-4b2f-a5e2-5dd9fb35ea50", "comment": "Malware payload", "value": "7187b82879d2c296cd822827166dcdc3e7b355738fe59f36920da896b49e8e36", "object_relation": "sha256", "Tag": [ { "name": "196-251-90-185", "colour": "#01F3BE", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386218, "uuid": "d978f33f-9080-42b2-a3a5-1454209f956c", "comment": "Malware payload", "value": "258a347c741e8dafb25e9f04fbb64639f8442553", "object_relation": "sha1", "Tag": [ { "name": "196-251-90-185", "colour": "#01F3BE", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386218, "uuid": "fad16d9b-cba2-478b-aa44-702bcb881fc8", "comment": "Malware payload", "value": "26bc5f412b03ed6e757dbdcecac29d68d1dc0dd5e1e90bc14c0a469558a98429159b3dcae80b7a439678ad2860b734a3", "object_relation": "sha3-384", "Tag": [ { "name": "196-251-90-185", "colour": "#01F3BE", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386218, "uuid": "d804cfc0-287c-44a4-97eb-015251cccb21", "value": "T10C610EC97D4198E417474BFBBA2AB684F084DC4C7AD08495F2A0E48BFD485ACD6EA730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386218, "uuid": "73e6625f-020e-45ac-a868-1eff35729001", "value": "96:CE2r9CcdrFdc3j7VD3G9gS3U6vaBVd07uPehVNcE+wXOUjqAaTBLSNR:CEE9T23j7VbG9gS3U6vaBOuPehVNcE+i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747386218, "uuid": "45fca87e-abf2-4f49-b465-cab2b7b5a44b", "value": 3332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747386218, "uuid": "7bd4916f-27a1-40e7-84bf-76dd801be4ac", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386218, "uuid": "ea6412e3-dab1-40da-910f-231203fae52b", "value": "2.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18b47c11-322f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747383830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747383830, "uuid": "025741e9-8d48-4707-b58d-eaf3feda3085", "comment": "Malware payload (Mirai)", "value": "6d473cc83c77888f01ff424c336d2b8d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747383830, "uuid": "f1f12846-3329-49cf-a61a-55ba106f60f3", "comment": "Malware payload (Mirai)", "value": "7192faae2eb0afefdc5d3e757614497ba53713b1157f573ffcaf005c84d3871d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747383830, "uuid": "ecec16f7-6668-44c9-92d6-a4859c77e3bd", "comment": "Malware payload (Mirai)", "value": "07609b76d858f4a5353f028f8b676f8fb2a7dad8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747383830, "uuid": "aa87f6df-0948-48fb-8b9b-22235fa8b2b1", "comment": "Malware payload (Mirai)", "value": "257e7b79cf31253e81489650b3adb52bd0bd0e140c8afb20f6be11176f9e6aca89011842630f6d308b026ae341c33108", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747383830, "uuid": "2bcc44b3-0085-4581-a618-bf77007aab7d", "value": "T1D7634AC4A593E8F4DD1507B43177EB334A77F536211AEAC7D3B8A923BC82A41940B29D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747383830, "uuid": "dacc5d57-c9dd-4d0a-9683-fdec2ab34df9", "value": "1536:m4uQwyBcqv117K/Mn9O/kbfvxk2N5rFfEftaNGgZ1aK9UPrT8y5x73QC:mBRk13jbfvxk2N5rFfE1aNGmaE68yrg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747383830, "uuid": "c2df5ac1-3d99-44d7-873d-3d5135248217", "value": 70704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747383830, "uuid": "e67543cd-dd75-47d5-8b0a-f5d33b7906ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747383830, "uuid": "7a07a14c-e089-4288-a484-49aeca83c1c8", "value": "UnHAnaAW.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19cb647e-322f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747383832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747383832, "uuid": "2f0fc925-7466-40e6-973c-8e26624b947b", "comment": "Malware payload (Mirai)", "value": "171cddeb0c105505f566ce0d8618bfbc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747383832, "uuid": "3d65f4d1-8817-47bb-9eea-d1e9fce8c98e", "comment": "Malware payload (Mirai)", "value": "7196fecdd9362424c253df8460a6772ae3b489513ed0933f8663783da71d4244", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747383832, "uuid": "46bc7193-228e-4920-ab71-737bd9f03b40", "comment": "Malware payload (Mirai)", "value": "127297efd38546a616c7322df0ab9ea72301021b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747383832, "uuid": "894efbc7-fa3c-40e8-907f-2effa20f0e69", "comment": "Malware payload (Mirai)", "value": "dc119897569644334df8362f528c8491874398bdc3b670de89daa03777a9d612c0127aea050bfcc4fa0c733a2dbcee8f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747383832, "uuid": "1771bbfa-bca8-4855-94ed-ec048631a376", "value": "T199A3B516BF310FF7E8ABCD3719A51705198C650A22F97B35BA34D818F64B25F1AE3860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747383832, "uuid": "b78dc534-102b-4d98-9c55-4bffc98722c9", "value": "1536:sP8a8N3hXrPpjLUQDW2/BSvBm61iJ6Z46fgG1ZfpD6Fh:sP8a8N3hXrPpLTW8B8BXg3G1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747383832, "uuid": "d61a2d5a-7ecd-4e56-b6b7-4213b9139f01", "value": 105132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747383832, "uuid": "2320108a-54f6-410f-8033-0760172675bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747383832, "uuid": "7f6e1c26-16ef-46ca-949d-78836ee41c96", "value": "UnHAnaAW.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e39efa0a-322f-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747384171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747384171, "uuid": "56c7574f-0a2a-4a9f-af0d-7d7efc98cda2", "comment": "Malware payload", "value": "db1d95f512090b0f7aadf6c356330066", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747384171, "uuid": "81172c72-f1c0-483b-9afd-5a77fdc2a4f1", "comment": "Malware payload", "value": "72129294f30c490cd4a8817262c82e007146df5464c486ca9bf94a9cc2b4fc34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747384171, "uuid": "fc8c1314-c486-4306-b91b-650dbd88a2eb", "comment": "Malware payload", "value": "c6db181217dc1936228406c055ccb1eb6339c98e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747384171, "uuid": "7bf25ca0-91ad-405d-a437-b64532e80156", "comment": "Malware payload", "value": "82824c1f69e1717d91184f12b9a9254f45a3c5d35f33003c0c1bafed494e01c28a03d62d2fe5c3722333d2b4dcaf1112", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747384171, "uuid": "21f5d685-1474-43c0-9388-fc9bb04f4960", "value": "T149D2E09023FD9BE5F1FE13B5555B4870266C78E5CBE9C3AA0F5052B83800054DEB63BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747384171, "uuid": "1b1a805c-cebe-4555-942f-5d3263099795", "value": "4b2df774f65211b4962a056c4da67248", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747384171, "uuid": "5df9e0cd-5ced-4ea2-967c-3166a383cd3b", "value": "768:YIRWpszd/rGZ2aWmj0tpGkAp9zsg+ll+nXGQl0ssMG:/WOe2aCtskcsX8XG40mG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747384171, "uuid": "32f3645b-6b85-49f6-b9f8-8ec7928b9912", "value": 29696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747384171, "uuid": "db8ff8cd-1c16-45e6-beca-b1c583eb630b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747384171, "uuid": "c28377d2-a25a-4e49-9fe6-6ea1dd7c14e0", "value": "SecuriteInfo.com.Trojan.Siggen31.7638.25864.30406", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "905b9fb3-322b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747382313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382313, "uuid": "b8ab2251-ff0f-4376-b18d-eb7aea7ef594", "comment": "Malware payload (Mirai)", "value": "5e99a4002a4f19091de649981f03db83", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382313, "uuid": "d101a677-8f97-4df1-bf0e-e93b8f7f1a2a", "comment": "Malware payload (Mirai)", "value": "7259a1becaea8969f36cbd22a7d6715d564e67701d8a1a3ba03f03ae14cdd4b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382313, "uuid": "6e76118d-5614-4b35-ad22-0527bef77d97", "comment": "Malware payload (Mirai)", "value": "b0299230f0bd9cb61710718f0cdf9020334d0be9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382313, "uuid": "ffe90af0-9b46-4137-9f75-c041a65edb74", "comment": "Malware payload (Mirai)", "value": "d33dc145f7a09473b13613b7b6ef7e1349e695a05ec501bd472705af6e0906d1f9c64d508bd12a5732464e107c8b3f2e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382313, "uuid": "e5b4af2d-c954-47ce-9048-f12e86810d4a", "value": "T1D7B39DABF2071591C8A346F007CB4FDE6E1722C29F57C4E36C6E253E58750DB5A0AB86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382313, "uuid": "16d26d32-9a1c-415a-a43c-aaa6216d10f5", "value": "1536:Rg4uLcytbI96afY2aye7tcOiyRLqlqOgb3a10Z/LWmoo:e4uLcytU968Y2JatcwRLqlqOgbWYqmo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747382313, "uuid": "5f4a7016-9cf1-4a48-aaea-38bf4a4ff788", "value": 117288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747382313, "uuid": "ee72c92e-91c3-4741-a296-239e77dbbb12", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382313, "uuid": "b3c9ba70-8d80-4946-949e-41aee68d04e6", "value": "RpcSecurity.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b99c85d1-321c-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747375940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747375940, "uuid": "eafab831-a37c-42fe-a059-2896aeadfc9a", "comment": "Malware payload (Mirai)", "value": "68d6e25713853a0bc4adc63df8f17b8a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747375940, "uuid": "cae7f455-3ff3-44e8-998a-ce2b0ed1d91e", "comment": "Malware payload (Mirai)", "value": "7272305320ce1625c24cdd3e7ce19463e7fec9596397523ac24f6ea6b1eb38b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747375940, "uuid": "b6afd4f4-30c9-4cb4-b154-3e4f65dab879", "comment": "Malware payload (Mirai)", "value": "32ae5d7f589304a40d64cb53d19c52c561f5fa46", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747375940, "uuid": "393ff97c-f780-4557-b59e-1f0b250fc1c6", "comment": "Malware payload (Mirai)", "value": "cd1c4eb0bd366c4017421fa2320c721af4bc7d048d4de6740d54cadae58147569067191e672b612cd74979107ea03b32", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747375940, "uuid": "ae374ba8-72c6-4bb1-80fa-d86e1a97a698", "value": "T1CEE2E053F1F6D90DDBFD42B04FEE79268050D688A90D82969ECD333D968DF666D001A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747375940, "uuid": "4294d209-2d68-4ee5-82d1-a2572883e1ab", "value": "768:H13yXjjLj0F5DFs/SCPs96SE208ARFzl5nbcuyD7UHQRjJ:V3yX/f0F5qSCPB208ibnouy8HyV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747375940, "uuid": "7dae5e14-61ca-4302-b7ac-6b4d0c8fbe07", "value": 33200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747375940, "uuid": "ea5e0247-e872-4a62-82b6-b608f9e11094", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747375940, "uuid": "84aec615-ca76-4231-b195-cb5651a4bbfb", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5148fa0a-3297-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1747428593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747428593, "uuid": "894c097c-724d-4842-9a03-7e99fca57e48", "comment": "Malware payload (Prometei)", "value": "2008e5f1877b3f1479bb1c2e04c729ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747428593, "uuid": "e5f5b023-ce6a-4247-b83a-13c82db14a1f", "comment": "Malware payload (Prometei)", "value": "73381dbec4d1b8f966420eb4729da11e6c346f4b21e67ff2e111432deec3e597", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747428593, "uuid": "a3a82766-dbb6-45a0-b8a3-d885a0ce3c33", "comment": "Malware payload (Prometei)", "value": "443770831aa597a40ed405a2fed190c7f55cbb32", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747428593, "uuid": "f3790950-be2c-49e2-ab2e-bc8d5aa130fa", "comment": "Malware payload (Prometei)", "value": "746e5e593a38a76aef6841d5560660904d1f8b946da7197fdc805b9794b5bedd9f154e8c30e84689de6b276900c13745", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747428593, "uuid": "449bb2fb-f59b-43a5-826d-54a8b21aecc3", "value": "T1EF9423F8C87D2E3098169B3CBB1A8268F0E15772D9562B6AB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747428593, "uuid": "729de3e0-e5d2-4fb1-8b7b-79fb86334675", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitg/:25WOSACZSV6eKRH5EPiamb4DsDwwcv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747428593, "uuid": "7ee49f5b-aa7f-4f08-ab4a-9a51970a225e", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747428593, "uuid": "84697a0d-c57d-4d9d-8cd7-b30e8ea85b76", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747428593, "uuid": "496e34a3-0733-4442-b608-f7e96710a527", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "216e20bd-32a3-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747433667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747433667, "uuid": "78f58930-042a-4cb8-b0e4-1292b8e4109b", "comment": "Malware payload", "value": "fb809c20c5ee3d891ad874ac42e17cd5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vgszf", "colour": "#2A4731", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747433667, "uuid": "ac068f84-f7ee-449a-a498-2ff224fa6e88", "comment": "Malware payload", "value": "7409f72c3bec45343af484f26fefee09ec591ddc2f87aaff261337209dcbedc4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vgszf", "colour": "#2A4731", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747433667, "uuid": "74d288d3-4714-4631-b317-80a975d713b4", "comment": "Malware payload", "value": "107b5d7614105b0de8e1646cdad6f477093795cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vgszf", "colour": "#2A4731", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747433667, "uuid": "4fad5aed-9ae8-4639-b251-028d757f211f", "comment": "Malware payload", "value": "e906f3e3cf06b43fd35b451563a5c799d81bae0d2dffcc7e501e796468bd43edffe5c8114ed4696c64d98a376e81074f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vgszf", "colour": "#2A4731", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747433667, "uuid": "1ae0af4f-a4fc-4244-91c9-a983a2964dca", "value": "T112236C86836019FAC58BD630C5F69A3BE8B0F9415B2287CF956486B61D61FE03F3D349", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747433667, "uuid": "fbc187e9-8a49-479e-8c1f-76982a5f1f6b", "value": "3e6ea868e005b67b788db20cee385104", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747433667, "uuid": "c4fb4e60-8e57-4123-b586-ebf673efc766", "value": "768:VB2jAkoi0UI1TMbYI3aW31MjHCPip1MmMbC0:VkZe12YI3H1MjHCPizDoC0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747433667, "uuid": "8da08d80-4a90-483b-92fa-2027acb9f4b9", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747433667, "uuid": "0d57fb50-bf76-4e14-8b36-ee7f7a88aa3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747433667, "uuid": "3f80490e-f6c9-42e3-956b-0a21c37f6f12", "value": "kd_drv.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63dca673-32a0-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747432490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747432490, "uuid": "19377a4e-412d-4955-97b4-59b3f2871e88", "comment": "Malware payload", "value": "232fd6efb8dd7263e245871dfd9d9800", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747432490, "uuid": "c2b2fcd5-60e2-4628-86bf-bc9454e7956c", "comment": "Malware payload", "value": "74d622434f05682fb73797e2a5fca9bfda7ba8b23e34a9f653e96b5a96702ddc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747432490, "uuid": "09dfc96b-d60f-4ec1-b9a7-e4678dd87a19", "comment": "Malware payload", "value": "67e4ea8b20730c0bbe22e062c848ee9b1ca30f11", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747432490, "uuid": "8a5a8491-bcfb-40a9-a097-d6d9426497ad", "comment": "Malware payload", "value": "0d4a5fe05d9afd5159f8ed9ff003a883b13acdd5cbc2c130085a4b9ae45e8fe9e732d23ef3e0259828a46e55d4d1170b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747432490, "uuid": "42db004d-26e2-46f0-8a34-3f3e616b8124", "value": "T17D6273063F1B1FF7DC9ACD364A647318089D681D21E9FB3A6A64D844B44B36925F3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747432490, "uuid": "2112a5eb-9b88-42db-a6e3-cbb2176800ca", "value": "384:sv6ZTL2u2B2L2l212o2h2l2W2V2n212A2fIeO7nGOQ6m+QvOnS9:8OyXUyQgt0QfA2gll3t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747432490, "uuid": "077e5e4c-0a64-48e7-bbcd-f4a96726a83a", "value": 15664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747432490, "uuid": "19a337f2-71a5-4ac6-9244-3d00c60c6b9b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747432490, "uuid": "38db756a-41b5-48b5-9125-230a91ac89bd", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1aa6e241-324f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747397577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747397577, "uuid": "f580a98b-f57b-48ba-9366-9608bde5fd9b", "comment": "Malware payload (Mirai)", "value": "46446be4e675e9993b00fda74a452957", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747397577, "uuid": "d93f026c-3243-4e04-bc32-08fff8a01d12", "comment": "Malware payload (Mirai)", "value": "7505011063ab00bcd3113fe2d7c3855d50af49a753015cd9018cbbfe65bd84db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747397577, "uuid": "521a01d4-148b-43a8-9751-9e46af58a19d", "comment": "Malware payload (Mirai)", "value": "a6bbeefd9ac364e59024c043d65fe3facd067380", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747397577, "uuid": "53c0c6d4-dc72-4476-8854-da5db6e95f48", "comment": "Malware payload (Mirai)", "value": "66634b3d6097f1d31687e9acf5ccc5d5770865a341489892155b6849c878b4979f3c7a1c4de34e94a4f48e0540a617c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747397577, "uuid": "97091970-aa18-4580-bfa3-456986b30dec", "value": "T1D863025986D3B95181E179F2F88D86CD3F4A16FCF0AF30F65B8546ACC7C49006CAA70A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747397577, "uuid": "a148160b-93ef-400f-a4e7-05d9d68daffd", "value": "1536:6P3Wgj3rfgPTr6mwhxA6/3BXrTvol8dMu3xwZ3qLY:6Pjj3rOmV/BXvol8dRhqaLY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747397577, "uuid": "ca998d79-beb1-45d0-99f6-ea918d0868ec", "value": 71316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747397577, "uuid": "5f5086e8-f266-4d87-b013-3210b573d8d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747397577, "uuid": "46afbee9-8299-4b8d-8241-a82d48b7d817", "value": "Tsun.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a710f58f-3237-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747387505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747387505, "uuid": "e3ff18c6-b5ca-4867-908c-8b5e009e1980", "comment": "Malware payload (Mirai)", "value": "f5914b2fa0d8242b4160d4065f8a7c6d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747387505, "uuid": "2172e4f8-cab5-48a0-9742-f63aa95696d0", "comment": "Malware payload (Mirai)", "value": "752066ceab980e362e4cd19e486bf750835b838ad4db0f6a4cf317c7e194daf4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747387505, "uuid": "12cac895-3a61-4cdb-bc54-6b251345d59c", "comment": "Malware payload (Mirai)", "value": "0395c191179d9c97ca02e108100961043d0cb663", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747387505, "uuid": "42da8dd2-041e-44d3-afa2-2d522ef08ace", "comment": "Malware payload (Mirai)", "value": "f1940fbd52506e27fc8e23942a3997e3b59021c8d78c56d7ca3449a9d8dbbf1a8dc1c4576927021efc212fdbe1b10385", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747387505, "uuid": "717cfc05-f88d-4b8e-86bd-64fa250e16e1", "value": "T1FA93D71EBF319FBDFAA9823057B79A116B5923D127D1C586E2ACC6002E7034D641FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747387505, "uuid": "e37010ab-322a-4d07-b308-4e38af5c06b2", "value": "1536:zeUS1xavSJsEsS2/EG3dFP7H3Tn55eA/ipxsz:zelxavuP2MG3dFPj3z5+xsz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747387505, "uuid": "b08f1161-5dd4-4c3d-8624-6ee666106e7c", "value": 92972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747387505, "uuid": "f8c318e1-f6f9-4903-85ca-d5ce8549d91f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747387505, "uuid": "1973ded4-4ec6-4b0c-9aca-a68c92b88784", "value": "neon.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48d60f73-3216-11f0-8bd0-42010a9c0005", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1747373174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747373174, "uuid": "ed98c46a-36a2-49f4-a200-391da20b8dd7", "comment": "Malware payload (SnakeKeylogger)", "value": "f464a9256079fc43263fe19adda97547", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747373174, "uuid": "358d87a5-357b-447e-bb44-65dccb418b5c", "comment": "Malware payload (SnakeKeylogger)", "value": "7539e662f669a3436cd5c07186579f1c83f71b16166afe082e764ecf013342d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747373174, "uuid": "97638fae-ddb3-4d92-8c26-f1cfc9e44cb2", "comment": "Malware payload (SnakeKeylogger)", "value": "a61bf538dd0063ad142527f08e6de52b796e766a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747373174, "uuid": "cb2cfbc4-f3fd-47a7-96a1-af52f88fa3a0", "comment": "Malware payload (SnakeKeylogger)", "value": "6c45eb7b52f15bcd8e914450a2916f42b418deedcaa178289e5f195b7ff4cf24b94978b0b372ead433bf103308a5e8b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747373174, "uuid": "47bc6b41-94c1-4548-8cab-b8160ff118c1", "value": "T1F0F412193269DC13D4A31BB41871D3F827B93D9CE521D7879FEC3DDBB8AAA066941302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747373174, "uuid": "a154cf38-cf42-4f0e-be4c-10f6d5255c1a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747373174, "uuid": "9336e5c4-d709-40d6-8803-542e3ecd87a8", "value": "12288:NpMJEZJNe7XVYr/JKA8GUnsvBU9XX+QEfDx2KlOE1mG2HiYOUgeb7c:vbYyJR8GUnspMXnESz6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747373174, "uuid": "3f957ac6-8445-4497-a169-b0d45d2a8ef0", "value": 730624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747373174, "uuid": "87771dc0-9a04-4917-8f24-95bdcbc3a9f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747373174, "uuid": "453bb126-f37c-4700-a1f0-df0f79196563", "value": "SecuriteInfo.com.Win32.MalwareX-gen.25757.16447", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35a7a909-3220-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747377436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747377436, "uuid": "9cebb973-15e5-45e5-b76f-3d1d41bb9af7", "comment": "Malware payload (Mirai)", "value": "2493f16f07d4ef9e86ab57cfdd97fb19", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747377436, "uuid": "ef010ce9-c48a-422f-b9ea-dd5666546fe0", "comment": "Malware payload (Mirai)", "value": "75767d29c1b44a3b450fd8f7476ea101af80336686e006e51c49940a8dbc9622", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747377436, "uuid": "84789c36-e60b-4753-996f-5595b5841157", "comment": "Malware payload (Mirai)", "value": "0bb51430781ecc79a3ee0db857f93250468e6c88", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747377436, "uuid": "c8192f46-84ef-4faf-bd65-eff41d0bb20c", "comment": "Malware payload (Mirai)", "value": "dfcaacf93571e6181d37aaae9afba609ba2185b0d314c8a2b627964abdd2eab934b69ee9fb0d3454b5c34a125c170456", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747377436, "uuid": "20040cbe-73ed-4b10-9020-d87f27e834bb", "value": "T17C1126CEE72CBD158138DE003459A604578986D0B5FC9BF5E4D5CB23A4AB530B878F1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747377436, "uuid": "78519d74-47bd-4571-b5c8-f203910cda51", "value": "24:a7933Ib79wSIE79xNIejIf79KLK/IW7919IB79ysIu79ft9IB79mwIq79iAfIkFD:K34NwHcDkRKLJW1yLy1eftyLmZ6iFkfZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747377436, "uuid": "603fca62-63b1-4f04-810f-cd7a8ca601ac", "value": 1041, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747377436, "uuid": "08bee152-34f0-4fb3-900b-fb060463d8ab", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747377436, "uuid": "0c77e925-8764-4d0f-959e-72b2e328423a", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5962c4f-322b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1747382375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382375, "uuid": "eed9f82b-313a-4ecb-96cf-386cadfd1f58", "comment": "Malware payload (Gafgyt)", "value": "6f64b0b35320db5be2e5f2250ac70b6e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382375, "uuid": "7adaae80-833a-402f-b871-55c25fa5e235", "comment": "Malware payload (Gafgyt)", "value": "75ce382bba5a8d4f4baae671d2c809c435ca4e834795a755c882001a86bdef5f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382375, "uuid": "e20b3761-d010-469e-a494-9b19208ca6f3", "comment": "Malware payload (Gafgyt)", "value": "a617779c3fe603cb725bde30674f33ccc6f83e60", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382375, "uuid": "d1ccec4c-dcbb-425d-9f6d-3ef781ec1e6c", "comment": "Malware payload (Gafgyt)", "value": "055710c9b2ba7b1c1a5f0f4f73d0c3806ec60af4b5e626d68ec9f8a1b180b87996d433e5bec1ceef750ad403b0616a89", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382375, "uuid": "5ff18f51-7c86-4a52-ac5c-7bf7baf57b98", "value": "T1BF14B9449C645B6FDBE3ABFAF75471CF727646881F833309D3285AB013C16EA9919283", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382375, "uuid": "44211f41-f40e-4ba2-b910-b317f6164f91", "value": "3072:CYy4aGXq11zXqwL5StNZf1t3aLUUGPN0ibtNf8eNgJs12Jhvc5PsEsEUxxQLaJlj:CdtfLji09x5bhcsoZCQ9gOS1SeX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747382375, "uuid": "4496fec4-c1d1-4b4d-88db-b521313a50c5", "value": 195733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747382375, "uuid": "d1de3630-4b64-4c2f-9cd6-0eceaa3bb02a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382375, "uuid": "4001fb5f-fcc7-4052-839b-cbaa4718b5c4", "value": "atxhua", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d166257-3227-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747380509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747380509, "uuid": "cf73ab2a-d5a6-41cd-861a-53b474090521", "comment": "Malware payload (Mirai)", "value": "80f55781adde921655a1a6eb2396ea33", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747380509, "uuid": "09e70f3a-15c1-4275-9607-358e6884ae4e", "comment": "Malware payload (Mirai)", "value": "75da5c139bde73604d8d0310e5b496f4f45581bc0f816006cbf49d6390f1691e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747380509, "uuid": "6d65a3a1-d395-40e9-a5ea-3f53938b8130", "comment": "Malware payload (Mirai)", "value": "9f1152e2d1db6c6e40be8119be61f455fb8d6919", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747380509, "uuid": "7eaec4e9-5a2c-477d-852d-51c3703c5552", "comment": "Malware payload (Mirai)", "value": "7917768ec5382d294d6efffceef3166dd32a1987f32775089ff58a70ea65572aab6c14f8b8cab72cff519674567bd1a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747380509, "uuid": "ad5615eb-f7cb-451f-9ad5-65651cf954fc", "value": "T19634B81E6E228F7DF7A8873447B78E24A75933D623E1D585D1ACC2101E6428E641FFB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747380509, "uuid": "b277a8f6-fd56-499b-a97e-4b60accf142e", "value": "3072:zMDG/DI3o0hb/zfwR+1NHVMIwzEY7F01Y4vfXCmZspzHwF1GeKEY:zv/DInDzfwR+z+zEoYnyZpUF1pKEY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747380509, "uuid": "a8ac95ab-ac4a-4b95-aefe-60260efa5d64", "value": 235220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747380509, "uuid": "aab47424-a3f9-4298-82a0-b0583199434d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747380509, "uuid": "2bdcb2ad-c0ed-4611-b6be-7813129f4deb", "value": "neon.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9150e604-325d-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747403789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403789, "uuid": "55d026e3-ca81-4e32-9ad4-3d8d545e310e", "comment": "Malware payload", "value": "0c8cc405eac964a742a3e34fb6e8a322", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403789, "uuid": "a9c76b31-3fe2-4a70-a2e7-1a19fe2ee1ed", "comment": "Malware payload", "value": "75fe14f74e9505cbb75a50344a9887bd89905511473f48c09af5220962a2e427", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403789, "uuid": "13c2b068-96a4-4dcc-b8df-cd3d010c09d6", "comment": "Malware payload", "value": "fc955ec991e82febe35b6be90d8e7919a154915a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403789, "uuid": "b9915e60-f689-4ae8-b848-e164b800a73d", "comment": "Malware payload", "value": "9ed6dc4174fb1511ee7e307af5846bc37b220089424d857e50cefe9fd0b001a54fa552a23fc4ed80ae0f7df4962fc066", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403789, "uuid": "3c41cd71-4b42-49c8-a6ce-fbc15a000c91", "value": "T167A52342F6C648B1E17228326B7867216A7CBD305F758EDF67D03A1DE9605C0EB20B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403789, "uuid": "fe2dfec2-ef98-48e1-b248-b71d05a237ab", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403789, "uuid": "b2f19f2e-3bae-4384-b2a5-80608f2566a7", "value": "49152:IBJwTpc8iYMljoCIrtufFEUPtPSfdjh/SXjlW:yGTFMlFIQDP4fdj4Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747403789, "uuid": "f5cd2bfc-e95a-4c07-b7dd-9b8888040bb8", "value": 2230224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747403789, "uuid": "a0d07342-1e60-431a-8445-48a7110f5242", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403789, "uuid": "452c0489-958c-4c41-83bc-1282468ff2f6", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b78c8d59-325e-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747404283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747404283, "uuid": "64b24844-dae2-499e-8e5e-acc7bc868433", "comment": "Malware payload", "value": "f2d5e2bd1b3639650b5c93497e868425", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747404283, "uuid": "07d93acc-69f7-493d-8617-54162bc5a295", "comment": "Malware payload", "value": "7603220bb8d1de4d8b2851fb753d35d9dba0ffeefe911a4ab2c08b9bd61ba096", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747404283, "uuid": "752640e2-8f1c-454c-9a66-935e761645f9", "comment": "Malware payload", "value": "98def2f80200a804c762a8ded92f58f8ec40a7a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747404283, "uuid": "090e11da-ab18-498f-9223-6101707c6cda", "comment": "Malware payload", "value": "a698fbe66d4ccc6ad0c8de540abf1bf5f913b7aac460542e2b4eff9096f64266220617f3de9758ad49b4b36e01e108b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747404283, "uuid": "21b8b98a-1aac-4b1b-aa2d-3d0dced23343", "value": "T1C7A52342F6C648B1E17228326B7867216A7CBD305F758EDF67D03A1DE9605C0EB20B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747404283, "uuid": "8d5dfd1e-4325-41b7-8829-d4e9cba963c7", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747404283, "uuid": "126546f5-5973-490d-8834-cf3a41b8ee74", "value": "49152:IBJbTpc8iYMljoCIrtufFEUPtPSfdjh/SXjlL:ydTFMlFIQDP4fdj4t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747404283, "uuid": "c852e74c-4837-4c8e-b5af-98694d1f622f", "value": 2230224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747404283, "uuid": "0e6c75a5-7a67-419c-82af-9998b197d855", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747404283, "uuid": "3958a38d-10b4-4798-9b41-5dcbe933af14", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6c08083-3228-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747381116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381116, "uuid": "d3f186c0-ab9b-464f-bf26-a1c3eda1f5e1", "comment": "Malware payload (Mirai)", "value": "c2ccae9fa51a5496a169b49dbfebed77", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381116, "uuid": "8036c952-aeb0-4d68-802d-164d3ac92519", "comment": "Malware payload (Mirai)", "value": "764ac80bfcd658e8915f6c18cc7fee2e25fc493f9e042e7e485082f0a0a696c9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381116, "uuid": "67cdf787-24b0-4d07-9976-adc692314077", "comment": "Malware payload (Mirai)", "value": "f290903bb72cff12d2669f4123592e8baafc8692", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381116, "uuid": "88492161-a226-47cf-b0ef-ec6f8386c594", "comment": "Malware payload (Mirai)", "value": "d1b4dcf41ea7da4511b4b96dfea32387eaa7e36fd311f472a260838916d3b2c9b47c745020aba88a5f34cebb240dfb92", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381116, "uuid": "fd2d7558-d6de-4950-b09d-38e927dd4f0d", "value": "T12153184178919A22C6E4937BFA6E41CD332563ECE1EF7217CC115F10769A82F0EAB791", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381116, "uuid": "d4aa5781-bad0-4121-9e2a-504eb9539eb3", "value": "1536:MH0nmpMSMV3V1IVGZteObws/dsk+1UwNvbyz:MH0hbwqddWND", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747381116, "uuid": "118be645-55a7-41f5-9b5e-85c27062f1e0", "value": 64320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747381116, "uuid": "c9094ba2-7b67-4643-88c4-9159c8c9044d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381116, "uuid": "0278eeaa-c924-4b4a-818f-df69c67afc5f", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69afc0c1-31f7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (DCRat)", "timestamp": 1747359914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747359914, "uuid": "8efab40d-1880-4133-8b47-077a1c9376ab", "comment": "Malware payload (DCRat)", "value": "475cdd21589ec3f5791d2368c48a6eca", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747359914, "uuid": "2de45c3c-fe2d-46f1-92cd-863fe54af31a", "comment": "Malware payload (DCRat)", "value": "769f06587a7ba1fd224022495f4c9743a8070a54a1781cc551ab0068943ce17b", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747359914, "uuid": "a37f3b9a-ec80-422b-8e22-e38bc4992184", "comment": "Malware payload (DCRat)", "value": "3cbbbf16f27015004671a0335b2f7d64bc30729b", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747359914, "uuid": "0b896e55-6930-49f6-b417-8e9d96b85050", "comment": "Malware payload (DCRat)", "value": "59a52bb9eac9aa5ec77503672181bc4f34fd5e9dcee3adc557194c30e0a91319267cb995830006debddb22d86078c843", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747359914, "uuid": "9d7cff06-b613-4077-bf0b-b76fe1f51481", "value": "T162E5D00669D78E72C36057314A67423D82A4DB313622EB5F3A0F25D6B9177F08B762B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747359914, "uuid": "0d88a93d-75ff-4453-9e08-17c4635124c4", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747359914, "uuid": "b35fe8de-8e41-4eb2-9aef-8fd66498e91a", "value": "49152:IBJgK/2Cq6Okl4l12eL2QZirV7XL69z8eR9kTQph4GIj7CsYr:yCKOC5Okl4l1/CgidXpeR9cQejZYr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747359914, "uuid": "aa67b703-b0ab-44b7-bc59-5ffcbccaffb4", "value": 3134796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747359914, "uuid": "f9743588-d671-495c-bd48-46c0e22e7060", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747359914, "uuid": "fb5b33c4-021b-425e-bd6b-e7be3a859e46", "value": "475cdd21589ec3f5791d2368c48a6eca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa0ef068-31fe-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747363029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747363029, "uuid": "1476daa8-9f29-4f1a-8a50-7b7d7d16e1bc", "comment": "Malware payload (Mirai)", "value": "bbd63015aacb85f89522f2839d2e6d85", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747363029, "uuid": "83cb35f0-a2d2-469f-87da-65c4994e2555", "comment": "Malware payload (Mirai)", "value": "76ab8550829a50b709633f175e0ae399dc5e5b2a739d5d6f82616bbae0acc965", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747363029, "uuid": "6807230e-3e14-4601-99d7-d14847023ad0", "comment": "Malware payload (Mirai)", "value": "1e6a39ed81785cb32ba58530fdd66264ca1ba528", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747363029, "uuid": "986cd542-0964-45fc-81b2-7c0a3e97f0cb", "comment": "Malware payload (Mirai)", "value": "310b9b4cb74fdcd687ca296a0a66c297fc9ac78dc52038225b9e7bcd2d425c6a8a849540490b2b32d2b83b4e3f84a282", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747363029, "uuid": "247f84e8-b18e-40d4-b65d-a99beb2ce193", "value": "T13FE2D052D6E0578EC4AF92342CEDFA5E1000E0476271C9B1FEC8F5BBAD95A285978783", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747363029, "uuid": "ab3c41c3-f6b1-40b8-a26e-a103ceab7169", "value": "768:Ag83EVer5iqPbFdi3gZktp1FEo1Xs2/bA+Ww+dxEO5cLRSjAM+3/9nbcuyD7UHQu:+/iQ01FEo1cEbrUxOJ/9nouy8HyE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747363029, "uuid": "df8ac00c-8ec4-47cf-a4ce-7613269004f5", "value": 31708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747363029, "uuid": "3f929555-c529-48c2-9bfa-d9725da371a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747363029, "uuid": "42457e2e-ccc1-4338-882b-ac4151139930", "value": "neon.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca017e2b-3281-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747419346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747419346, "uuid": "eb95773f-776f-43f6-804c-ea88d1ac31d3", "comment": "Malware payload", "value": "fc0d1e54f5481c545fa5a1962ee5ee80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747419346, "uuid": "ad7fbeec-1958-49ab-94bd-e6ed2dea106c", "comment": "Malware payload", "value": "76acce3bc4af9224b0290ab038d72f8d8266870d87e0204cbbfdd2c5ab938e0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747419346, "uuid": "b1b65f44-d227-4587-9a8e-3f97e84d41c1", "comment": "Malware payload", "value": "bc696a922cd350b2573de12af84959c2969d992a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747419346, "uuid": "61739dfc-6322-4741-88d2-025df3f66931", "comment": "Malware payload", "value": "cc449d1c6d3d7133b3c0e8f5e7e32d1b18f7e45aee41e2818a5ceca52a063aca6734c1b0de3b8ce77b9bf816b8e4e8c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747419346, "uuid": "911c67f0-8234-4be3-be1f-cdcc948774a8", "value": "T16AE20707B6B505FCE1ABA27899E32D07E3BA381517618ACF4340456B1F736E0AD3B745", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747419346, "uuid": "433da5f8-885e-4e9b-92f1-5c5f604a1656", "value": "193c19492f07d7e4f654f0ff037d6f1e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747419346, "uuid": "b47b2cc8-17f5-48d6-93b1-7b245ed38ce2", "value": "384:w5r3CFr/RsuLh8z9+DXctNnjA1h0lnVdyR5KKFOtNp2XX7FOi+3w0WJAU4Qe0U0u:1mkX7FQw0WyU4P0PLrGi3WTV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747419346, "uuid": "44c7c09b-2b39-4398-8fb5-2ca44353af42", "value": 32256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747419346, "uuid": "fbeb9392-ac07-4b0e-a77d-bc6f50dd993f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747419346, "uuid": "7ebe5351-f201-4c37-9e54-b51ab4a96932", "value": "yesyes.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec791c06-3234-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RemcosRAT)", "timestamp": 1747386333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386333, "uuid": "7f112e52-315f-4fb2-bc7a-a61566a56510", "comment": "Malware payload (RemcosRAT)", "value": "d2bbc3ba991b412daa22e480a2db4beb", "object_relation": "md5", "Tag": [ { "name": "196-251-90-185", "colour": "#01F3BE", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386333, "uuid": "2cc3db04-4392-4fbd-b0ce-93e180562bba", "comment": "Malware payload (RemcosRAT)", "value": "76dfa69e280db2d4bca1142b239f2add35597a8f9dc3d93d4a43a3c81465af0d", "object_relation": "sha256", "Tag": [ { "name": "196-251-90-185", "colour": "#01F3BE", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386333, "uuid": "a800c88b-6d6f-4380-bc58-817ac268a8e5", "comment": "Malware payload (RemcosRAT)", "value": "e9d143af626575e64081e3174ce7c638f1bcfab9", "object_relation": "sha1", "Tag": [ { "name": "196-251-90-185", "colour": "#01F3BE", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386333, "uuid": "15f05f1c-3bd3-43be-98be-4854a7225c76", "comment": "Malware payload (RemcosRAT)", "value": "03ec8de253aa51acf1ae363c3417b2c6de3a3633d4328a4022063d409ac3169e58363fccfff0e14222c97bc3e2c34802", "object_relation": "sha3-384", "Tag": [ { "name": "196-251-90-185", "colour": "#01F3BE", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386333, "uuid": "4847f121-9ace-4b4b-ab45-1549ab93d319", "value": "T1BA91F82C7B080DA74528BA6B0FBCC698F46D50AD823E65D7F0C882114740E66C2EE747", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386333, "uuid": "6042b9ad-16bb-417a-b326-d25b3d06ecae", "value": "96:gwA7Vp3k9OcrOOwINhRNdXQYtj9wPUwrITC30XYP3+u3wn9:EVk9Zr/Nh5g6wcw6+0IvR3wn9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747386333, "uuid": "718f58fa-5934-4539-90f5-22ed15627296", "value": 4413, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747386333, "uuid": "609df281-5a63-4720-8a0d-d992ca217f76", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386333, "uuid": "4722584e-ab48-447a-af57-49eaafe2b5a1", "value": "afkaste.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0da2b18-3225-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747379844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747379844, "uuid": "66ff27ca-559a-4f8b-a7b7-246284efe754", "comment": "Malware payload", "value": "8fec274a00cc42e408e8dabf64f56839", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747379844, "uuid": "d7b910b1-fe75-4883-b5f1-22ba3e22b218", "comment": "Malware payload", "value": "7708b1297b6e9d485dae7dce0c146d310844bc9187fdb4e343b080698e9773b8", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747379844, "uuid": "c47b88c0-ac1d-4337-9e45-cd340f7f25ce", "comment": "Malware payload", "value": "e7a6392d4ec6772da4d3bc518b9b31703d134b8d", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747379844, "uuid": "ab24b904-1e9d-4fe2-9b7a-9a9ea390e571", "comment": "Malware payload", "value": "7d9199c20ada5b22bdc73feef91fb36cbe08e3149c60ca9fa2a3df836ff96e2e566cebae14148b7a927cdc525cfe7876", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747379844, "uuid": "1f60b563-a13f-4288-9512-5f353602b89c", "value": "T125F09EE70C97D94FE7502604CEA9B1F89589438508F8982A51E4D8A9B97125D8D53534", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747379844, "uuid": "26c6ffd6-9829-41db-a188-6f42ec93b289", "value": "12:kxvsCk9cE3MotZjo/XUloJ/YFbUDIVMkqLVYI:kbxw8/keN2I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747379844, "uuid": "deb0cfcd-61f8-4809-a023-9fc64a00fdb5", "value": 496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747379844, "uuid": "f3b56c5c-b4a7-4e9a-a919-f4c65c32b2cd", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747379844, "uuid": "b4fbeed1-bcff-449c-86fd-cf451e1a56c1", "value": "fuck_niggers_10.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01085e10-3273-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747412996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412996, "uuid": "d8f1951e-432d-4ff7-942c-f577ea9b2cf7", "comment": "Malware payload (Mirai)", "value": "d80f103669eda4c378e6972f2aafe3ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412996, "uuid": "3bc54b2c-c8a2-4c88-b18c-8d9630d7bb55", "comment": "Malware payload (Mirai)", "value": "77380b85687c57228beac368f92d782571f6636604f200833b4c995f6e19f8c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412996, "uuid": "d7d6f6bb-e33f-4ffa-a921-6d7ede6034b0", "comment": "Malware payload (Mirai)", "value": "cbbd9ca3b3353ef9959266ac6797e7abe8050261", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412996, "uuid": "f72763a4-6a2b-4767-8c08-705023b56074", "comment": "Malware payload (Mirai)", "value": "71b3e320d1925d59b539e1df37807516a54d5fc6238031af3cde800d4a62a143e4e08ec6a1dfdd8ea5da48eb2846c0ac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747412996, "uuid": "846590eb-8908-4803-a829-37c54f1acf9f", "value": "T183530985B8819A25C6D113BBFE1F018E3316576CE2DE73129D141F607BCB95F0E2BA0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747412996, "uuid": "0cfc2c4a-3a5d-42c5-8c2c-2dbe157dd853", "value": "1536:wdnIYoZXnYkTAcASlquASBAFzVLl1kHQwOcL/IBikcKJKWx:FFnRUcvlqCuhLlUQcKJKWx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747412996, "uuid": "12e616ff-e6cc-4969-9eb5-52aa4f20f33c", "value": 66688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747412996, "uuid": "243abfdb-9d36-4ba4-aa17-f6c6ef64a64c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747412996, "uuid": "6e9129b4-0779-468f-9fd2-ef6fb345c8fc", "value": "Josho.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d2a1af0-3245-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1747393448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747393448, "uuid": "915bfc31-f1e9-4c34-a664-d0350f7a3adf", "comment": "Malware payload (Gafgyt)", "value": "cb956f43b8618184bca41d1d9a9af754", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747393448, "uuid": "3b4e5dd3-bff2-44c6-8112-c49f0af380b5", "comment": "Malware payload (Gafgyt)", "value": "77c1297c42f1acb5e5a50ce644b0f65e2c6e0937ce4808ac354e30ca80aea76c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747393448, "uuid": "a684afd3-5a67-45d6-91d8-bb91239381ad", "comment": "Malware payload (Gafgyt)", "value": "bee7aaa451ccdfb668360990f94d783a54990a57", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747393448, "uuid": "5aafdfd7-a2ae-43dd-840f-dfdf9b585815", "comment": "Malware payload (Gafgyt)", "value": "e3b57296db4bd31b2f9a5b8c04a73a12fa8a711a3c954e354fc4632e07703cf68c13d1ee57e5241947d290fddb35fe05", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747393448, "uuid": "db7eb510-c0dc-439b-84a0-11b00c4ce948", "value": "T1FDB31B93F515D5B6F44AE73308D38B247270FAA14F53152263173BAAAE362D4386BF42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747393448, "uuid": "b9417847-3c11-4c4c-9249-cb61516ef958", "value": "3072:BwQeqacWucW0JcWcBeNX2WfKIwMI278ORF/qnFY3mzmmHqzTQKHKtW:BwQeqacWucW0JcWcBYmVM978OaO8mmHe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747393448, "uuid": "cd4a0dd5-4cd2-417d-83c4-e63cc8249aea", "value": 109567, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747393448, "uuid": "7c54d04d-0bc1-44cb-b350-6aac7a75d299", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747393448, "uuid": "ea367589-0062-4cd3-90be-3a4d3d2ea72a", "value": "rebirth.m68", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89ce5a2f-3235-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747386597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386597, "uuid": "5b03f3de-b9dc-483d-936b-12ba1da9539e", "comment": "Malware payload", "value": "0b0a2a720f02cf6b67dc79d1a599211f", "object_relation": "md5", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386597, "uuid": "c99f25e5-a592-4f76-a24a-90cb7259459e", "comment": "Malware payload", "value": "77f96150b49a36ea64cf9363831e1a25e4a2657532059c1daa8dd318d732c4a2", "object_relation": "sha256", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386597, "uuid": "9b4ad1f3-7fef-42d4-bfbf-25c60270cdc6", "comment": "Malware payload", "value": "a8b065dc8878c3a9253c43d81b52671b7ae38189", "object_relation": "sha1", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386597, "uuid": "00f58595-7f70-4468-bfb3-6e42908d01cb", "comment": "Malware payload", "value": "c95c847e17639b38d787a759d5a1063c8ab79ac584efae708880dd51baea708e5d43d41619536cd1c39832631fac64f8", "object_relation": "sha3-384", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386597, "uuid": "aa477261-bca6-4ba9-8c33-73d882d67b8f", "value": "T10A25337EAB7E0CE9FD53203349252EB24C8B35CF8D180927C667129F49E97937A24593", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386597, "uuid": "518c2c7b-d088-4653-820d-db1005c11fb6", "value": "24576:yNmtAsCAK0eFbf7D38Z1CtRQV/2zGrViMAEhc6W0FBZCoI:yNYC4eNf7DcCusqBiMAEVX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747386597, "uuid": "8ab84e1a-da9d-44f3-badc-495c37d474e7", "value": 1037506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747386597, "uuid": "d5b0ad22-c352-4687-b757-4daf2060877b", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386597, "uuid": "eb7b1adc-0b34-4d36-8658-bfa7f1f6ec44", "value": "TradingView.dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c26c0989-327d-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747417616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747417616, "uuid": "f8af40b5-ad0e-4a19-8d15-c8e2f6f6704c", "comment": "Malware payload", "value": "fa1ebddbb15f0b516ee6b498f6349740", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747417616, "uuid": "1eac3349-932d-4bec-bf31-1bcd5f8d0573", "comment": "Malware payload", "value": "780bfcf9aba2e0a257912db9954b2ce7a881a8ceb7829b61631200773cd1fd16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747417616, "uuid": "617d2df8-9eaa-45a2-a80b-3a9edc9c990c", "comment": "Malware payload", "value": "22692c54946759e3c5f0901c254e2a67fce224eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747417616, "uuid": "202453dd-44b7-40c8-bc28-df4594014999", "comment": "Malware payload", "value": "7de565c4173bdb9409c4d3713305496333ea4af14ce6fe989a6683118c97ebf6874c4a4b393f9bb781c49a3ac673fb87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747417616, "uuid": "3a89298e-3afc-46af-bf88-d2b88d87121c", "value": "T1E6648D227A508475D66303334D28B75599BEBA711F32539B7BE81B0DCFB01C1AA3A367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747417616, "uuid": "d2e9e181-1bfe-4fd5-b206-13e836e51f5b", "value": "51ca9c46373f1c0875b1d6f02a15b195", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747417616, "uuid": "0145760b-3998-4232-9195-98e0f4c95a1d", "value": "6144:ZyTTp1SVak++mYPbtegkOTa/c+RbdEVyVKjIir8rNPYqCilo:8SVat+mYPbW/ceboylcglGr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747417616, "uuid": "34397b43-674c-443e-bea5-b3255aecc650", "value": 315904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747417616, "uuid": "6da18d3a-6ada-4dd5-8d23-ff1ae8064251", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747417616, "uuid": "2f1897c2-25d2-4540-9015-e8201af99892", "value": "KingdomCome-SAFEVERSION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18f0e6b2-3200-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1747363644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747363644, "uuid": "845b1e5f-08d1-4d25-b9a7-7fcd1b26f41d", "comment": "Malware payload (Prometei)", "value": "2c7cb37da051ab653acc209ab5a72a79", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747363644, "uuid": "776d86d3-6081-4c7c-82b5-ac45744c2a9e", "comment": "Malware payload (Prometei)", "value": "78450d422d60b8259cc8d063623f7c6f50183ebe7b3f74644b659c3f5badb119", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747363644, "uuid": "4db6422b-9c7f-4ade-ac41-f1f3ee9acc5e", "comment": "Malware payload (Prometei)", "value": "9cc07a48321b33ed969ed9d36d64d7dab9bbc8f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747363644, "uuid": "f82153ef-4cb1-4177-b4da-80a4b01c3fe8", "comment": "Malware payload (Prometei)", "value": "76b94bd2bbe9dedd441a4c460c337ce6a7c7e74fc9c41886235ad0f32f7dee5910a6b74d53c6279a840da514f0132ba5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747363644, "uuid": "ba44aea2-5095-4cd5-a3b3-99fdba90f357", "value": "T1869423F8C87D2E3098169B3CBB1A826CF0A15772D9562F6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747363644, "uuid": "00522cec-d058-48a4-8ff6-f474b21a0ea2", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgc:25WOSACZSV6eKRH5EPiamb4DsDwwcM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747363644, "uuid": "bf95f10b-7f74-4456-989d-3f65a14a02da", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747363644, "uuid": "b2f10700-f749-4ca5-93de-b65378e9082a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747363644, "uuid": "40b52d42-80ed-4273-8ad0-ee8873ac2ecd", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77fd9771-3235-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747386567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386567, "uuid": "f5fc3efb-ca5e-4236-85d1-9a5bb1854193", "comment": "Malware payload", "value": "1651c71d9f2ac41dffb506b5a42f4117", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386567, "uuid": "b08d0c83-391d-428f-aa0e-f873e3253319", "comment": "Malware payload", "value": "78a98022a6a2e258665a29daa0296c147571880b3132a9dc0ea255f1992b7d0a", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386567, "uuid": "7a37d5b0-66e2-44e1-b977-8e65cdb4db8b", "comment": "Malware payload", "value": "d244d02622be580ab773cf30d5a48855a320c10d", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386567, "uuid": "5e487266-08ef-48e8-81b2-47b3f59ad9f3", "comment": "Malware payload", "value": "9568d8e48b22156b7f21decfa2e22245d87e3aefa84f3da09ec2a7ef426767b7c36ca1a294a75ab457141b16f5ffcd76", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386567, "uuid": "4c67eed7-7ad2-40ef-89ce-68851c5ee75f", "value": "T13775015DF2D83F1BCD9701BB212A1291A5DCFC400381CB5BEA925BBB7D287AC1C17A95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386567, "uuid": "be8deee8-6bad-4106-af2a-8d7b5511a702", "value": "12288:8j9Mnd95QHdFCbtdSPTB9Mnd95QHdFCbtdSbRC:8ZohICbaohoCbR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747386567, "uuid": "8706e361-de86-4c06-a16a-77253dfad5e5", "value": 1584016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747386567, "uuid": "7773e972-0ed5-4149-869f-0e3790d4546c", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386567, "uuid": "3e73d703-1a14-47ff-a7e5-d5d92825cdac", "value": "restart", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1aa8439-322b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747382449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382449, "uuid": "77d2d807-b42c-4f53-99c9-ac0a801873b6", "comment": "Malware payload (Mirai)", "value": "b58243853198d17f12e17942b5a63c6b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382449, "uuid": "fb054533-af54-4c3e-bb28-65eedccfdb99", "comment": "Malware payload (Mirai)", "value": "790089bbf537493b8b5baaf5eb21032cd0e3a1f9404a0b5c6f6202ae11e0efde", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382449, "uuid": "32ce6d37-0e91-4fea-bb68-2bc969d00601", "comment": "Malware payload (Mirai)", "value": "ff0d200c646953f31522ea1f4184a460446b8c7e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382449, "uuid": "1070b130-c05f-436b-9860-975b1c65c6c5", "comment": "Malware payload (Mirai)", "value": "37a32fd133b90b6bc5d552984afe55f2dc98fbe3f99b787c17cb27d75c643f689ec9ca541860c4727e01c33a26943537", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382449, "uuid": "1e8f0123-9f4f-42e7-8c83-9f1a0e47f7ed", "value": "T1C8630985B8819A25C6D553BBFE1F008D3316576CE2DE73128D141F647BCB92F0E6BA0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382449, "uuid": "e238cd9d-b9a3-493a-9646-679741459c4f", "value": "1536:5InBClQ5NoAIK4G2TAGn8QCiyAMF1HLhqULaIMiiZGeKWF:gAQNITxTvn+zXFhoZGeKWF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747382449, "uuid": "2a01d56d-25ac-4128-8b79-bc0293c50b1c", "value": 67416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747382449, "uuid": "642b9621-b14a-4b41-8d73-ef28b88426cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382449, "uuid": "ef9d20db-1e3b-4892-9175-70fefbf83ecb", "value": "phantom.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "437ab79e-324f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747397646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747397646, "uuid": "ba1df9f8-a2c1-4dd7-a9b7-4c988b7f1af1", "comment": "Malware payload (Mirai)", "value": "83867fdde29576979e955837269e0b46", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747397646, "uuid": "a656fd73-3d89-4ea5-92de-9583d53a7047", "comment": "Malware payload (Mirai)", "value": "792b7b0a3d8b79310b9171f8bf683af7ead6f4ff797fde625de2f92c21e64311", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747397646, "uuid": "c035ee66-a9b9-4eb7-bd00-edf25c07211b", "comment": "Malware payload (Mirai)", "value": "69e855b977b0338130ed873d717394019865e41e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747397646, "uuid": "b367ddf6-52bf-4b45-80d0-32df297765e7", "comment": "Malware payload (Mirai)", "value": "05282d693f13ef7d9236045e958b56c2ee93acb2f30d3b6be87fc34b386f73b36555b2e17853928274a9432b36cf6f36", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747397646, "uuid": "fd60cf4b-7f1b-4f18-84e2-0e5159a5c165", "value": "T124516CC623C399303C629A6BB6BE491932C0D19D9EC5EA4CAEDC3CF9568CF583444757", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747397646, "uuid": "a156f0cc-fcea-4f0f-a59c-5b37d99069e1", "value": "24:vfn0wn0KdlfngjngCikfnrnQyfninbfn0nDfn0vn0DdofnGKnZBfnnxnBfnQnnft:vMxKdlYE0hukM8Ddo++vX0bis+rathb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747397646, "uuid": "66c2fc87-1938-48dd-9194-8e55296d0eda", "value": 2655, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747397646, "uuid": "81cf2e7f-9d97-4932-b653-f90e1758cb7d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747397646, "uuid": "6ae8bb79-7880-4ed2-80a8-2ded71295d99", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0f5c19e-328a-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747423143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747423143, "uuid": "ade61f05-b2e7-4b97-ad58-0c8ea52d315b", "comment": "Malware payload", "value": "ad73eda94d240bd64aaff29ab6b84a0f", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747423143, "uuid": "d439711b-16d2-4fac-92c1-6ed43310374d", "comment": "Malware payload", "value": "792b915f3684861a7167b1c3c46aed3f03c9f17c96ce3314a64e9f2189335b6e", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747423143, "uuid": "51e332a7-8442-4cea-9fb4-9c5752acf32d", "comment": "Malware payload", "value": "65ce9b947d5a95d0fdb0c15527fefeba908fa0fc", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747423143, "uuid": "d2ad6e53-e8e6-407a-8e0f-f45c36541473", "comment": "Malware payload", "value": "9f500e6e7ba3b69dbc277ee1d028039a1bc2780d864bbc7b60007200a53e9cbeefe8e82a583cd6284727709f76802b3d", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747423143, "uuid": "874e74fe-bedd-4919-9d76-a29ee14e052e", "value": "T1F7A5336D7916D1FE7ECDA27A5262E0E02C4630EADC519D979F824DDC038BEB0A9F401D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747423143, "uuid": "f6f4de17-b445-44ed-aa61-e77cec82ad7e", "value": "49152:KmoVJdUPrJjdSBmAT61Q3Thul9fPAjry82hx6BlYMf2mZl:KmoVTUPPxAT61QDhul9fM+nEzYCZl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747423143, "uuid": "e1a0d209-0855-4e0d-8c49-82d320eac8ec", "value": 2089806, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747423143, "uuid": "c5972d62-0a02-4535-b5b9-140542e3e5a3", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747423143, "uuid": "26a8264e-fe16-4337-af24-ae11d68a8a6f", "value": "Bank Swift.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9744e8f0-321a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747375023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747375023, "uuid": "19bf78e4-ff74-44bd-9e75-3b5205440a24", "comment": "Malware payload (Mirai)", "value": "2df4e9029f7174c9f8ad427e1035d3ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747375023, "uuid": "a5c8e584-4103-4bfd-998c-344330ee7831", "comment": "Malware payload (Mirai)", "value": "796445b5dd28ec833cc6d21ed64d2f8b999920939a918d510d3304a76488df77", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747375023, "uuid": "aa7a128c-6420-43be-b6cc-4027874ebb58", "comment": "Malware payload (Mirai)", "value": "59eaa3b4cff2d2bd5529ea6da5b74dc4720e0da1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747375023, "uuid": "1043fbf2-0e3c-40c3-bc80-653609c9fad4", "comment": "Malware payload (Mirai)", "value": "3bdb90ae05f9e3df4b7a90f2726f60486d92050cfccedf7746847fc2dd30c5ace6240046e847556ec446db727aac06b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747375023, "uuid": "0fb74541-150a-452e-bc2e-dd66f6ef4f41", "value": "T14AE2E1E3B27FFAB4C2260A7721CB41C8FDB1B54687210B7959DB36FC985E54864117C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747375023, "uuid": "fe32214f-4fe9-4c25-99d3-92de741610fb", "value": "768:f7Dm0WM7CSpYcXk2IbAn+ZwMGrxC0a1ye+ZD2b41XRWSx0f6:f7rWQphj+ZjGrx9a941b66", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747375023, "uuid": "3f39de89-6e21-44bc-bd86-51ca0c82e467", "value": 33456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747375023, "uuid": "a93fbd6b-1b97-4c50-90c0-1256de33c24e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747375023, "uuid": "ce297769-5044-4d06-b89d-d9d900bbe3cc", "value": "neon.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee9f9f2a-320b-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747368727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747368727, "uuid": "5ede2244-3022-4733-a934-97c9d6c4bdf8", "comment": "Malware payload", "value": "c82b2dca76075b292680e385f1e15699", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747368727, "uuid": "629a0927-0abe-412f-8bb0-3be4dc13417f", "comment": "Malware payload", "value": "7987168462140b0cc8fe89c35216e8be11be3f85e20ecaf5a5a0e6a3f2b1440d", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747368727, "uuid": "633200f2-b8e3-46c6-aa99-bc1353f2cced", "comment": "Malware payload", "value": "88e0c8a823ea96a8606214532396b488e4a3b2db", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747368727, "uuid": "07038fc3-916f-4de0-8257-44613bcdba85", "comment": "Malware payload", "value": "a3af216816ee799b2009d33e107de68876a70501b644702a50aba2c84a4561d07fc39c8a5642f467882e0f536bb3f39f", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747368727, "uuid": "cc8e459c-1338-42ce-988b-7f69463b148f", "value": "T154F09EDB08D7C58CFAA034849F6753A8644800B5288DD629A0F498A9B53265EDD151B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747368727, "uuid": "bab85447-749d-456a-affa-e9b986b35335", "value": "6:qzxUQjwCX96IABmELDMoQlZh75cTr4g70x1uIPushl4vMfUmA+6t1Y96OQP4iVl0:kxvsCk9cE3Mod/XUlpJgtzIiVGJYI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747368727, "uuid": "023cc4bd-8007-4dba-b9f9-c8820d5c3f69", "value": 497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747368727, "uuid": "b1bbf84b-b97f-403d-a0b8-15e8e550cf1a", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747368727, "uuid": "ed381ad0-db2c-4e52-92b1-26d21845e6ce", "value": "fuck_niggers_49.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a358fb90-327a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1747416275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747416275, "uuid": "32a20798-d7ef-45e2-a0da-c1d2951cef8b", "comment": "Malware payload (Prometei)", "value": "80171b5181d6070cd24f8250e1454a23", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747416275, "uuid": "53e6ec6c-43bb-4757-8cd5-d964e2fe21e5", "comment": "Malware payload (Prometei)", "value": "7a0ba460dd26ae02cf0df9f6137afe9aa2665caf0ea286d35523d0ce21c33dfd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747416275, "uuid": "8e9d1a83-fec6-4815-96e2-6f81a965c7c3", "comment": "Malware payload (Prometei)", "value": "c59b234e6b0d5d87714c35467ccf3be85dc5601b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747416275, "uuid": "8bd4b46f-bbb7-4ebd-a38e-168f18c76eb4", "comment": "Malware payload (Prometei)", "value": "da8d522fbaed45ceeb056811d0738d71b32c1637d26d4c29a81e472f28599cf3f6fdb83aef079cca6dedb877a2b20300", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747416275, "uuid": "99375b61-7799-4cc5-bed6-dba2bdb195d7", "value": "T18A9423F8C87D2E30D8169B3CBB1A826CF0A15772D9562B7EB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747416275, "uuid": "aadc0ab5-db62-43f3-a7b7-949bd0375996", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgV:25WOSACZSV6eKRH5EPiamb4DsDwwcF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747416275, "uuid": "67065003-ae3a-4bcb-887a-56360861cc34", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747416275, "uuid": "1f0f340f-c846-4672-924a-adba808b48b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747416275, "uuid": "bfdd4b29-9ad7-480c-a86f-bc18f5fa82da", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cf56f1a-3264-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1747406654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747406654, "uuid": "e7e02334-c747-4178-aca4-7558c14e88fc", "comment": "Malware payload (Prometei)", "value": "b7f6db3477f4fb8e05aabfed78af9be1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747406654, "uuid": "116ffcb9-2325-4b50-b982-1721ca806795", "comment": "Malware payload (Prometei)", "value": "7aa460e7755823d8f2f80e5f7ddf7801eb61d47fb3f6deabbd068bb1116dd95d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747406654, "uuid": "7d751d6f-89cd-4278-bf59-800abe079bfa", "comment": "Malware payload (Prometei)", "value": "12440459cf20e982f9b35a7aaeba15a5bca11e8a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747406654, "uuid": "7c9bb051-336b-4a38-8dfc-168479a684f4", "comment": "Malware payload (Prometei)", "value": "09fa60a978177ca18a0b44e3226f9e30f2122873ac9999efe27a1900ef4f6c0c0803f59dd37c5220622444c7a62cad71", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747406654, "uuid": "d5ad4ec8-fd28-4d47-bc2d-2f985542d2a2", "value": "T1CD155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747406654, "uuid": "ca898d12-ee56-4cb8-9bff-2aaab68bf4f2", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8MplT:qmShf4OTjMgXSJhBXEsVrmz9MOup1KhY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747406654, "uuid": "0d3493cc-8762-4fc7-ac36-4def09fd0f09", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747406654, "uuid": "68cad5d4-a1d6-46af-a61a-da6ae42f448b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747406654, "uuid": "e683dbb4-8529-4127-8e13-cb55b13c411d", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61b57cd3-3229-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747381376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381376, "uuid": "342ef4a4-39eb-4271-b10b-6ccb54b40d6c", "comment": "Malware payload (Mirai)", "value": "7fc7833a06a35572d369341b7aaf86ef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381376, "uuid": "0fe3e4d0-efb5-4add-a2ae-1249f7bd0e40", "comment": "Malware payload (Mirai)", "value": "7acfedd2b92a0d344c1ae07d037be2dadcf1f27f64fbd72c18ceb03d53c2d6b9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381376, "uuid": "abfb3164-1604-4110-a886-2e9e38b7cef3", "comment": "Malware payload (Mirai)", "value": "37fcbddb55a04ab537a7de9a925022cd82331db8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381376, "uuid": "a1842c08-f645-4b61-8327-9ef6d1c99f41", "comment": "Malware payload (Mirai)", "value": "7e6f7de5041854a5518181f2cb2a7a743447f482d7bbc12b0c07953ec86cc9764ec81ba03b5bfbe225ef62a74e20e6a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381376, "uuid": "f18b68eb-756f-44ad-bc98-00abf48f7889", "value": "T19C633A51BD819B12C6D1127BFB6E428D772613A8E2EE3307DD256F21378B82B0E77641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381376, "uuid": "962b5ab8-3d47-4e18-84d8-f2bc4fffc978", "value": "1536:Uw9QTo6XeRotBb/zJl6aeizRM/OO/CcBE/Nf7ASn:59QmRotdll6aeASBERf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747381376, "uuid": "c042a6f6-1766-407d-8d47-a7b145e2a712", "value": 72396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747381376, "uuid": "b5da533c-75f2-4365-bcdb-5bd7437f263a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381376, "uuid": "eee49a37-d765-4474-8662-ae6b22ffbec5", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60ad7272-3229-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1747381374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381374, "uuid": "5a23bb4f-2ac5-4fad-8c98-6d911c5871c0", "comment": "Malware payload (Prometei)", "value": "a04f8d0a07137be58448705d1b24db54", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381374, "uuid": "ce3ffe44-5c38-4f63-8220-ca9c4b320030", "comment": "Malware payload (Prometei)", "value": "7af71da29e76bb60dfa89091f72b1e93672decdbf5098eec487b87b18e3d7cd3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381374, "uuid": "e944522a-0b7d-48d3-949d-f18db38c0799", "comment": "Malware payload (Prometei)", "value": "7966328b5b3354f296cc4fcf1b43f65246ffd8ad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381374, "uuid": "d0efd52e-8f5e-43b7-bac2-b822b37799ec", "comment": "Malware payload (Prometei)", "value": "e00f80ded183b9fec4b3d11d01b9b1025e172d05ef3a1d95869e63a0ed212c0547e133efdaf24306e80ca77f68a49dcf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381374, "uuid": "6fbf24d4-9276-43ef-bccb-03f544bca176", "value": "T1C29423F8C87D2E3098169B3CBB1A826CF0E15772D9562F6EB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381374, "uuid": "44d8d3fc-7605-4f27-9cf9-cbcad938db38", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgf:25WOSACZSV6eKRH5EPiamb4DsDwwcP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747381374, "uuid": "2a01e051-5efd-451f-8986-f4a4f03d2b93", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747381374, "uuid": "7de37623-fbfb-4555-9628-611bf8f5b28d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381374, "uuid": "19e90e54-ecd1-4ff7-82d5-5cc9db5b3561", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "086830ef-324c-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747396258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747396258, "uuid": "c34d85af-62eb-4ca1-be38-6e85a7115e32", "comment": "Malware payload", "value": "fa4d23db65a28bd9a2b989e5b0e0c42d", "object_relation": "md5", "Tag": [ { "name": "1po56mdxc-localto-net", "colour": "#E5C76C", "exportable": true, "hide_tag": false }, { "name": "AgidCert", "colour": "#56D604", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747396258, "uuid": "cd4b48c7-8504-4c7f-aaff-5dd344edc634", "comment": "Malware payload", "value": "7b0e104fabb376c00379b81b138f853d2df760a9050266e8384f07be211f07df", "object_relation": "sha256", "Tag": [ { "name": "1po56mdxc-localto-net", "colour": "#E5C76C", "exportable": true, "hide_tag": false }, { "name": "AgidCert", "colour": "#56D604", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747396258, "uuid": "87b31508-3a97-4f4b-96ad-b3d046cbc1c5", "comment": "Malware payload", "value": "d1536a921d7d9fcab7dc35d64a3f8564b026098b", "object_relation": "sha1", "Tag": [ { "name": "1po56mdxc-localto-net", "colour": "#E5C76C", "exportable": true, "hide_tag": false }, { "name": "AgidCert", "colour": "#56D604", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747396258, "uuid": "61f1f96d-24fb-469b-bce5-224656f74aef", "comment": "Malware payload", "value": "5255c01ebe3bf9d637cd971df858be4affd123e7ec812857d529bf64420b9973381342ce29e1ead761d625912695f434", "object_relation": "sha3-384", "Tag": [ { "name": "1po56mdxc-localto-net", "colour": "#E5C76C", "exportable": true, "hide_tag": false }, { "name": "AgidCert", "colour": "#56D604", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747396258, "uuid": "45b45a77-c24a-40fa-a4ba-06f54e0b4d26", "value": "T145C3DE6F34541B9168764B93CC8ECE98DC0106E4FB65E2F4AA4EDD89FCCCF1228A9745", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747396258, "uuid": "cd65dfb2-251b-4042-a335-50ec22220b6d", "value": "384:HoeOWoeOyoeOyoeOyoeOyoeOyoeOyoeOyoeOWqymV0+UUfHgtKoFkuH88:9OUOYOYOYOYOYOYOYOrI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747396258, "uuid": "64c2393e-e986-4969-afe5-29f6c581634c", "value": 127994, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747396258, "uuid": "1a52b173-23e8-4af3-9468-482fa0067711", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747396258, "uuid": "34021c13-6348-4d23-814d-610b0416bcd9", "value": "Fattura-Online-15052025.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef904f08-3260-11f0-8bd0-42010a9c0005", "comment": "Malware payload (CobaltStrike)", "timestamp": 1747405236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747405236, "uuid": "7890ccb4-336d-4820-8cfe-a99d92ff0931", "comment": "Malware payload (CobaltStrike)", "value": "e4601c9d3537a78acf12dae922f70b5c", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747405236, "uuid": "0d71b439-589b-4987-a963-8179cbc5416a", "comment": "Malware payload (CobaltStrike)", "value": "7b30344c6bf06b6ec7aba1e5f9ac6953014ea8b78631e2911d15612272668340", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747405236, "uuid": "71106fc7-1f4c-4897-b5b9-065f4c8e95a1", "comment": "Malware payload (CobaltStrike)", "value": "bf971b50964bb2957d3b48ac6f694b682d2c1929", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747405236, "uuid": "1c1a0a15-a6be-4d70-8b81-5578c26b57f3", "comment": "Malware payload (CobaltStrike)", "value": "068ea4315f85acbb305591d17c1d3f4c239b6d098765103ab5b757aaae60ae6cf1e5bc74aa989d5b279675da89bf8272", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747405236, "uuid": "ecec9d9a-7d68-4432-be1d-e1ed58ac1415", "value": "T129E4C023B55198BCD40BC0B586568A7266327CCE0B2265EF12D57A363E7D7E22F3CB14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747405236, "uuid": "6ce310e9-04b8-40a6-911e-4ba0aee5acec", "value": "ef21ca8e16358d0e67f0448045805da8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747405236, "uuid": "57992022-47d9-4f59-829f-9e4f4c829f6b", "value": "12288:bWDcb+TFX9TI+U1EpW2F6KWKW8sdBtHKvK6HEAmD/:bcXXcgW2CNRYW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747405236, "uuid": "83652314-feef-49d6-a0a7-064412021f57", "value": 701728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747405236, "uuid": "fa2509e3-c9bb-4d03-9d16-375ed9425f8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747405236, "uuid": "0b0a585c-a59b-462e-8dff-baa5c2da6811", "value": "e4601c9d3537a78acf12dae922f70b5c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0211573a-321c-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1747375632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747375632, "uuid": "44c23c04-be9d-48af-959e-c8575a999f5e", "comment": "Malware payload (Prometei)", "value": "aebd4e6019cc7467b65d4a353e01e54f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747375632, "uuid": "49ba3338-4edc-402c-bfcc-e6ff0baf515b", "comment": "Malware payload (Prometei)", "value": "7bd130c2875b0f6a13d65245e02348fb2fec00d1d7724533d7589832cb57cc0b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747375632, "uuid": "53bcc494-2942-416c-9987-e51c98eae3eb", "comment": "Malware payload (Prometei)", "value": "221bdc9be1c1d5404c8882fa122e1132154c8229", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747375632, "uuid": "a22b8baa-0256-4de4-ab35-b82ac16dd509", "comment": "Malware payload (Prometei)", "value": "829ff4c47b8c19e8f7f5da343c74a2e5ed608ade4596228dabfe7a8569efebe318ba04a568fdb2c5b65a29c42798fc3a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747375632, "uuid": "bd1157d2-63c6-410b-8b74-2c3b638619c2", "value": "T140155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747375632, "uuid": "d80654a1-a01c-44d7-9b51-a21014d15122", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8MplZ:qmShf4OTjMgXSJhBXEsVrmz9MOup1KhC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747375632, "uuid": "e549f0fe-348a-4024-9d75-07c45dcca885", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747375632, "uuid": "dfb661df-65db-4a9c-b78e-fcb0b1d6bbba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747375632, "uuid": "4ceeff35-7a29-4e91-834c-14958b8e8ef7", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "441c74ac-3244-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1747392923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747392923, "uuid": "dcab1fa0-6e91-430d-900c-d32f86d7d808", "comment": "Malware payload (Gafgyt)", "value": "449491fee6b931c38edac99b495ff6ba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747392923, "uuid": "b781a82d-8b72-457d-905a-3cd26694a440", "comment": "Malware payload (Gafgyt)", "value": "7c01460d8bfe31ef1b4f2fd153177922146a57220b47d2242fd81ced97426966", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747392923, "uuid": "56c25296-1e41-4a0c-a9dd-9a4eaf34781e", "comment": "Malware payload (Gafgyt)", "value": "2b0c107be1da5950df9d031515196ce7b2da962b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747392923, "uuid": "5fb3ae03-fdae-4c9e-be5e-376825157fc3", "comment": "Malware payload (Gafgyt)", "value": "8fee70d47332d4a49935885d3475321e0177514c25da6498999494108d0714e03b57440ea863d6f1a356d1f52597d296", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747392923, "uuid": "2048074d-bf5e-4cd6-9fe2-ddaca0409d25", "value": "T130A32903DA60847EC48B93761BDFC6225623F8B90731621B63C4BEA92F169D9DE5D343", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747392923, "uuid": "440f1e43-7302-40a8-bc81-261007806f36", "value": "1536:QBfT9WiC3txvWtfEo5vXJM9wypej++3hAEgL7nLGPTms5TDUMHYr/:QBjC9wtsOnuejjhAEgL7smITDfHYr/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747392923, "uuid": "b81bc177-ffe2-4d20-9877-bb1d5d6e1d04", "value": 101269, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747392923, "uuid": "8ba48bbe-ff65-4eb0-bf5d-3ee244e213d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747392923, "uuid": "c9ad1b8c-6298-4ede-bbfa-4b796338c126", "value": "rebirth.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01b11565-31fe-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747362746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747362746, "uuid": "5759d883-f55b-4f55-a58f-1de63e642e14", "comment": "Malware payload (Mirai)", "value": "0a1e51945e155c3a3f31ce098209a604", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747362746, "uuid": "d288fed7-a76a-4d44-8c44-a4d2ef85a13f", "comment": "Malware payload (Mirai)", "value": "7cc7dff9e05d9a596f86b1ef01618601cf872b8a6a2019749b00803ee63a31a9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747362746, "uuid": "d0e0003e-ea19-4c2d-8113-67f1af03b197", "comment": "Malware payload (Mirai)", "value": "de271cbc97e54f879908e68467a651ef6a0cca6e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747362746, "uuid": "20daa902-fa46-43fb-a005-d654093f64cc", "comment": "Malware payload (Mirai)", "value": "9191586f3198821172347e98263b15ebbbc29a7863b707756f6223acda6243ca4334ce64d2d2faa3195e30df25ff1b86", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747362746, "uuid": "ee1232ed-3b48-4122-b2e6-14df0166c6e9", "value": "T1A043F125A52B9484DB101E71E59A4CABBF1A2BF6D0B5A1E3637C0DA6FF809C43DF4007", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747362746, "uuid": "45bc199c-5405-4b13-a0e2-12198c223348", "value": "1536:WNoDHw4KgGgrhP2H7RMNThXqLLmFjxIvrHvd440g:tDHw4zrhP2H6NtCLIxILG4r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747362746, "uuid": "ecee49f1-39c0-474b-a48c-c7d86a1535c1", "value": 58512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747362746, "uuid": "fbc629e2-a57e-447c-bba8-e6dfc4252968", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747362746, "uuid": "35614172-46a0-439a-8164-d29545989edc", "value": "neon.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4c54af8-326f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mydoom)", "timestamp": 1747411634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747411634, "uuid": "77d0af91-65b4-4b1f-bd06-124dc5946ec5", "comment": "Malware payload (Mydoom)", "value": "e7aa9408ee2577d70dec6b7b8b45b234", "object_relation": "md5", "Tag": [ { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747411634, "uuid": "01f138c1-6bce-4543-9ba9-f1b5deea3b0f", "comment": "Malware payload (Mydoom)", "value": "7ccfd9b52ea9c8f3faf6afad17babff9c052b0b7561b912bcf4030efb2e9ee78", "object_relation": "sha256", "Tag": [ { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747411634, "uuid": "6f0a3584-df5b-453d-ae07-1a7bc692630c", "comment": "Malware payload (Mydoom)", "value": "d625011a040b62b7c91754344239e274cc2ed935", "object_relation": "sha1", "Tag": [ { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747411634, "uuid": "4ca02eab-522d-4398-95d8-489809f31990", "comment": "Malware payload (Mydoom)", "value": "98e5628f8d14e5b270b8757362d6172dba15da028a1b70ba37fd2056cf5af60208de9ce73606caef494a44676d602d09", "object_relation": "sha3-384", "Tag": [ { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747411634, "uuid": "d3165bef-6ba3-40b3-96d1-929c570e4140", "value": "T15A9533DA35A3608EDDB52EB1E334EEE0CEF95F059D79EA24C1614E11B84CAF18D540E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747411634, "uuid": "5d72d4fb-c0f6-439b-8141-feb212430a27", "value": "24576:co0w2aObVo22oPKiqt/i5sIIkTcSKJ72fT3YIRQHQNVshi9Cu547KsmXXcSawp/D:QjaOJogeBcssTpDfT3JQeshiK+Zr9yCd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747411634, "uuid": "cd4ddad7-1c5c-46a8-820a-5f499ca35237", "value": 1947242, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747411634, "uuid": "f964dc6f-6da6-4c0a-97a7-0e49b38b8a5f", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747411634, "uuid": "c1bf36d3-b1df-494a-a1bc-11cbb90ea51c", "value": "Desktop.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "948f9fde-322b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747382320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382320, "uuid": "ba80afe4-9ce2-46de-8fd7-10b435e4e88b", "comment": "Malware payload (Mirai)", "value": "d50a3c58bdfe2c5a67b064ab4d14e622", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382320, "uuid": "03f5db8b-a4e2-4510-a7dc-a634e268c5ad", "comment": "Malware payload (Mirai)", "value": "7d67343232e1203f97d78ac17ea7671d039482053229713ecb17513acfb95da8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382320, "uuid": "c1651791-e7e8-47e8-8366-84085c45f702", "comment": "Malware payload (Mirai)", "value": "ecfca5f106d334fa0aab38ffd25384c45ea003b7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382320, "uuid": "f046bdc2-61f4-4c5b-91e0-ecafb35db335", "comment": "Malware payload (Mirai)", "value": "de6c45760ee33c06e2a11e87ed0655bac53c0920fa42a907137ff7aefd1cd41d71df2db17ebdba696acec4ff2b1f2970", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382320, "uuid": "0a09c791-27dd-480b-9be1-298f89de1017", "value": "T13B732826AD762927C1C4557F41F78326F1FA274A34B8C62E7CB10F8DAB58B4061633B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382320, "uuid": "c2c37984-3b03-4052-b3b1-a442fdd84848", "value": "1536:sLGpgEUWNpZpdrNWD+GmpjJFGrk7Idf8ADdhkWxtdJ:+tazNSTuHGr2gUAD7kg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747382320, "uuid": "42a8fc80-30bb-445c-bd05-f92cc1cad4bf", "value": 79064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747382320, "uuid": "3b0ca62a-da48-4e39-ad86-d17a42418ed4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382320, "uuid": "ad12468f-c4f3-4502-adb6-d0811772993d", "value": "rift.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fafeb67-3235-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747386392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386392, "uuid": "3928a06b-381e-4556-90db-2e82a757a13a", "comment": "Malware payload", "value": "6955be3e19b1659613dd55650d4f96d1", "object_relation": "md5", "Tag": [ { "name": "196-251-90-185", "colour": "#01F3BE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386392, "uuid": "8de52d0d-7a37-48e4-97e2-cb16cccdd9fe", "comment": "Malware payload", "value": "7df21cb0853bddbdfab62027417fbf7e5e9efba04ae078e28b8ee7a15314a420", "object_relation": "sha256", "Tag": [ { "name": "196-251-90-185", "colour": "#01F3BE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386392, "uuid": "e3947510-09e2-4004-b050-95fbb74faf95", "comment": "Malware payload", "value": "9c4ab7df1d7c6824eccdb07925ddbaae55c87d4a", "object_relation": "sha1", "Tag": [ { "name": "196-251-90-185", "colour": "#01F3BE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386392, "uuid": "eac228fb-c66d-494b-a266-d245e27f042a", "comment": "Malware payload", "value": "382b177e4ccbd563c025c3bc5f55f7e8e8e64f276e971e5139a327e81d5af22a480cde5a3c1af20e23d2a100e559e8f1", "object_relation": "sha3-384", "Tag": [ { "name": "196-251-90-185", "colour": "#01F3BE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386392, "uuid": "8281d694-cabe-4c96-afa8-696bd9a10c02", "value": "T18611C4FD3F171B78C83A99F0B10F17BAEB46288CBCB807209D82A0022D132A20557115", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386392, "uuid": "2a2fa257-cef9-43c0-ba71-6fbe3155f472", "value": "24:9OsISm3+NbJuI1GO0fMu/ipuEMyUhCXdZuEhH6A/UQXbsE:9dVdN9uAGf/guEMy104wE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747386392, "uuid": "9d552624-fbe5-473a-b044-d1244534e7d4", "value": 956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747386392, "uuid": "ed38ba47-39be-45c2-b701-57c347eb9579", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386392, "uuid": "f8e28061-f8cb-4722-a372-d30591beff4a", "value": "Husqvarna-DOKUMENTEN.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f39bcba7-3228-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747381191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381191, "uuid": "496e0927-8377-40d0-9441-8fe26c8d9384", "comment": "Malware payload (Mirai)", "value": "05985073983ac99d87aa8327ea423f12", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381191, "uuid": "95fa7fa1-ec6d-4eb8-b102-4b64ba2edd01", "comment": "Malware payload (Mirai)", "value": "7e0f6d218de8c6289be01829e4e4075e670ac927bf9f074c9b94612bff30997f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381191, "uuid": "7ea655a5-0c9a-4b64-90a5-26ce95341728", "comment": "Malware payload (Mirai)", "value": "eb4cd7244a23ef187114473bbda9986a01508dc8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381191, "uuid": "6f8c0316-4f7e-4c0d-856e-330a61f2ef6c", "comment": "Malware payload (Mirai)", "value": "a734312e1280b88be172a5ca6b98065cca5aa91efc0ca9079223b2bd6570f9ba614c12135474c7896bebc0ebda5312a5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381191, "uuid": "0f0b65fe-b540-4bb7-86b6-8b03e7338a64", "value": "T19B53F891B8426A39C2D1577BEDAF548E3314A7D8D1DB3213C9244BA07BCA94F0C97F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381191, "uuid": "4a7f7656-d0da-4e16-aa8e-3117d8641a4b", "value": "1536:nEbNn3E5sOq19Pj21ZXBbpuW+8nkSXeVSvhWy5UzS:+n3IxdpNkSXsKf5t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747381191, "uuid": "decfa3f3-caba-4452-b64d-fb6ab3bed713", "value": 61700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747381191, "uuid": "8948ad55-cb5c-49c2-b32b-329191e43465", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381191, "uuid": "c5947c1f-6805-4043-9471-fa65badfc014", "value": "sora.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "badeed8f-325e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1747404289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747404289, "uuid": "3eaaacff-2a81-4fdb-b10b-624e9bd29285", "comment": "Malware payload (LummaStealer)", "value": "72ad9a338206da91156189ef261f120b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747404289, "uuid": "b89a0c66-30b5-4739-9ceb-1904f5e18412", "comment": "Malware payload (LummaStealer)", "value": "7e268bf5ccd71be30eea4258e54cd291f4e0191fa6eb6b28825ba71098abd486", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747404289, "uuid": "314c80b5-7107-4045-8826-f41853d72d8b", "comment": "Malware payload (LummaStealer)", "value": "760d3130494973cb7e00fd940b56885c917877fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747404289, "uuid": "61c7f1d2-6980-45fb-b1c5-4a675d9a2a7f", "comment": "Malware payload (LummaStealer)", "value": "78690c1c8ae4d6d59b77214f7934c6a443714a96f2025e7d125d564a27092d01343b43dad77296e8b2fd6446e51dd151", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747404289, "uuid": "09bf9f82-a008-42b0-b8dc-99ea509cacd7", "value": "T10C8533B79C9173E9C799B533342020146B6EBA48E21E443F0A2702DFB079ACEF597675", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747404289, "uuid": "8129315e-0c69-4848-939a-94b17a0dd412", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747404289, "uuid": "f5246d3f-9dc9-4510-96c7-ed8fd8d9aedf", "value": "49152:9glME2fxHeEQ4CMh1aHTKcncEXqUCuazriWEfjgFGK:sMLxbNDumaLXqlriPfsQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747404289, "uuid": "f8cac744-b390-4190-a68f-7f467968d6ef", "value": 1872896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747404289, "uuid": "7ebb3f2a-02ff-4d44-b021-65cc87d4a1bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747404289, "uuid": "89cce943-a42a-4e81-b7ea-a8d609b1dfe3", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d2144e9-325d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1747403809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403809, "uuid": "12a49e6b-4604-41c0-b3eb-dbfe7d48389c", "comment": "Malware payload (LummaStealer)", "value": "83114adbc4a2baeb8644da38e8db8549", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403809, "uuid": "4e841bab-1199-4a7f-ba12-a14222e3d071", "comment": "Malware payload (LummaStealer)", "value": "7e2f2a1638c79ab8c7f0853c5c0a8cecbb3b623f9a069ee7a1685eeb0dc72665", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403809, "uuid": "1e903b8f-d6ad-4bbc-856c-435b92baaa8e", "comment": "Malware payload (LummaStealer)", "value": "927d9ffd06bfc0ab3efbc15de9472165e1580f98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403809, "uuid": "9367e2a3-ec3b-4ea0-ba1f-a5e044c420af", "comment": "Malware payload (LummaStealer)", "value": "5c45908b5f8abaaa11a4c584fc7a4f5d63fa3eaaa303b1fda08e5ac751430fb0958f50d87aa67fba5ba2e8647f751436", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403809, "uuid": "9b637023-f41a-4642-9cbf-7a7b3d8423b5", "value": "T1FF8533F5BEA1DE30D85E5B366B0F508238B4C742A8BDC5557E5EA77B2E3E61720C40A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403809, "uuid": "a80d361f-cd66-4b8e-bf25-81e6c74d0d7a", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403809, "uuid": "0c13821e-2004-4ab1-9f5e-200ef3dd81c6", "value": "49152:SrvacSk44sAkxa1Cj/qR5Syyccx3Ml9pcvbZr5huCx:E2kOZHOR5SyyXcMvbbh/x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747403809, "uuid": "183aea4f-4495-425d-859a-087b98e27662", "value": 1866240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747403809, "uuid": "a1da8430-f3ff-4b5f-9969-81482ffd891c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403809, "uuid": "8956ee74-496b-458f-a950-cf21fbde3d90", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a86f2d12-3228-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747381065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381065, "uuid": "63b98a14-732c-4d4f-8623-6bc3a4122407", "comment": "Malware payload (Mirai)", "value": "32453a6aedfa0e75f0a66468574539c1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381065, "uuid": "f0b0f80b-e64f-40ce-b475-81c8c254ed45", "comment": "Malware payload (Mirai)", "value": "7ed90185f7a9d60012f9a2d24995e86baf7f046f08b69e6a9fb81f8a0618573e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381065, "uuid": "5652a983-0e36-439c-98ee-f0075270a7ab", "comment": "Malware payload (Mirai)", "value": "9b1e7dd23c53fd0e98fd4652f023a32582901167", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381065, "uuid": "11482828-2cf4-4f93-847b-feb44a4e0e28", "comment": "Malware payload (Mirai)", "value": "d932d529d7a4eec4d534d20e79569a49bc61d6df3e98616ffb0c58358866620b646490049e4988b778eb2606b656add4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381065, "uuid": "02d1eefb-6240-4c2a-87bc-f2f235007989", "value": "T12CE06DFD29A13C3C1895940627E18800B2028193C9F68DBE98CAF06084CBE0824ECD8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381065, "uuid": "b74ba585-b8c7-41ab-bb2c-502eebbe3c45", "value": "6:lOnFflE0FQbNi2bNimKdViMGRNimKdVpwWTXi6ipmusgD+EW+EoeLj+Eo8:v0F+NiANdemdefRo7D+EbEUEz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747381065, "uuid": "84de5917-8fa7-49bf-b50a-801873e82ee6", "value": 415, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747381065, "uuid": "eacf9090-5872-451d-b0ad-303f8745922b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381065, "uuid": "5c330da2-b2cb-4b2e-af6a-86792e44576b", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1279b4b3-3236-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747386826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386826, "uuid": "d3c2795a-1e10-46b1-8a3d-8218b3bf4bc1", "comment": "Malware payload (Mirai)", "value": "6a324aa1e50d0e3f944925eed8ffb623", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386826, "uuid": "45fa2e5a-2bf8-41cc-b395-a8dd88d551f2", "comment": "Malware payload (Mirai)", "value": "7ef38b0241df68e86701887a1ecb3f5775965cf3ac6f54a985491402374b84cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386826, "uuid": "42f4f5a3-105d-4c06-81df-456fa5a62f32", "comment": "Malware payload (Mirai)", "value": "6bff3a781eab60fdf623be13760d71d5ce64f803", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386826, "uuid": "b7577953-b62d-4d97-818f-7622a23712a0", "comment": "Malware payload (Mirai)", "value": "70834dfbebcacc2c70e7cb05c20f46024f4dcb0f7e6956d706bdc9112ddb7edf39d2d92394f323ef425b6d2a981678fa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386826, "uuid": "4854bd0b-20fd-428a-ab03-4a500823528b", "value": "T13BC2D07A9D9C2603C6FD4D3C918E03645CC77590729BCB9847128EC8639E6ABBCC97B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386826, "uuid": "8db18402-cbad-4bd4-9447-f6858f2c6eae", "value": "384:ODSTlATcYQESJeYPJL1tjPEMixt0O+0tcRIdI0aOBdYBSaRWGVCz0Nv9:N4CHJeI1tPdStcxOBdWRW8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747386826, "uuid": "8f7f7636-906b-42ed-a786-90d6646db7a6", "value": 28040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747386826, "uuid": "c4933f3a-d7c1-4d56-9310-4d2c1463c955", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386826, "uuid": "422ff449-8517-41a6-98f8-67faadb70465", "value": "Mozi.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc50d510-321e-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747376803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747376803, "uuid": "8ef9c113-ce2d-4e1c-bc30-270e039c74ab", "comment": "Malware payload", "value": "253001b1ebca185d22e1ff81fdbe654c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HijackShell", "colour": "#965DAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747376803, "uuid": "53cb266d-f01a-47a7-8552-0f76cfb6f17a", "comment": "Malware payload", "value": "7f07b33cde26574a5a7bb4d4165252b5f1264debbbf4c37136f1bcdd6ad71f09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HijackShell", "colour": "#965DAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747376803, "uuid": "0edd18e9-d406-44b7-87eb-d211ebba98e0", "comment": "Malware payload", "value": "1af82e7d7642ee8d256b3ca9ee3acf7c436c74d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HijackShell", "colour": "#965DAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747376803, "uuid": "77f9990c-6b19-4414-b4eb-67f865309d78", "comment": "Malware payload", "value": "587050124c5b0941efa5d059774dae11b21d936046db9001355f605712c2b010f2f97cf44b61bad8e967f12232c15723", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HijackShell", "colour": "#965DAC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747376803, "uuid": "74c3fccc-8aa5-4edd-895f-00b03b9fdb09", "value": "T161B5492E23FC0095D5BAE13EC247464AE6F234312722A2CF0565C6BD9F27BE55639F21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747376803, "uuid": "38cffbbf-a4f9-408f-89ce-460fb59ae778", "value": "24b9088379ba4d09632644a6ea94b15f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747376803, "uuid": "2b77fa11-8cfa-4f84-a92f-648fb04eb4fc", "value": "24576:0xqPMCU3ht4cdqyGTR7FEkqTFoPLtFHgxRfQuPFG+CJ69gapZqc4cD3WvGGlRbwS:r3qqDde7KgnPA8ZpZZ4cD3WvGG3w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747376803, "uuid": "4f2741ea-9ca9-4357-9ed5-f0963b23db44", "value": 2427904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747376803, "uuid": "3bac001d-326e-45de-a387-3b4c599e645b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747376803, "uuid": "529172c4-0681-4709-95f7-d26f6a8e85d1", "value": "ExplorerFrame.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caa0440c-324b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1747396155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747396155, "uuid": "e1e7b9b8-6c80-4be5-b939-fc68d7ea32fc", "comment": "Malware payload (LummaStealer)", "value": "582161da6f3f27a342aedad9a660915c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747396155, "uuid": "9c46cc8f-b79a-4741-b4ac-f73336446635", "comment": "Malware payload (LummaStealer)", "value": "7f2d8442d51426c7cd6b29323b643f211e50c576c0315c6b59da94970d3895ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747396155, "uuid": "192109ad-5432-40c6-938d-e8b33328567a", "comment": "Malware payload (LummaStealer)", "value": "6b46616d579cd81e3f6714a4fac20fe28b60be61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747396155, "uuid": "2793a8ae-3dce-473c-8d0c-6026bb50a84f", "comment": "Malware payload (LummaStealer)", "value": "3cc8a3244d2d7958df1c8e0c3835ccc9327d71102ba795b03fa6ee49072c931d7df145cd33bf17ea9563bb0b136e9651", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747396155, "uuid": "950a2cb5-c170-4ae6-8993-ee00093529ce", "value": "T1D98533CABD70A021C2AB5577CBA587BA7774617377A1E7750DD3E102801AB0FEC17A22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747396155, "uuid": "7e1fbc63-87e9-4897-86bc-3e4c0330a89d", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747396155, "uuid": "39b900a2-2152-4fc7-88ca-91f400c2664d", "value": "49152:gffokOynFyg9QDDCcy/mh4kocyM89/aDcp8dNV8X/ITVqLkfqR:g44Fyg9npm2koct85udV8PIT2S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747396155, "uuid": "02d070f3-840d-46cf-bbcf-f8749fcf694f", "value": 1868800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747396155, "uuid": "0babb617-b5ee-4730-ac5b-3506261436cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747396155, "uuid": "0b9e52a8-5d9a-4e59-81c9-7c946c065c34", "value": "582161da6f3f27a342aedad9a660915c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bab7e5a-31ff-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1747363327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747363327, "uuid": "ce53a4a8-355f-456a-876c-3c5cb9e6d8e2", "comment": "Malware payload (Prometei)", "value": "afb0e2735bdeec1032056ba2c17c8047", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747363327, "uuid": "d5ee4652-8da7-4cbc-8637-f61bd4748f89", "comment": "Malware payload (Prometei)", "value": "7f8bcbdd439a771d65182bf3b5505fae01b59f651476e3ac0f77eb23a4d3a46d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747363327, "uuid": "114ddd95-3b55-4db1-b7d3-bebcf7dc2903", "comment": "Malware payload (Prometei)", "value": "7b8835392e39e4afeb47da116cf97a36aeac3621", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747363327, "uuid": "191bd8b6-c15e-48fa-9094-ceab8037c2e3", "comment": "Malware payload (Prometei)", "value": "9a1af58ec9095881c5e96928202d14086b73ade1284b9c5dc88be88475ea926d2e3cd410185386dc69e18971873460ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747363327, "uuid": "c40ec44c-d9bb-4c12-a3a2-5aa44287906b", "value": "T10F155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747363327, "uuid": "e15efec1-9d97-4bb2-bc72-4be061305357", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mpl/:qmShf4OTjMgXSJhBXEsVrmz9MOup1KhI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747363327, "uuid": "d433ce82-4c6c-47e9-9382-2cface0d663b", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747363327, "uuid": "b4c46c6f-7316-4281-b9c7-8ab837434a43", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747363327, "uuid": "6a782845-c074-41f2-99ed-e75ba24459ce", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe51d93b-3287-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747422011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747422011, "uuid": "42884d65-89b0-45d5-aeeb-81a68ff617c8", "comment": "Malware payload (Mirai)", "value": "af53e9295cffbcc4886fc17563f96d56", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747422011, "uuid": "a84cf205-b6c1-4b51-8663-a5d9a193dd89", "comment": "Malware payload (Mirai)", "value": "7fa545aadd1c0bb4eba61cbd61d6416cae3476055fa3623b5982354c63e57903", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747422011, "uuid": "165405c4-7176-48d7-97c3-84fe9fd1b516", "comment": "Malware payload (Mirai)", "value": "83dd931896180444fee685bb5322405000390131", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747422011, "uuid": "2bc6e6bf-d70c-46a5-b050-265a3c88714a", "comment": "Malware payload (Mirai)", "value": "d0d628e2a7840ea75b30bdbcb6f21fb31a41787104379a2e8cb2776e6249492f6c9e11a1ea41d59d1cf22325aac82ef1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747422011, "uuid": "042b4e83-0e58-4c26-a082-42d08906da46", "value": "T1C38329B81995F63CF9F250B5F45310EA28A10A1C379CE1E3BA83647AFFB47087169D49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747422011, "uuid": "005405a6-74f5-47af-83d0-ce88ee355c13", "value": "1536:RFsqdPA6xChpzOWYbgApb+Gxfv1/WGQashyD1w6A:Xdo6xIz7+pb+M1/W2ayRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747422011, "uuid": "82e05045-fb66-4071-8d6a-237782a45ac6", "value": 83396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747422011, "uuid": "26331b9c-0356-43bf-b97f-0ed50cb2241e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747422011, "uuid": "166d3a9d-4b1c-4943-a3f5-7f9b3f62f18c", "value": "db0fa4b8db0333367e9bda3ab68b8042.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "899f1db5-325d-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747403777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403777, "uuid": "0ce9fe69-6908-4315-83ef-ffd29179556f", "comment": "Malware payload", "value": "8724c60ae55d2955f899dfa49ac3f299", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403777, "uuid": "1d37a121-0529-4d26-a2a8-c8f1c3f040a9", "comment": "Malware payload", "value": "7fbd007f79194db78fe3b72f0166a58b19150a95880023ccdcd9f43ee11f239f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403777, "uuid": "063eceec-21d1-4f1c-995b-f27734021946", "comment": "Malware payload", "value": "7408c6a08362e578e48f4e27091d145ba43684d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403777, "uuid": "2780791b-3239-4d05-8f14-5a07674a532b", "comment": "Malware payload", "value": "4b082601bed56e41e070296c78467eb1854740d866f6e53aa807123e35269a2f0c12749bbf365562dabc6bd476b4f9cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403777, "uuid": "23d61363-edef-4f59-8252-477d37b8f7dd", "value": "T1D3A52342F6C648B1E17228326B7867216A7CBD305F758EDF67D03A1DE9605C0EB20B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403777, "uuid": "a6cc4ea4-3aa9-4297-b394-a814b2f392a4", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403777, "uuid": "2eea1d4d-1fe0-4e4e-91f3-f0167e2e57c1", "value": "49152:IBJJTpc8iYMljoCIrtufFEUPtPSfdjh/SXjlM:ybTFMlFIQDP4fdj42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747403777, "uuid": "b513d5fb-e177-4efd-9816-48ee396f904e", "value": 2230224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747403777, "uuid": "f49dc7f5-efba-4f1e-a079-092814c30777", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403777, "uuid": "a1a71014-e32a-4ff5-ae4a-533c05e22cea", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4901098-323a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (ValleyRAT)", "timestamp": 1747388897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747388897, "uuid": "a4f9b958-0da9-429a-929a-d0fe0425e5ea", "comment": "Malware payload (ValleyRAT)", "value": "fc057b47b3bea3b1e5410b326ac55315", "object_relation": "md5", "Tag": [ { "name": "dsh-fvsrchps-cn", "colour": "#DE3429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747388897, "uuid": "d509d61e-abf7-4e31-97d8-10ed957a7b81", "comment": "Malware payload (ValleyRAT)", "value": "7fe80e04473465d9f615ff5b47b0d79e7b1b0f43cee6d249e0ca695073a5f7fa", "object_relation": "sha256", "Tag": [ { "name": "dsh-fvsrchps-cn", "colour": "#DE3429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747388897, "uuid": "d77e6392-a1b4-470c-89c2-0a9be0358c84", "comment": "Malware payload (ValleyRAT)", "value": "ef6ae6a21fc87ea548d2425ad9149ad88efeba4c", "object_relation": "sha1", "Tag": [ { "name": "dsh-fvsrchps-cn", "colour": "#DE3429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747388897, "uuid": "45068d80-8e94-4090-9bf4-8dde5743589d", "comment": "Malware payload (ValleyRAT)", "value": "16e9cc094a057a1ba2411e5b535a44f15dc277cf37e8f345cc96667ee6228902ac549909346aa49ed530c625ca933646", "object_relation": "sha3-384", "Tag": [ { "name": "dsh-fvsrchps-cn", "colour": "#DE3429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747388897, "uuid": "9d8b9515-ba5f-4ac0-8639-c0f2a95a03b5", "value": "T1AEB47D1A72E804B9E577813DC9538906F7B3BC560720DAAF13A4476B1F237D1A93EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747388897, "uuid": "43b76ab0-b5e8-483e-9f74-932854cfe1d8", "value": "c316c09a38dd8756a01b65ed6910d7a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747388897, "uuid": "8ef0b7fb-454a-4cc3-a462-1e6a64069aa5", "value": "6144:DPUlmJBsosn5hzSk7/Ud9OB/ivvcYohahENkxQol0XAD35m0ampO83rvdcYc7KH:DPUlyuFHzV/U+UcYoL+eKQG5+YV6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747388897, "uuid": "cf30e9e0-92c0-4126-a41a-53e243991a07", "value": 518144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747388897, "uuid": "1f7e55de-7ba9-47cf-a6ac-f426cdc52735", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747388897, "uuid": "0366c031-8cea-40b4-a636-ef107a44081b", "value": "7fe80e04473465d9f615ff5b47b0d79e7b1b0f43cee6d249e0ca695073a5f7fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a4b1d57-31ff-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1747363324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747363324, "uuid": "08c886b7-a4e0-48eb-b516-bca7955133ba", "comment": "Malware payload (Prometei)", "value": "66c742f730a91fcdf7ad4a8af6a84030", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747363324, "uuid": "31e374db-e5ad-4622-b3b7-ac5909de27cf", "comment": "Malware payload (Prometei)", "value": "800d14b99f7a89b585462ce1fc17bc4416e6e09bbed309b88228a1e0e52f6eaa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747363324, "uuid": "c383120e-4d37-4156-9a8c-4ede99a44eff", "comment": "Malware payload (Prometei)", "value": "b12335f5e8937c7c6ac43a788a697155fd1d93c3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747363324, "uuid": "1c914d8f-e52d-49ca-99eb-9fded88a5ac9", "comment": "Malware payload (Prometei)", "value": "eb4a2e187b1f093e7fa6bd5fd10760b4a7110fb6bee3d8778a2aaa93dca394b3e9f1226a694973882a581b699d95f6cc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747363324, "uuid": "3d2d98f2-a7df-44bc-ac14-e379f9e875d3", "value": "T1AC9423F8C87D2E3098169B3CBB1A8268F0A15772D9562F6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747363324, "uuid": "badb44d7-219c-43cf-986d-52c19ad6fc9e", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitg3:25WOSACZSV6eKRH5EPiamb4DsDwwcH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747363324, "uuid": "e5c76e59-f8ad-44c6-925a-43961d7ba0c2", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747363324, "uuid": "cc7199f0-a406-4a6e-b0dc-ca0cd11f0163", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747363324, "uuid": "045ba2ce-0232-4e0a-aac6-315a618bdf97", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f047d709-3272-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747412968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412968, "uuid": "02af1d19-3206-42b3-b5c3-860f792f0519", "comment": "Malware payload (Mirai)", "value": "d73e60f0439591e2cc6ea1a3169e9a5e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412968, "uuid": "929fa611-5214-4665-bf15-774ebaf8b7fc", "comment": "Malware payload (Mirai)", "value": "80d54050f8d722ead19445164bebef42f0cfa7ddba061c0b867e9682c72b2a5c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412968, "uuid": "d2e0a432-cbbd-423b-b4c3-bbb544e40785", "comment": "Malware payload (Mirai)", "value": "87544020a7005be720e13c571faa39f8289ee4ad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412968, "uuid": "9fed6064-43f3-480b-bfc8-f3419bd55269", "comment": "Malware payload (Mirai)", "value": "7d7d77408acfcde35a02ac2977892394d078c8666ad90ea7b4c616f41e437466d3af2eeccaa9b12acb89a0a7b3fd1b7a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747412968, "uuid": "4e0eab39-e0e4-4112-b209-6f7cd4e3274a", "value": "T19563A506BF214FF7DCAFDD3749A91B05258C641B21A97B397E34D828F64A24F19E3860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747412968, "uuid": "078784c6-adb4-4a4a-aec2-7d61800efccc", "value": "768:QxNCJ0EYlDYhHnrwqsFDwLX3U6ngBhN6PNUpGXS5SyeweVKe0n3oNWpkmPqXitMF:QxNCJBYlZFwwjhwPTXSNxIKzn6CpC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747412968, "uuid": "be086e99-21da-4b98-b5fe-cf67d7f8d4b8", "value": 71528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747412968, "uuid": "aadbe8bf-611e-44be-9440-8e966b39f34a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747412968, "uuid": "3559d410-24cd-4769-921b-d9a39b4e0011", "value": "Josho.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "641105f9-3224-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747379232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747379232, "uuid": "aaa0f6d2-4c87-445a-9ddd-b5b6684d60a1", "comment": "Malware payload (Mirai)", "value": "d24fcb7c7cef870b89135d46bdb85dfc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747379232, "uuid": "9c240694-3364-4b30-a6bb-c23740f21775", "comment": "Malware payload (Mirai)", "value": "80f0ed45b00cdeb87f9735edffe6aa1c2e4e9e34192d6fa8d2eb9dd5119501f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747379232, "uuid": "69c91ef0-120e-46c5-a1cd-26c52523f8d7", "comment": "Malware payload (Mirai)", "value": "eeae4ba56b737243c1eb4899c2367ee2d57f105f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747379232, "uuid": "8d6c5415-6101-4a2f-a142-675129354b26", "comment": "Malware payload (Mirai)", "value": "d2ff4dacb4f589e66a5d9400e4302ebafd5c614251596037a92558d385072a45e4c507af2ca3944cab31fbb52638f94f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747379232, "uuid": "3a7740a0-1c7a-42bb-a3d4-1570c829655e", "value": "T161E2F1F905DD2AB2CC1BD27811FF9D27509B5C9CD71EC26E2A842F56F1790641361C3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747379232, "uuid": "6fc56dd0-b5e6-4297-a617-c4df1e9dbde4", "value": "768:lAX5+N9ZzCMJLsiytweY5uVeB52sNYKMIpcgokMkI3:lAX8HpCMJLZythqZOQMDgY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747379232, "uuid": "9cae7f07-077b-4b6f-b0b2-b2bedbb72679", "value": 32692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747379232, "uuid": "1e72a3a7-326c-48bf-891f-0d12f8e535b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747379232, "uuid": "c3164619-97c1-4728-8951-2fa9aca5b62e", "value": "neon.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da5a2de8-325a-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747402624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747402624, "uuid": "b0f7d460-979d-4d79-b559-0a100a08c7d4", "comment": "Malware payload", "value": "0372666658f80967139dd2db9bf171a3", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "shokito", "colour": "#A9E8CB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747402624, "uuid": "946cf962-7e13-4fdc-899c-cd6cb15d752c", "comment": "Malware payload", "value": "81df645501855f892b1767927f1ec52240e81ee82da5d4868d011dbda53b88d6", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "shokito", "colour": "#A9E8CB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747402624, "uuid": "3ba2f990-e4f2-46de-9f2b-332412ca0a8e", "comment": "Malware payload", "value": "e015076db2f99ff35006a5a6c3cbcd7876e70232", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "shokito", "colour": "#A9E8CB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747402624, "uuid": "d2601f14-19c1-4be0-85a2-1b733487c3a3", "comment": "Malware payload", "value": "0cfa8b2cc308351385467fc2b99ac58958c13e3989d7e236530fa62075278faba2e006bde0476554b1c3bccfd1f09802", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "shokito", "colour": "#A9E8CB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747402624, "uuid": "f88e4e7b-b982-44b6-bb38-27b4c4819a9e", "value": "T1F29723B87B85963AC63756358A818212B0050D3A97AED9271B2039FC5C7BFD48F47DCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747402624, "uuid": "0b714f50-67ab-4d65-a476-a104083b46f7", "value": "786432:umNS5+nY1OEQ8gNa7FmjCrNnbhWIYCBqRUoeb9Az9+7h4hM3AoxduswR:umopRZgNa7Fm0NntWIYCc6oC9So7+0zG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747402624, "uuid": "e2dcb828-f446-4e64-b50e-7895da10523f", "value": 42955449, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747402624, "uuid": "1b3ba9f2-27f8-41fd-9563-18b56a2b3276", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747402624, "uuid": "9d537fcd-a8d1-48e0-9460-5763ce8e88e7", "value": "81df645501855f892b1767927f1ec52240e81ee82da5d4868d011dbda53b88d6.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7630a847-325a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1747402455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747402455, "uuid": "4d9b7239-1a89-49b5-8c99-be9f88c38059", "comment": "Malware payload (Prometei)", "value": "782dffd8832f81c4d22ff3855625b51b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747402455, "uuid": "fc1b8aad-b5c0-426a-acd5-f59a37895d58", "comment": "Malware payload (Prometei)", "value": "81fa75ccc3c17855347c64fde785c53b399a0d9a18e52e00c550145bd062cc67", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747402455, "uuid": "4a56b812-ee52-4abf-a6d5-ded182351f06", "comment": "Malware payload (Prometei)", "value": "d7e19220f2a7229871169c7d608f5fd56c1179a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747402455, "uuid": "a9132145-b406-4fec-81a0-31e567dc29f3", "comment": "Malware payload (Prometei)", "value": "07a8ac44035b405f15c79aa40e379e83246440d4bf24574a7a3b87d0b699c0b78d8cdeb937185c58484c80bdb6c85dbc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747402455, "uuid": "f910fb88-2bb0-45ab-b215-4797bb93dd04", "value": "T1729423F8C87D2E30D8169B3CBB1A826CF0A15772D9562F6EB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747402455, "uuid": "20c9e5b9-703e-4d8a-8589-6a3791157c15", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgy:25WOSACZSV6eKRH5EPiamb4DsDwwcC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747402455, "uuid": "91e82ca4-5cd9-4d95-b30f-f4e9f5195dd5", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747402455, "uuid": "4978aa11-5159-4c4c-90a0-dcad86e4cdf3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747402455, "uuid": "ec3958c4-869f-4b05-a398-be6d6b01e69a", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2959fefb-3236-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747386865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386865, "uuid": "8e81be44-04e9-4d17-915c-452872b95dea", "comment": "Malware payload (Mirai)", "value": "00296470a8c3193dab2fa35c43c07744", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386865, "uuid": "8f28d942-427e-4aad-904b-921b38d0d818", "comment": "Malware payload (Mirai)", "value": "81fe85ea11d273835c2b9f32c9e92619b15f7a1d7f4ed2a277b5de29945d068a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386865, "uuid": "b5725417-7732-4434-a88f-51452c95ba2e", "comment": "Malware payload (Mirai)", "value": "d16a01bfd858dbeae2318e7da83827bdeb09fe7a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386865, "uuid": "21eb7767-194c-4da0-9323-500d46a7da7e", "comment": "Malware payload (Mirai)", "value": "eb3511e527d61be086d6ecfe3fb37bf1ab14e9395480da3921aa86c3a03631226a32438fe2d3eae08c4901dca51cc199", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386865, "uuid": "440efea7-2288-4b47-b484-99e6071c8f9f", "value": "T19E53E5D8BC44AA12CAC9227AF16E61CD372563E493CE32138FA20B51774756F0E37969", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386865, "uuid": "5815d381-566a-4af6-83bf-8d4e10bc41b3", "value": "768:WAuHciwYTDKuQtIaZUHgFmB8Yws/tdHcrZ6q1RBRYAZ3KdaB4dDw:MHQu6X2goZ1ywq1RBRY/nC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747386865, "uuid": "0b5de485-e8f0-4dff-a371-2345adfa859f", "value": 64736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747386865, "uuid": "83a81100-fd28-4dc4-93d4-8fbad3c5642e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386865, "uuid": "9eeb25cf-fb69-4fa3-835e-caeeae03b010", "value": "Mozi.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3df129a-3269-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747408975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747408975, "uuid": "d15af590-5cfb-4f7e-8a80-2f1af8d42db0", "comment": "Malware payload", "value": "f2e1d236c5d2c009e1749fc6479a9ede", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747408975, "uuid": "9b8b4538-f041-466a-a22a-61c363d4596d", "comment": "Malware payload", "value": "8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747408975, "uuid": "dff05b96-7f84-4f53-8939-f9d9f053ae35", "comment": "Malware payload", "value": "262c22ffd66c33da641558f3da23f7584881a782", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747408975, "uuid": "d5399b76-a42d-4218-a494-7ddfca6a1434", "comment": "Malware payload", "value": "2b0097f2a74edad27972c721dc84250e4dff7f763b810d13bff80a99bb972318fa77a8c31871c696f2aa4a79fe2393dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747408975, "uuid": "ffd862ed-74d1-4b4a-956f-3e36fd4494a0", "value": "T156652337249F0247FC584DFF8C762DE303FB41A6A1537E7526AEB8C14579836AB420A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747408975, "uuid": "71cc1232-4dac-498f-8f4d-f3f369801d14", "value": "4ec91799cda08417c14bae94b6a450c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747408975, "uuid": "89dea756-2cc0-45a1-b7a5-4cc2d048bcdd", "value": "24576:6EpKGrwKydag/jU7IZK8LNmf2+r+eauoUWg6ye2tX9t5WR4MJh:6nGrwKtg7U7I88Zi2/xxyeAt06a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747408975, "uuid": "e2a85943-c4d8-460f-9746-d236eba4af80", "value": 1450500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747408975, "uuid": "daead3cd-290d-4e46-a3a7-b443e76fa2a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747408975, "uuid": "6d54c791-a01e-4198-99ff-43ec637b96f3", "value": "8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f51cc6bc-3228-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747381194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381194, "uuid": "ac2cf81a-7659-4815-8575-b554c030bf91", "comment": "Malware payload (Mirai)", "value": "9d3b114c489fb09d7128d0643ac87aaa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381194, "uuid": "e59efa7d-736f-4ccd-b68f-9e7230cd2988", "comment": "Malware payload (Mirai)", "value": "8200d7eb24997a5e0f1e033d280344c88f3473c07b9e44df974437c096c5e23a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381194, "uuid": "fcc71905-d82a-4a80-98de-004e4386a652", "comment": "Malware payload (Mirai)", "value": "2e0240a13378a540fc31d6056f2fa028bf42503c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381194, "uuid": "fbe229a3-8d03-47f2-a3ec-36535b261a8b", "comment": "Malware payload (Mirai)", "value": "373282b4ab42849b4e214f48b187467c4498ef9fd0186198da3587568cab8fd0c9311b3f21ed136cde4e8fb4abcc9ee5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381194, "uuid": "d460d0a1-ab06-4766-8699-3e8e310dd826", "value": "T144730A85B9819B25C6D513BBFD1F018E331657E8E3DE73129D201B607BCA91B0E27E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381194, "uuid": "65cd2822-cde4-476f-827f-4fa71993dd9e", "value": "1536:q9KnGSGYfkiu/ZwQNCJEHQXglNU6bO3d5yAMw1f91uwcWIWinluUsPMrQ:CEkiUZJNZHKMNU6ba4XwtsluUsPMk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747381194, "uuid": "4375ae44-7daf-4583-9d1a-02313f7c2035", "value": 79764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747381194, "uuid": "9bc583c1-454a-4488-ba16-cc0e172802da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381194, "uuid": "9c2bcc03-4cfb-4707-a550-c357d8f3d6be", "value": "sora.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ae6851c-325a-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747402490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747402490, "uuid": "c6ae4947-a0ce-4d95-ba42-01dc81aed957", "comment": "Malware payload", "value": "ffbc289c6821d03f6d4c42f8de0a22b1", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "shokito", "colour": "#A9E8CB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747402490, "uuid": "5ecff6a5-5e4a-4fe9-aeeb-b368deed177a", "comment": "Malware payload", "value": "824380aba14080f359fab8b34a954821a1ad4ff1fde6d7d628a02d3e4113b94d", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "shokito", "colour": "#A9E8CB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747402490, "uuid": "d31d64a3-9062-4df1-8580-59de84146077", "comment": "Malware payload", "value": "7982dc7fa15c813bbef0a6a13c3a7577055ad1d9", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "shokito", "colour": "#A9E8CB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747402490, "uuid": "a95dbafd-47fa-4fb8-a4ab-880496a99c97", "comment": "Malware payload", "value": "b7e229b7cfd2a49754b4de87132e9ba072ea65802c6827852d88c58ba2d6f1633ead73eb7214b04e9f666396e84d6f5e", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "shokito", "colour": "#A9E8CB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747402490, "uuid": "be5005bb-4a89-4480-b81a-0f8bc7b05f92", "value": "T1B9F73356E3EDA82ECDB790328EBA612615A10DD28641DBD7381DB21C6FF36901F49BC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747402490, "uuid": "95528e66-d085-442c-961f-1290086b0962", "value": "1572864:Bq0tbzbs32aeXYymFJ0Ir149axnDyiX8qoDy6nkxRYhMtanc8R:tw98YygDuaZOisnDmRu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747402490, "uuid": "e4434dcc-ad82-4a07-9cc7-1dc1badf3cca", "value": 76545065, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747402490, "uuid": "1a3b379f-a6a6-43e3-a88a-761e5aad8104", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747402490, "uuid": "e38a669a-0136-417b-94a6-54f6be4344ab", "value": "824380aba14080f359fab8b34a954821a1ad4ff1fde6d7d628a02d3e4113b94d.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "482bcd87-324a-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747395506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747395506, "uuid": "51629370-61e1-46d0-9f23-09b4f0ad0a44", "comment": "Malware payload", "value": "2e7189e97fd9332947f12619919c900f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747395506, "uuid": "1a612f7e-c9df-4f5e-bd38-5b55d18ffae0", "comment": "Malware payload", "value": "8273b577a45c33352f7d2e771aca7b1450400abc3fdf2327581f7839de9d4cb4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747395506, "uuid": "7791d4b3-b58c-4959-9670-07f33bc44d2f", "comment": "Malware payload", "value": "c1ff6fbe7165fa3031ab9f2ec882a6e24595f742", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747395506, "uuid": "6e73b0d6-e6d5-4d49-8ceb-469230fe4ad9", "comment": "Malware payload", "value": "712530b24c02ba233ded9dac7935b7e3ab82b9f5d93d43b1416cf642214fa2220ebf92c0b015711c3d1ccf5c9d61422f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747395506, "uuid": "1687ebb2-0348-4807-a736-e938f2b03624", "value": "T18A842305B565AD31D504C5BE6ECAFCC812F4D5B50EA0AB0FAF9E132C6A25760C1FA38C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747395506, "uuid": "49a36d60-a081-47fd-a8e0-68a988ad5702", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747395506, "uuid": "4faa8b1f-33d8-4cbf-8ca6-c23398ca6d15", "value": "6144:3qBrOM1eV4KHSl8DPLDlzwAKgZlkpzaAbeHk17eZ05ZEyq0abDd7uzAYnc+l49:aNbeVil8DPLDpw0EN1760nOZYnnc+l4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747395506, "uuid": "2230633e-d8d1-4861-8d6b-ab1fbf1f109b", "value": 378880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747395506, "uuid": "e29872ad-a053-4f33-810b-00e7649ef45b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747395506, "uuid": "694c486d-cde2-4b13-8d45-fb15832dc42a", "value": "2e7189e97fd9332947f12619919c900f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cf35e81-3241-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AmosStealer)", "timestamp": 1747391703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747391703, "uuid": "3a706662-2307-4881-b073-77ed57592d5e", "comment": "Malware payload (AmosStealer)", "value": "970e7c9bf84a4e109a2f51a64b25afdc", "object_relation": "md5", "Tag": [ { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "security-check-u8a6--com", "colour": "#68A0E7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747391703, "uuid": "3aca08c8-a40e-4279-b22e-c933a416fdef", "comment": "Malware payload (AmosStealer)", "value": "8286df61d08d3a639023bc4726a53c6469f27f8ee2e7d242d7fc46a3f864997e", "object_relation": "sha256", "Tag": [ { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "security-check-u8a6--com", "colour": "#68A0E7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747391703, "uuid": "5110dd5e-d597-4690-814c-9d0970e66842", "comment": "Malware payload (AmosStealer)", "value": "b2450667ca9e57de33f33719ccca4aac39fcf863", "object_relation": "sha1", "Tag": [ { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "security-check-u8a6--com", "colour": "#68A0E7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747391703, "uuid": "6a8497e1-2e60-42ce-8f50-d2d9a5739bc2", "comment": "Malware payload (AmosStealer)", "value": "b74d150537fdb55cc16e90dc3daac75c3b8c5aab6947da70cb06f30f04e03be5a3ee72351d5ade5332fff1346cf4dc53", "object_relation": "sha3-384", "Tag": [ { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "security-check-u8a6--com", "colour": "#68A0E7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747391703, "uuid": "7b649d96-3ce8-4105-a83a-95a6b70ad2d7", "value": "T1D7E4018DF6C0BF2BCC5705B7206A468215DCECA113A1C38BE612AB3B3D54BBC1C5B55A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747391703, "uuid": "2fd3215b-c9f3-43ac-b9d6-f790a852d6db", "value": "6144:TTfZ++jtl3g/ZGi1DRBneYleuRbuisQ1Nuw97DIEurgIaBxEKJYmh7YJ4DZnp7Hd:TqJHn59XHpFCbtXiV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747391703, "uuid": "72fe219b-7115-40f7-925f-87210e32ab84", "value": 719984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747391703, "uuid": "5da19686-3179-48a9-a9b9-2a20712a3e4f", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747391703, "uuid": "1bc395dd-f139-4b4b-931f-94188d954895", "value": "8286df61d08d3a639023bc4726a53c6469f27f8ee2e7d242d7fc46a3f864997e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81448660-326a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747409346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747409346, "uuid": "0f5fb15c-f151-4593-b6cd-74fd6bb172ca", "comment": "Malware payload (Mirai)", "value": "deb70df610bca48856c0b0ef1ad52462", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747409346, "uuid": "86c9f7ee-7b76-449c-bbaa-ad2502036782", "comment": "Malware payload (Mirai)", "value": "8296a1264b27a763899419e4ee195225488ee777bccf445c8cd64bb6059612bd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747409346, "uuid": "5d76d982-c42e-4fd0-87f0-1e8a8783dd41", "comment": "Malware payload (Mirai)", "value": "2836aca9ce31e6a0d2b6d1d70b68d78e0f580e58", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747409346, "uuid": "9bf06795-9846-4fb7-b4f0-fd47fda63db9", "comment": "Malware payload (Mirai)", "value": "42cc4883d8b3195b3faedefcaa1a3d63603f221ea9999160b54b62b4358df6e0b3b6eba1cd3a0f8db6635ce6ae196b78", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747409346, "uuid": "2efff38d-af5b-429f-9986-5a862d6bf28f", "value": "T14A431845BCD19A12C9E423BAF92E41CD332523E9D1EF7217CC112F51778A82F1EA3A56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747409346, "uuid": "f0fcaad7-ff3a-48e7-b938-d83a4733e667", "value": "1536:ePoNI2E8F7QfzpP9a2Enm+cPvlu+oZb+1gAp2i/2EiLSAi4ha:6oNI2E8FpiJ2i+EKi4h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747409346, "uuid": "1dfa36e6-5c52-4451-b348-251a18a20144", "value": 58448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747409346, "uuid": "6f7c4ba6-09bf-4309-b480-1bf2df8fbb6f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747409346, "uuid": "c7aa7c32-8942-4940-a605-966a748485d9", "value": "kwari.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bc5dae8-325d-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747403780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403780, "uuid": "163ad31c-176f-4083-a65b-4f5d10f45ff3", "comment": "Malware payload", "value": "6b2744600c7894d50b43cd10fd89afb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403780, "uuid": "15855dab-80cf-48fa-aec8-eb04611707fb", "comment": "Malware payload", "value": "82ba78e8fe2952effa20d8902eeec74a0718eb9c382d5246de57981475e80f60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403780, "uuid": "8400c258-7e2e-48f0-b42d-aa0ad8bc83f4", "comment": "Malware payload", "value": "b9093409ee9cf264224c14f086879468ab682152", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403780, "uuid": "6a8f43b1-a5fd-4ec2-a8d1-9f504adcd6d8", "comment": "Malware payload", "value": "c8e66aca54db3b09e03d952b66ffcfd40b9e76f27096d092b5190ba64312637e07c025836d284c872fd2e355514253de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403780, "uuid": "8a83458c-bbf5-45db-9d40-7c0b0d33e017", "value": "T194A5235533E109F9FD72513E88A2CA26EA31BC650774C78763E44A672F332D19E39392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403780, "uuid": "8cba9c25-2c1f-466a-a2b6-dbf749d697ba", "value": "a06f302f71edd380da3d5bf4a6d94ebd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403780, "uuid": "b0603368-99f1-4522-a27f-16e201b2a386", "value": "49152:n7Dcg8/eMNPFRAYbQUayrIxUmeAyE6sxFg2KK/nT+SzdiDelZY9jA:n7b8m8DAYbRXrIxjaX2KmCrD6Y9jA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747403780, "uuid": "187c1170-253e-4d87-93df-94059f83cd96", "value": 2129443, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747403780, "uuid": "23f0c208-113e-47e5-8205-b5f990ca2d40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403780, "uuid": "23d40953-4254-4015-9859-8036a047179f", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea13b038-3228-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747381175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381175, "uuid": "05e5e999-69f2-4689-a9fa-1cb4471c3834", "comment": "Malware payload (Mirai)", "value": "1e5896e540e7d1553a846378ec6a6f5e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381175, "uuid": "fd2aee34-68f6-4dbf-9b8a-3b7f4fa29956", "comment": "Malware payload (Mirai)", "value": "833d51d92c5b260bac3c91fee5bf39eaa2dff868c39f7dafc22ebd4499ad4df0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381175, "uuid": "b4528aa8-7cb9-4b85-ad98-46deb40e2b01", "comment": "Malware payload (Mirai)", "value": "59c0885789f6c30186d741c9a6f5637ad9c39da0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381175, "uuid": "b066d37c-5a97-4bd2-9ccb-df93c84a6617", "comment": "Malware payload (Mirai)", "value": "77a00aa6dad9158170a5bd9c0ffb895a970829e45830d5d366db8c831db69626523f22a057e5063631aa736785169a09", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381175, "uuid": "99467b31-c9f9-4cdd-a571-d356298eb46e", "value": "T1C043F65178A25A2AD1E0A37BFABE518D3320B3ECD1DF7257CC114B107A9A51F0EA7781", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381175, "uuid": "cbb0856f-c24e-4bee-9023-d63f453cfc3b", "value": "1536:N8mKd9BCfKnY847xJJelcbfAu7udxTa9lSWkoj8Bz:Gmrfp749afF8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747381175, "uuid": "006b2146-57b6-477f-b337-d70339455d31", "value": 57004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747381175, "uuid": "623d155a-b3de-4c91-8fa7-c199755c4167", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381175, "uuid": "a2268607-7fc8-4486-bb79-6182c0ff5788", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a48aee6d-328a-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747423149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747423149, "uuid": "5aa68110-b0ba-4fa0-b8f4-5f5b6e55e9d5", "comment": "Malware payload", "value": "44e9ddff2513a7ab4d07d2d8c2aaf442", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747423149, "uuid": "dc07dc0c-b62b-44f4-9777-ee063a2152e6", "comment": "Malware payload", "value": "834da6143d94223b48b207bfa0019552bf4a72b347be18dea4793b3e96396341", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747423149, "uuid": "681a078e-bde5-420c-aadc-566a6ce70566", "comment": "Malware payload", "value": "fb777a39a8a636af33c525f4c73d6963a68703c8", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747423149, "uuid": "3be10bd6-4779-405e-bb9f-550857a9878d", "comment": "Malware payload", "value": "7d97e4f6937ef61c870774477baa0383068a5cb3e810c741a23678b7e0f74a61e5e67203b3d6af126a1826cb7744f3db", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747423149, "uuid": "a27204de-a5cd-4f6a-bd1b-a9de08d26004", "value": "T136A533877783DE0A8F40B5E3D4819EC528952209B10A53EF67B0A2C979CE3E3265779D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747423149, "uuid": "d1880894-f0d6-414d-8c46-211a80f37f1d", "value": "49152:up2mAJDW2G604X4pAH5HN0A07jdMUTjtg+Ui9v:2EW2ZFz0dXdjna2l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747423149, "uuid": "abcfb953-24ef-4cb3-9c0f-84c0eb18a018", "value": 2070488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747423149, "uuid": "c8b7199a-cde1-4fa3-a236-f5c7139dac39", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747423149, "uuid": "677686de-d96f-44ad-9487-ec2118f8cbf7", "value": "Swift for Invoice FTV25-614.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be6eb8b2-322b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1747382390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382390, "uuid": "e24fd414-a7a5-4b89-bde7-4677f325ecd3", "comment": "Malware payload (Gafgyt)", "value": "5befcfe99ca341958e454c3719a0690a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382390, "uuid": "5c036f84-5ea6-46b7-b6a8-415920c8184e", "comment": "Malware payload (Gafgyt)", "value": "83618ed37edab1a7008c457ae0c32dd590dae7c728925ffc8d6d2975935f7dc0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382390, "uuid": "b770cf79-077b-4fef-b739-c137797460de", "comment": "Malware payload (Gafgyt)", "value": "c1c253978135cde5a16dd838b32496166cee4464", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382390, "uuid": "570aeaa5-76ae-456a-8d40-1be415536014", "comment": "Malware payload (Gafgyt)", "value": "1d7de8bc3e726d8635dd9c2cdce0dd60cf5fc44793699c725a4e9636354e7164f6bc6bbac7b795e9c05b1055afcd25a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382390, "uuid": "ddfaf1f8-3a50-4e13-b69c-7f469605c6b2", "value": "T1F783C40ABB610FB7DC6BCD3706A9070135CC955B22F53B3A3974D92CB54B64B4AE38A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382390, "uuid": "364b3d12-ec2c-4fba-ad2e-92513ae8b364", "value": "1536:DZcyLN8GuioGXlMSG4HMyBLTrC2ioN1gBW5dZWZOFGxFxNUR:dc6N8GuioGXlMpCfN1gUZWKoq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747382390, "uuid": "a8cdb8ba-9fab-4882-ac48-ada4814bfcab", "value": 80768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747382390, "uuid": "f36b5593-a1b8-4c2c-8a76-8a7551ef7a1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382390, "uuid": "7cb8f310-185a-40f3-9238-0684acfd3d22", "value": "garm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef2926c2-3272-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1747412966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412966, "uuid": "e2a7e89f-9682-4f47-9f92-7892181854d7", "comment": "Malware payload (Gafgyt)", "value": "7d75fe29a57ca83f09903e76b7efc92d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412966, "uuid": "9d6f71e6-1322-4b70-9d01-9774b7dcaa25", "comment": "Malware payload (Gafgyt)", "value": "838e9dcaedb21f5ec10801f3287d9a3823c63614f666ef795cc233c4c7848e3a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412966, "uuid": "d437606c-1e53-40e2-96e6-18d2aa632714", "comment": "Malware payload (Gafgyt)", "value": "e9fb56eecd51fea6b138517693def90c7c66c696", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412966, "uuid": "db2c9cce-84ce-42c5-907f-5023e7cc327a", "comment": "Malware payload (Gafgyt)", "value": "7c3519b0ab466d509082607e33aed4609ac917731e02cca0020c4a6e43d00811aed076376d93bb6c3ca00b34525c28b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747412966, "uuid": "ffcd6f04-5d1b-4817-a035-732b6feb2f8f", "value": "T17CF39409D9A02733E3D23EBEF7A581CE72290ED86B573382C52D3AF45795BEA4535060", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747412966, "uuid": "cb71251a-95d5-4e00-80c1-dfaf9ae1cde5", "value": "3072:R1TZuEQtEc4RKTpiA6LwiEFeXgZdTTap5VO8UUHMjVa1ypk5uo97SaQ1/gUjwS++:RoXH5nnGaGZi7Bdk3moym4Q5LXKoq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747412966, "uuid": "232b1b22-82f2-448f-b719-aa1431c43983", "value": 163418, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747412966, "uuid": "9f3943ec-804a-4722-b0e4-f0260987da23", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747412966, "uuid": "d99a1231-1268-44b8-b549-e9a393ee2beb", "value": "jackmyarmv6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7f6bae3-325a-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747402673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747402673, "uuid": "9300a39b-7cc1-4ea4-891c-4bbac3c56441", "comment": "Malware payload", "value": "04e92939e7e70fdd05e33dd88f1e23f5", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "shokito", "colour": "#A9E8CB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747402673, "uuid": "2dbee6da-973f-4b15-87c4-0cc0d17bc7f7", "comment": "Malware payload", "value": "83a0a76ac022f50ab5b630b17c19ec088e872798006cc0847e86f428c0221476", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "shokito", "colour": "#A9E8CB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747402673, "uuid": "32e9526c-dae4-439b-89ba-7271854a2333", "comment": "Malware payload", "value": "0b5d9ed35ecb3575c8ccfcaee8f58dd177916d21", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "shokito", "colour": "#A9E8CB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747402673, "uuid": "f12625ea-0773-4272-aee5-279c9eeeb060", "comment": "Malware payload", "value": "083bbbc71a30993cb3fcc0c11a2c167dbd3b36a6a9be9035333114b8806e9473655445b6c8581659a8d75150f7ffde30", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "shokito", "colour": "#A9E8CB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747402673, "uuid": "0d4d37c5-cfa0-4657-a2d3-9ffd3d0bd030", "value": "T1B4A733DD7B8098BED4331773181672261126ED0E894EE587B638765C4833ECD6F8ABC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747402673, "uuid": "05a8701b-e920-431d-a4c2-9f574defb52f", "value": "786432:5kYBB16b4Ru/0h2hWinT8FFTkORbYV/7GVAOt5+nY1pBuShDGqBw+krxYxsvFqwk:DDvu0IXQHTHRb2kAO3p3G0w5rxFvFEvF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747402673, "uuid": "4f4199a1-aa50-4f94-8c0c-8729346ec00a", "value": 44405958, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747402673, "uuid": "6f1693c0-fdcf-4543-804f-5f85d2989e3b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747402673, "uuid": "8783d371-4986-43c3-865c-860c100dc3d2", "value": "83a0a76ac022f50ab5b630b17c19ec088e872798006cc0847e86f428c0221476.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a8440a1-3235-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747386383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386383, "uuid": "6525473b-a1dc-4bb7-a1bb-c720b7476017", "comment": "Malware payload", "value": "6a1744e6cfcc18a7d4dfa35a7f5a223e", "object_relation": "md5", "Tag": [ { "name": "196-251-90-185", "colour": "#01F3BE", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386383, "uuid": "1c442b19-45fe-426b-9d31-e854c8dd544a", "comment": "Malware payload", "value": "83e3a90e45cc0785a9489503ff27bbed1f6d4a510c02cd9f81f1c1ba3f5cb661", "object_relation": "sha256", "Tag": [ { "name": "196-251-90-185", "colour": "#01F3BE", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386383, "uuid": "a5745e56-5100-434e-b1eb-dec959e749f6", "comment": "Malware payload", "value": "79a3e7983f721ddabe7e7478f37f244188a7c051", "object_relation": "sha1", "Tag": [ { "name": "196-251-90-185", "colour": "#01F3BE", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386383, "uuid": "7347a400-29a7-4e2a-9c6f-86433f624de7", "comment": "Malware payload", "value": "e2c7df07cbc5029bd728b6a30b3551bde8cdac7fb729953503ea1fd932126a0f9d681e2cb3547534487c379f2e79e7ab", "object_relation": "sha3-384", "Tag": [ { "name": "196-251-90-185", "colour": "#01F3BE", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386383, "uuid": "b589c9f5-e06c-4dfc-a236-81c4505109a7", "value": "T12451A84123D40739F372C63260B36DA6633BB9A1B5A1D64D9291416A0873A24DC6EF9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386383, "uuid": "cab0334d-4465-49eb-b5bc-778d8509e9e4", "value": "24:8fagRFLxddSBmEXuHYSnvE583ybCj+7SAvM4agtPMjVnR/LQgvyfPMjV:8SkPdQBlXuHLvgb7za9VSlgV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747386383, "uuid": "8683b55c-3016-4011-9c5f-d0478072d5df", "value": 2557, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747386383, "uuid": "6ae4a36a-8e8b-42ca-846a-eb2e18de878a", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386383, "uuid": "73aa0ca1-819c-41c1-b8b4-422f8b696bc6", "value": "83e3a90e45cc0785a9489503ff27bbed1f6d4a510c02cd9f81f1c1ba3f5cb661", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff5e018d-31fd-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747362742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747362742, "uuid": "c57ce00f-66b5-4b16-834b-73071a020e2d", "comment": "Malware payload (Mirai)", "value": "90292df197dda0ea981013a8bdd47e21", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747362742, "uuid": "09370a99-78a7-40ec-9163-0be3858b2674", "comment": "Malware payload (Mirai)", "value": "84223e7c1d97ed4886e8fea9975d74367ee893bd3dd9fe1081cc68bbe07fbfad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747362742, "uuid": "b5e70340-940b-4f1b-8afa-11a4a5d347be", "comment": "Malware payload (Mirai)", "value": "e2853aabaee1cd9e527e1ea0fc6e153401f8efea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747362742, "uuid": "d96b6c5b-edb0-4e61-9c19-56e89b0f7e7f", "comment": "Malware payload (Mirai)", "value": "df6cbb74c3519434d7207d24e1ee41c093a6fadef070476819431a1d071e0f1ddc4eb10b6945cbdd67f129f2ddfcc2ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747362742, "uuid": "5cee5878-d7c1-403b-82c2-eedd24e894b1", "value": "T1A6E2D193827AE7B4C0233B776D444080B8F068A85F228F375CAD71FD6D7ED5A1925E90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747362742, "uuid": "ed7b932b-08b9-4e2a-b08c-66d97987b3f5", "value": "768:17Dm0WKYJGIPZ71fLXTmJMrEFVT+Vv+L+s3xnRBViFYX2Sx0fV:17rWKYJxZ71TOuEFVaVv+L+Y6G6V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747362742, "uuid": "fb325384-e444-455d-8322-95a3e7e6d6ec", "value": 33448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747362742, "uuid": "5049167e-e1bf-46ef-89c1-ce2478a86b0f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747362742, "uuid": "e3c17484-fcb0-42c1-bfdb-ff3208984626", "value": "neon.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "024edd5c-32a5-11f0-8bd0-42010a9c0005", "comment": "Malware payload (BlankGrabber)", "timestamp": 1747434473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747434473, "uuid": "5b96aeac-d26d-48de-92d7-7cc64dbf9100", "comment": "Malware payload (BlankGrabber)", "value": "16218630cb686cc8172b0cff7329887c", "object_relation": "md5", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vgszf", "colour": "#2A4731", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747434473, "uuid": "1298059d-5e7d-4502-befa-dd21ee647bf4", "comment": "Malware payload (BlankGrabber)", "value": "8453b3ac669bc4b733dda13643d3bb9b77ab956ac5a6f3941abb605c4ee6afd2", "object_relation": "sha256", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vgszf", "colour": "#2A4731", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747434473, "uuid": "c58fd12b-f964-4dcc-a80a-c84d12e4478c", "comment": "Malware payload (BlankGrabber)", "value": "4184660f1ed34762a162ec9fbd536a1a85919804", "object_relation": "sha1", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vgszf", "colour": "#2A4731", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747434473, "uuid": "3719d056-0981-47ae-ac29-a5a6ca2dda6d", "comment": "Malware payload (BlankGrabber)", "value": "8c30ebaa5653ab0ed38b08a2df23e3bcdf687827de9cbd6f4588f62328de9941b6b27f278d1856760c16a38a99e53f25", "object_relation": "sha3-384", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vgszf", "colour": "#2A4731", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747434473, "uuid": "c6a7c932-3da7-4546-8d7b-ec05df3f86f4", "value": "T1FA96334576894CE4D8FBC43D84834513DBB3BC52AB20DAAB639802755F7B6B02D3EB91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747434473, "uuid": "b0c1d216-070d-4a99-ac78-e3c361882aa5", "value": "72c4e339b7af8ab1ed2eb3821c98713a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747434473, "uuid": "73db63cd-53a5-441e-b6b4-b2ef468b8be9", "value": "196608:2PgQHVEE0wfI9jUC2gYBYv3vbWQO+iITx1U6nq:pQHVESIH2gYBgDWQxTnzq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747434473, "uuid": "bc66be31-dcb9-49dd-86dd-03200865bb1f", "value": 8683817, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747434473, "uuid": "ce114356-6e75-408b-a6e5-ad815ad08124", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747434473, "uuid": "ad583b44-6031-44e7-8594-ab8a83e24523", "value": "mappercaralhomtofodaaaaaaaaaaaaaa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26b138b7-3238-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1747387719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747387719, "uuid": "c587bfa5-f192-4616-90ff-874c25cc26fc", "comment": "Malware payload (Prometei)", "value": "407407b19587c9ec74313965d34d0195", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747387719, "uuid": "7bb78a91-f558-49f7-a5e1-d62d033fe7e1", "comment": "Malware payload (Prometei)", "value": "847bf9fe9412f8cca353a0b52e4efc4101943e0d9a0fd423e470eefc52ab57df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747387719, "uuid": "8db3f509-bb79-4ff2-aabd-60996df98016", "comment": "Malware payload (Prometei)", "value": "36a1329b7f8f43dfdde41d37f936cb3e120cd65a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747387719, "uuid": "15bad273-4c15-4613-8e2a-e8ac21c0c006", "comment": "Malware payload (Prometei)", "value": "5286ec6d85cbefbf40949fc8038866a4b4993e6f797f9c7a7a93cb288c0119c9ad4e9686b40e5ba48a1255a6b39f02f6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747387719, "uuid": "d51e3a8d-027f-43bf-a17d-dfed2cbfde17", "value": "T1339423F8C83D2E30D8169B3CBB5A826CF0A15772D9562F6EB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747387719, "uuid": "e70f7ab5-b91a-4fbb-957d-2253468c794f", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitge:25WOSACZSV6eKRH5EPiamb4DsDwwcO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747387719, "uuid": "d5e09f53-739c-4714-af42-63ae6ce8bf00", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747387719, "uuid": "d4479a7a-9f66-4e86-9905-3f96473247e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747387719, "uuid": "43128ff0-d873-4d6a-9954-028c777aa323", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33d82236-3227-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1747380440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747380440, "uuid": "2595661e-a1ea-4fc3-b1ad-db42e9d08f1f", "comment": "Malware payload (Prometei)", "value": "e4373e20d3c4b370fefb8d9bebc87b41", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747380440, "uuid": "553d40bd-cc39-4e94-bf3a-00c5c2b505a0", "comment": "Malware payload (Prometei)", "value": "84e01dcd2c3e8115adabbc97ddc9fc812b163260d3ad238660b2da43497ab37f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747380440, "uuid": "b6c1bf3f-cd18-41ea-82f9-04ecd6ac0eb9", "comment": "Malware payload (Prometei)", "value": "02a8936642981d6d17c22dd3c1b931e021a9bf4c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747380440, "uuid": "f52f8a6f-64aa-4fa5-8fd3-31e93ace4a31", "comment": "Malware payload (Prometei)", "value": "567959ff6d9d35402f98d73703dc6730f616301ba6f49212bbd64628f75b6f19cf2de52b4f13470fd7408f89efe112b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747380440, "uuid": "c4b5e206-343e-4625-ba22-2b8942a51ca8", "value": "T16A155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747380440, "uuid": "f2b3ec39-05fd-462d-b64b-141ccacfe8ce", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mplz:qmShf4OTjMgXSJhBXEsVrmz9MOup1Khs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747380440, "uuid": "f60452ad-cc91-4057-80a7-e1cda4e60795", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747380440, "uuid": "d69c49e7-0b17-4678-83ba-a088938c8c88", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747380440, "uuid": "23c9c803-6025-4066-be04-50cc198cf8e6", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81b617aa-3245-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1747393455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747393455, "uuid": "6dc3ee4e-5f12-488c-8a8a-7324e0461d2a", "comment": "Malware payload (Gafgyt)", "value": "662c546352fab63ffd0531f28a11ccce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747393455, "uuid": "910981f8-4ff6-4a3c-a8df-674685406189", "comment": "Malware payload (Gafgyt)", "value": "853427d960baf5613d660091ac4a2afa8fb29afbd6c062d2914649f6f13fcd30", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747393455, "uuid": "09670d4a-c9fd-4a31-8f1a-15eed5091e4c", "comment": "Malware payload (Gafgyt)", "value": "e0d316e485c93e9f62f773e86ab244360c3c838c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747393455, "uuid": "1cd16578-4b77-4993-b27d-954f1701b2a3", "comment": "Malware payload (Gafgyt)", "value": "9223ad1209a66c3672fb2b60a37e679dca4459240f84a59b03c3289f698f5e6dc9bca8c27934eb1e9671c49ff1f35d9a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747393455, "uuid": "357d2dcb-d724-4399-9c98-3ed559dfc468", "value": "T15BD3D617ABA15DBBD80FCE3302E64521109EE49613957B6BB178CA1CF74BA8E09E3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747393455, "uuid": "3aa69b16-f3e8-4890-9eee-7625df81e875", "value": "1536:76ejNyUhayRB4pa4ggYJ7vOTlC7xhxPYsXm/KBgvYYiCh:74yX4pNLglhx3mCBgAYiCh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747393455, "uuid": "27a8f1c1-e082-4fb1-8a7c-60570aab29bd", "value": 140059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747393455, "uuid": "9a039f37-69c3-4f22-b0b0-48fafb3c16b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747393455, "uuid": "831e429c-4f78-462a-84fb-018220452ad1", "value": "rebirth.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f26af86d-3287-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1747421991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747421991, "uuid": "a5aab1bd-a173-418a-af98-3f4f41751a87", "comment": "Malware payload (Gafgyt)", "value": "135833fb384d3486edb7715742e69ff1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747421991, "uuid": "32d9a2ae-ce08-4c41-a2a5-77e0227b805d", "comment": "Malware payload (Gafgyt)", "value": "853815e7da82450680c579b4a3b13f1d641d60789f2a4ee20137dc034b8f9174", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747421991, "uuid": "c9b32eb1-5b90-4272-9cea-e2dc62e8d288", "comment": "Malware payload (Gafgyt)", "value": "b4926dfa3ae6389aae3bec466e1faebf288f15ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747421991, "uuid": "61b2e39d-0590-4bf1-9ece-8e26b72c3126", "comment": "Malware payload (Gafgyt)", "value": "7221547e3608da71714d1364bccd2a5527c9239d4abc7ec7f2cc8393c7c55d20de7e560fdf0f28803155978ea8d951bb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747421991, "uuid": "e8c39f4c-01a7-4787-bde0-96851a45b2b4", "value": "T1F7E36C2B75C18CF6C00286B126DB63549523FE7F0AB62147B7947DA0BF398C94E69BC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747421991, "uuid": "a5663467-d0a1-4627-8e15-c5769b64e135", "value": "3072:t1gzJvfR2KNGYAXXpETbZNutJ8adPF4KQTjsn/SijebvfcivGmS+Qk:Y2ASX5YPutJ8adPF4foBebvfci+mS+Qk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747421991, "uuid": "23883338-ec1e-4ab2-a26f-ce9e09dcabe1", "value": 143460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747421991, "uuid": "7c24d0bc-38e2-4c5f-82b6-e24038d1ff09", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747421991, "uuid": "d2047a8c-6483-45d0-96f7-aa69e9ac008e", "value": "bash", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bd8d719-3262-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747405740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747405740, "uuid": "9db6eda4-dfc1-4a71-ac05-bd3a8e76bca3", "comment": "Malware payload", "value": "86dfe2e87ff21d4039349743fa4bf869", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747405740, "uuid": "a5f085e9-ad76-408b-80c5-f815a854fffd", "comment": "Malware payload", "value": "853c7a5c51094e0dc0e13fa3fa842a3255db581318fb7a93a251a44e7f4e262d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747405740, "uuid": "fde1df58-9e22-47e3-806e-33661af2aae3", "comment": "Malware payload", "value": "62552bc382d21df04d0ba396399a7ca6be2e9092", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747405740, "uuid": "ff619ebf-3a72-47e5-bbfb-91190a96e0cc", "comment": "Malware payload", "value": "e766b7d3beeefd149ee8d725a6d64c0824af9b0614037afadd400079630590973964d648ad6b5fc7dd53a4b946742107", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747405740, "uuid": "67b6f06d-c1b5-400d-b924-60764d962de2", "value": "T165A30A96F8A28B56C4C557B7FB4FC75637231795E3DF36038A184E34278B50A8E3AA01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747405740, "uuid": "e9684712-5c86-4614-9a9f-60202b883349", "value": "3072:9LOuh02xHCKQnqZ9YfMXKgyLlBZSyPjYNf:FOuhPHCKsqZ9YfM6g23ZJLYNf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747405740, "uuid": "09d6c961-87d3-48f6-8f16-e06df9b98102", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747405740, "uuid": "ce66a39d-2769-4abb-bf9a-7dcad0a3ef06", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747405740, "uuid": "a44b2b70-e356-4db8-8401-47f54184563f", "value": "tftp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a8ee7a9-3220-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747377445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747377445, "uuid": "52cf56ad-bc37-463b-a2c2-570bf20737ba", "comment": "Malware payload (Mirai)", "value": "ca8e0bdb1091455a6b7b7e510627b244", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747377445, "uuid": "d83a0959-1fe5-494a-a134-13e0fe7653c4", "comment": "Malware payload (Mirai)", "value": "859aabf17a2ac38c2ad8721b0feaa1093173ea052d03879ffd14cf2a2dda6259", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747377445, "uuid": "8c0e1945-490e-41d6-851d-49a8d5ce9768", "comment": "Malware payload (Mirai)", "value": "4efa8e514db15e64f2d728d839ba619e4a822ffb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747377445, "uuid": "1d808394-4581-41a5-8200-47fbe2fab03e", "comment": "Malware payload (Mirai)", "value": "5a570afc2e45706d43122ebcac3707faa9a434f6ebf8f6f2827414cabe0368b28a8d6a7d2aafa4cac5c7c1b6ccb94446", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747377445, "uuid": "aeeae462-057b-4287-98b4-e747947e667f", "value": "T1C3B38CCBF6870061C8A346F017CB4B9E2E2322815F1796F36D69763E1A7A1EF1905B81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747377445, "uuid": "34437c6f-5251-42b3-99f0-ef45090d52d2", "value": "1536:0AJxwObdAQP10GBF/h2nf1OYYDThHfxinjRg+MW+/LWEz:ln5dT9jBF5OOZThHwRg+b+q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747377445, "uuid": "f044d4de-4cc3-4199-b1d7-c4c367df5f5f", "value": 116448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747377445, "uuid": "62666b0c-11c4-4f86-8771-69a3907a8c97", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747377445, "uuid": "5b89aa4e-216c-4e45-accb-cfd85b3fa555", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa602b36-31f7-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747360157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747360157, "uuid": "ca4767eb-c9e8-401a-b3c8-4fbf531fdecb", "comment": "Malware payload", "value": "f8f54bd396ef1f42e445227ef2d83c4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747360157, "uuid": "aeb50766-c585-433e-bc27-30de2debfec7", "comment": "Malware payload", "value": "85dd5177d90553bad25a7166d475e3033c8f888a09305dfb2ee500c9874fec5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747360157, "uuid": "f7c878fc-3233-4526-b9c9-5b6b12aff57a", "comment": "Malware payload", "value": "f55d1b9b821f86955592e60b97fb570574b9fa27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747360157, "uuid": "4a4470f7-5101-462d-a6c3-a78877e90812", "comment": "Malware payload", "value": "babec8929dd1a9699e80691dc28fbcf018e015669d832c7f39cc22bf1b5a3242de58c812f3d172a8c9e68be5f13eec21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747360157, "uuid": "b5e278a4-4b33-47be-965d-88cfe0ad7098", "value": "T1FCB49E71F7D18537D1271BB88C1BA2A998397F102E2864477BE82D4C9F397C139292E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747360157, "uuid": "72498f7c-f56a-40e0-9324-0c0622240c90", "value": "9a06f0024c1694774ae97311608bab5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747360157, "uuid": "07b2e9f4-f7f9-4425-b54d-84897c2620f9", "value": "12288:9rMIztyCK5x8CBmn+RrNbEyWYa0Ie1vUx9V6:7ZyCA8CBmn+RrNj9ay5I6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747360157, "uuid": "1c4957b5-a90a-46d9-9664-f1b73e1a6b85", "value": 534016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747360157, "uuid": "b282e3ec-b047-4c80-bae8-c30c06fce11f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747360157, "uuid": "3c0b775b-503e-4655-a286-a04436a8193e", "value": "EzCad2.exe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3f0713b-3228-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747381111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381111, "uuid": "ac22d334-1ad3-4b33-a240-aa59fb81152a", "comment": "Malware payload (Mirai)", "value": "d870bda9d4bbaf8ccfa67e1c3c787908", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381111, "uuid": "6b08e7ec-e1fe-418a-974c-3426daad10d6", "comment": "Malware payload (Mirai)", "value": "86273b5bc6ab42e8b9c0a241c17df5d2cab80e21b64bb89d92e4919f2ef2162d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381111, "uuid": "162644b3-c9ae-4861-969e-a0605538c41f", "comment": "Malware payload (Mirai)", "value": "46e283067eac98297d71169803edca3948993a6a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381111, "uuid": "4d8c67d6-0ffe-429a-abaa-7ba0fc3e9ffd", "comment": "Malware payload (Mirai)", "value": "66430452ff78acf441abacfbe36a131199ffc647f987f3409f18a0572c231c0c1bb03ec310cf0855f81996da1a6a7f1b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381111, "uuid": "20b50dd5-6f21-4980-a2af-521431fde78b", "value": "T15283C6297E218FBEF79D823947B78F22964837C637E1D581D15CDA005E7028E641BFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381111, "uuid": "17c4753d-c2c1-494d-a653-e8e5d31f1521", "value": "1536:E6/iw/0w8HoQ5uy8NxqlcJ0vXxh11xYqcn6BZOpkMoAogR:x/8RHTgMcJ0fmqJZOpkM/XR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747381111, "uuid": "217120b0-2fa7-400a-b391-4b300c0f5bd6", "value": 85312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747381111, "uuid": "e3355627-f6b9-47ff-9045-24ac1abe92c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381111, "uuid": "7b731e55-2097-4cfd-9047-6deb91a5fc88", "value": "sora.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b838b293-3228-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747381091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381091, "uuid": "5527e61c-0544-49d8-b0ce-3d5f58060a8e", "comment": "Malware payload (Mirai)", "value": "3ce976732b4f0f8da1ec8a6d44ae2004", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381091, "uuid": "65580ed4-1073-44fc-993d-91e86b117b36", "comment": "Malware payload (Mirai)", "value": "8648b0630a82999ce10ef156408f57b2634b277b4d810719e01e0b743c5a34ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381091, "uuid": "53d93748-99e5-4a98-8bf3-bc7428eaf106", "comment": "Malware payload (Mirai)", "value": "ca0396bc476e7cf759506d54b87730f97bdcf7f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381091, "uuid": "b31f1c67-5678-475d-8986-796557991927", "comment": "Malware payload (Mirai)", "value": "f3f0021b41812d601232f2d4adcf1c071e4584804a5fe197c6e131da59fc8119ed9efabee763bf6ee04b74c5bac4ed3e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381091, "uuid": "4240116c-df66-44c3-817a-3293b426314d", "value": "T1B6E329C7F800DEFAF80AE33748570905B630BBE115921B372257797BED3A1991963E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381091, "uuid": "d45ab374-3823-4f3d-8508-324a8d7b6411", "value": "3072:KmzTDH86Jn78rCdV5jAti2id2ow9+aVvjbitLLxGyMYE8j:K2TDH86J5fjAtiHde9+3L4yMP8j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747381091, "uuid": "13e51716-ae18-40c0-9412-87875e739b14", "value": 150464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747381091, "uuid": "c1c1e132-26fc-4e15-b5e6-94c2aa6759b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381091, "uuid": "6fc8af40-7f45-418f-8d0d-7c1772f82726", "value": "main_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5166295c-3222-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747378342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747378342, "uuid": "aff3f6eb-cc54-4f75-90aa-b8a1e89fb831", "comment": "Malware payload (Mirai)", "value": "f3132c546df87ba3ba4db552a0413bb3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747378342, "uuid": "64f0c448-ec2f-4c62-aa41-5a39489aa779", "comment": "Malware payload (Mirai)", "value": "865bd3851fe9a3acaf872084f8e7a67fb06c8abd82c9a918898f58224e8ccfe0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747378342, "uuid": "6a026e80-8f6d-450e-bbd7-3b85db6003ab", "comment": "Malware payload (Mirai)", "value": "cd7e62777fa85cafb491dfaf7b807e1f59e5a40b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747378342, "uuid": "54ea2467-64a2-42b2-82ee-c252e5636d50", "comment": "Malware payload (Mirai)", "value": "11f094b45b0731c03d93cc92f09efce614a146325166dd1f8993ea66159434c2201d62dda7e5e608758e7074d0bad19f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747378342, "uuid": "78336d99-6030-42c7-937a-7ee7ff40fb73", "value": "T12DF2E175C68FE5B0DA302A36664C8947EEA71F3DBCED34242A51172C6FC2E4207D6D82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747378342, "uuid": "63b4430a-9eac-4d33-8a6c-4ad73206e0d2", "value": "768:FEy0ESBXrnhBzaRo02PLRBh/2mNwXNoxHS7llo9q3UELSL:Cy0ESBXDLzaIPLRncNohS7rRLQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747378342, "uuid": "cc71d1b4-4f06-4931-9e64-ffba63a7943d", "value": 36988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747378342, "uuid": "6fd473a6-18a9-4d7a-9eea-705e37801574", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747378342, "uuid": "6a3f75a8-1ef9-40c5-9d36-8c95431f00f3", "value": "neon.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "922651c5-3268-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RedLineStealer)", "timestamp": 1747408515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747408515, "uuid": "f4ae3f21-6b63-4ac8-9955-9aee98661f4c", "comment": "Malware payload (RedLineStealer)", "value": "bff537f368cf413f3d6d6d9481b1ed50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747408515, "uuid": "a825e001-7009-441c-8fc1-d70785c9a029", "comment": "Malware payload (RedLineStealer)", "value": "868e724925e76c170363a3a3d1a9f302f522389cdfac2a26651d3f1052e03828", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747408515, "uuid": "19ec8669-d2a1-4d67-99ca-09fb0a2bb565", "comment": "Malware payload (RedLineStealer)", "value": "6161b4304a086644e9d5fc41bd131c9b2bc1c8f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747408515, "uuid": "c11f647a-900e-42a6-bad9-079bda6d25d7", "comment": "Malware payload (RedLineStealer)", "value": "ba4a0c9949cc929b4aa04a5f2272c76507511ed5dbf6cbe9727a6fab182d43a0671ad89b582097dc40e433f4f7b7eacd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747408515, "uuid": "487d5db8-44bb-4d36-bc75-558c54371184", "value": "T14D159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13A81DB9BD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747408515, "uuid": "afed17b4-05d8-4fd3-aa9c-40d64086da37", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747408515, "uuid": "78f43d3c-a473-4c68-aa75-83dcb2e8e0c7", "value": "24576:UqDEvCTbMWu7rQYlBQcBiT6rprG8aMGb:UTvC/MTQYxsWR7aMG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747408515, "uuid": "d5990e16-d286-4bf1-9bed-13d79ec2edf6", "value": 961024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747408515, "uuid": "67085767-9f45-4093-abef-1ff9bd2faee4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747408515, "uuid": "9605039e-55ae-4e57-a961-724a520f5de6", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9f2e3b9-322b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747382356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382356, "uuid": "426050d9-2522-4700-b86a-cb36789abfa3", "comment": "Malware payload (Mirai)", "value": "63e84e3a8671eaae86aff508e87cd233", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382356, "uuid": "851208e8-8d83-4a54-8065-c2aeb4b0ac19", "comment": "Malware payload (Mirai)", "value": "8697c17faf09914d4061f37e89f5a36fe5a698384e6df09170df54898ec44e75", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382356, "uuid": "5bfc3ccd-11c4-4c31-be13-91ff91d3a8d4", "comment": "Malware payload (Mirai)", "value": "a7a0ebef0799202de51ae2125ee2d4d39d5b7f9b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382356, "uuid": "2d5aa390-af4e-4d49-b468-64036f4431d1", "comment": "Malware payload (Mirai)", "value": "6c6790685c9d849b162264f82753b3ea32d3491aa4de3e3e3aa53e685c0fdc10a886b6675a47039b83464860a2616d07", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382356, "uuid": "eaf2f74f-18b3-4286-9826-11eaa6aac2a4", "value": "T1DF23025D2E75382086F018FACB804609349F19EFE97D3536D9F09D1C7AB199AB0DD14A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382356, "uuid": "04b08077-5b24-4272-8034-3585513825f8", "value": "768:8n+ZcEIQbaXaHg9Y5YrbjZY2BTLVwKapun5DOPyo/Xi9q3UELQ9Pi3aEkCDpI:8+ZcEIQGXs75KbNY2ZLVwsD2/nLQEqEy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747382356, "uuid": "580c37d6-5028-4a1d-8e7b-e1197f71bcef", "value": 48740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747382356, "uuid": "1b337d36-6012-4d8b-ab9c-1f5aa4610a72", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382356, "uuid": "b5dc6899-1abf-4156-b06a-6f46a7f68165", "value": "phantom.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c07e96b0-3279-11f0-8bd0-42010a9c0005", "comment": "Malware payload (njrat)", "timestamp": 1747415895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747415895, "uuid": "bef55ef6-18a7-4691-a653-65a658009022", "comment": "Malware payload (njrat)", "value": "f75fab1bf8ab16f9ece439e9b22325dd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747415895, "uuid": "8fea3e61-c29c-4abc-aa17-4e95f682e20d", "comment": "Malware payload (njrat)", "value": "86aae65ce3c1668cfc4d5914a86830fccc088484d32232e0e1203735fb74ffb7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747415895, "uuid": "37ce336f-7b13-4b2e-99dc-085e4cc10fc2", "comment": "Malware payload (njrat)", "value": "2784b067b138cf173385bec3233b4b9b5823c3d8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747415895, "uuid": "c9dba64a-f4bb-4c3e-be9f-bcf6bcffbc4a", "comment": "Malware payload (njrat)", "value": "4f8599b43ab5886a9a668f1a9f5a7e53f4786bbe8594304ea4dd80f2631980f77d34e97043a6ef9e5847b70787067a0b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747415895, "uuid": "4d3a0103-8c31-416c-9284-460ab152b3b1", "value": "T16147331BEE8303B5C14AED3438565FAEF31E71E2BAB2151CB344EF8848596506BE3356", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747415895, "uuid": "abe99515-e061-4795-b46b-c0ef0e1fda1e", "value": "786432:MCygXHrCT0kw0OJAxTtJtAfoJ/9nH2a2UxfDfgSnVv:5XHrCTvbOiTt7AfoJ/9Wa2UxfDfgSd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747415895, "uuid": "5dc99e3c-f838-4101-9cd0-e01104561905", "value": 26222839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747415895, "uuid": "cebb8a28-546a-49f5-8b8e-5d2e277888d5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747415895, "uuid": "d7a1aace-2c2c-4c35-a089-4c07a21e7f1c", "value": "XWorm-5.6.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f28fa96b-3272-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747412972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412972, "uuid": "55e20d3a-f6e4-476d-9199-19bf5813de68", "comment": "Malware payload (Mirai)", "value": "77d773aab4616c7b9ae34e2d95d2bbeb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412972, "uuid": "381d8169-91b9-4879-8a2b-cbf233db761a", "comment": "Malware payload (Mirai)", "value": "86cd6de4a9406f7f6c9524f8a1a9967a297703d82ecb70ad9698537e9098f596", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412972, "uuid": "1bfc8df0-3b8f-4ab8-9ddc-5978d273c13b", "comment": "Malware payload (Mirai)", "value": "eceb034e29b5a20634706384d8f49233e6de572d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412972, "uuid": "219905bd-5ce0-46f6-a832-0cc686e6f741", "comment": "Malware payload (Mirai)", "value": "5a575ea91011c1abb3a95377e49f5f3a6eeacb8350c5aca58494857d7644aad967deb4e02e68e2c13ab48ae61a7fa50b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747412972, "uuid": "a3bed28f-b6e8-4885-b708-af0ffed7850b", "value": "T1A4833A22BA761E1BC4D4A8BA62F70325F1F24B9A24ECC61E7D710D4DBF6064026477F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747412972, "uuid": "663a3843-8f91-4a93-a371-d2f982e7a52a", "value": "1536:EPljSSn8VDHZNhwen+vHjDjtc5Nk5fFCQNriGtBcity:EdWJCeIe5NUw+Py", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747412972, "uuid": "7b315bd4-646f-420b-a546-a0971d07de42", "value": 81124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747412972, "uuid": "ffd7424e-1c22-44c3-90a7-2bdfdfa8b3c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747412972, "uuid": "fb5c7e17-33c5-4c83-9afd-9a05ea29dd8e", "value": "Aqua.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3540287-3212-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1747371742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747371742, "uuid": "b97867ee-4352-40ff-9fc1-27a123819e5e", "comment": "Malware payload (Prometei)", "value": "3b24490a1003b64f324febe422a5d6d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747371742, "uuid": "f1e70fc9-f455-4dfe-bf3f-dee2674e17e5", "comment": "Malware payload (Prometei)", "value": "8793db379d7b3804d426292dacfdea1f46aef72ee7d9b715da3aeb7b50900e50", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747371742, "uuid": "b8bede21-5c67-498e-a24c-5f2df26930cc", "comment": "Malware payload (Prometei)", "value": "15191c9826250367019c1e35fab73e9f4d499bc6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747371742, "uuid": "193d5428-20df-4323-a9d9-ecab1ab6c77f", "comment": "Malware payload (Prometei)", "value": "1feaffd1cc8edf496a11361941d96c3ca43322387500c3b606eb035e32276955d20f50685bc5f257d2c90114ce174841", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747371742, "uuid": "38a46bc5-c594-4043-95f7-77c1e67cedb8", "value": "T1F4155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747371742, "uuid": "0820bfd1-5381-49df-995f-bf37e2545b3d", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8MplK:qmShf4OTjMgXSJhBXEsVrmz9MOup1Kh5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747371742, "uuid": "f802716b-ff54-46aa-862c-70a946a0eeed", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747371742, "uuid": "154af6e2-78cb-4e16-a085-2c3d4488d38e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747371742, "uuid": "0331be07-342a-4a67-8ad5-6c2fce79cbbc", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4c9afca-320c-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1747369060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747369060, "uuid": "5d5534a4-f6be-497b-a0ee-43331f771164", "comment": "Malware payload (Prometei)", "value": "e419df307bc914fbb1dd29665a250733", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747369060, "uuid": "754389ee-217b-46a5-aeeb-8e18e677665b", "comment": "Malware payload (Prometei)", "value": "8808c570e41712aacbdee3fd099874a27c25c272dc01398043dc428b65a5d077", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747369060, "uuid": "a7df588e-0ed6-4879-a19e-29c3a7443a2a", "comment": "Malware payload (Prometei)", "value": "2b09a1a8bc66c2f5825882b93c28365940e46dbd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747369060, "uuid": "0a5c05f7-16ad-4764-8bae-9d454cfdb7ab", "comment": "Malware payload (Prometei)", "value": "c1450af663a02cbdf29bcc1bdac6f41bd637302818071cb75f26bfdadf96e3a996380b37ff5447bbb3998a61785a0119", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747369060, "uuid": "ce8031cb-3acd-4e84-bd88-bf68cbd91059", "value": "T1249423F8C87D2E30D8169B3CBB1A8268F0A15772D9562F6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747369060, "uuid": "fd939006-2da0-410b-a6f5-c0eedc193616", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgD:25WOSACZSV6eKRH5EPiamb4DsDwwcz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747369060, "uuid": "3938e062-36cd-44a5-8814-498b4f22f657", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747369060, "uuid": "c3c61c51-6c0d-4387-ba7d-26a25032028d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747369060, "uuid": "235129b5-e099-4dc9-af36-b360ce203f38", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7347bf54-328d-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747424355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747424355, "uuid": "669f0501-7cb5-4b1b-8490-a1ba3678094e", "comment": "Malware payload", "value": "02b585bbddef08a8fbb478d269b8e2a1", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747424355, "uuid": "298b8997-2369-4868-b533-5ac261582fe0", "comment": "Malware payload", "value": "88092bc54750881f96d0fddb494674474b35330c58df446321f366dcfa38c5ed", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747424355, "uuid": "5eafbe48-e1cd-43a5-a96b-f6e330f8cb1c", "comment": "Malware payload", "value": "e404ff5c7d1f7e9f1ddbe183f4a2c36375715335", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747424355, "uuid": "eba58b25-ca24-4f49-aa6c-d22be8fb8960", "comment": "Malware payload", "value": "3a5200f8fc12fbeec47a62b6a183d916ea1707da03dc57c8d55815e1fd6fadbe9f5526f29152d68a266c2c99d189f6a4", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747424355, "uuid": "221d14a0-27f4-41d8-942a-dd27c9368fb7", "value": "T1B0F6338FEAE78FDDE51CB61217CDB7E892111EFA0E210630D255370EE14AB35351BA64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747424355, "uuid": "4027fa32-cec1-470a-91d5-14eaa6d0abf6", "value": "393216:guZamf6Dxq4FKcDlZcXFqRDdv3Mj3VQeJWVXsCK:pZwg40cDlmqRDdv3Mj3VYct", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747424355, "uuid": "4cd7ea0e-caf7-4111-a634-4769763e4c60", "value": 16219165, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747424355, "uuid": "2e5695b6-6ce3-4db2-af29-1cb44dcf7041", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747424355, "uuid": "a959ebd5-1357-4e24-b053-3b0302077c24", "value": "NitroGen_v2.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55b76dfe-3235-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747386510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386510, "uuid": "0c14d7de-d29b-40f9-9303-98f6bf323556", "comment": "Malware payload (Mirai)", "value": "cbb070c6cbadfbb4cbbbf418b3b42168", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386510, "uuid": "6e258796-4329-4d76-93d2-cb3a83907c6e", "comment": "Malware payload (Mirai)", "value": "8857f842bbbc0860a944a6c6e7c7aa3f7fc372823d21fbd6db24f60fa354031d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386510, "uuid": "2e0634fa-e1bb-4867-b212-e9abab8bbde5", "comment": "Malware payload (Mirai)", "value": "5b8b4db0e7042cc4b418b7eaa8fea518acc41906", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386510, "uuid": "c5438c05-4b48-44ea-987c-06ad8e5a62b8", "comment": "Malware payload (Mirai)", "value": "c1a382af3048b6a9a81907d3ea25d0f5c133ed40b88a6ec9a87555436c68fc729fb18cacc5e8035eb8f092dcbd76e155", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386510, "uuid": "d9beca6e-4dc3-4a74-b274-9165f3abd3ee", "value": "T15B430270A4D1A426CDF84379D742E752AC263BFCD1BCB5AA7058C20C5AE981247EF22D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386510, "uuid": "2e30ed3c-ffb1-4652-bffb-2ffeb348b602", "value": "1536:vWdp6Xt8no7twhflxlMhdrSgJyRBHLeVDivF9E6Y:edUd8noUHlArSgERJLeJWCD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747386510, "uuid": "0a08b087-5793-49ae-86cc-5655b5f2b25c", "value": 59308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747386510, "uuid": "4237206e-8a16-43e1-89bd-6b69f0cc6e98", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386510, "uuid": "a5fc5b46-62b2-4a35-85b9-66e330774e7c", "value": "neon.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4df84336-31f6-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747359438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747359438, "uuid": "db9c21d7-d7be-421e-a424-ac71028595fb", "comment": "Malware payload (Mirai)", "value": "3b87699a44add5bea059b910accbf42e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747359438, "uuid": "69aff48c-5a79-472f-838c-4ae983958d77", "comment": "Malware payload (Mirai)", "value": "885da8eb3d9c89d061e41c5a249e82a1f8159a11e47e58d7872f1269efb7cc2d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747359438, "uuid": "35f0440a-4f12-440b-b8a9-5dc2dc254690", "comment": "Malware payload (Mirai)", "value": "5dbfa68409530b6c22903957213aae80dc6237b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747359438, "uuid": "8255c1ae-8c95-4845-9c97-bc42a1a06d61", "comment": "Malware payload (Mirai)", "value": "26e4f812152d11bade26d7f6c228d34bc049b8014501da1d9d8135d3883f4179cc6213b4ce3fabc7d5865a676dff8c9b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747359438, "uuid": "8b889da3-2606-4512-80c9-ea58b1505316", "value": "T15293E909BF511EB7C8AFCC3706AD1B4238DD599722A53B367674C428B24B54F2AE3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747359438, "uuid": "b7f0de57-8fbe-4cf6-bb4c-2292fb95fd6e", "value": "1536:BXLdRKdKetFGXmibZ0JeIC2H6ZusI+lYZePm2zqbJ:BXL3KK04IvH6/YaabJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747359438, "uuid": "2949dcce-8381-4981-b856-89f5314e748d", "value": 88864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747359438, "uuid": "ccd63279-f9b1-41f7-a070-57a3b1a0e446", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747359438, "uuid": "db3767c2-4f5f-40dd-9a1b-e86a1129b951", "value": "neon.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea6efd0e-3287-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1747421978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747421978, "uuid": "524b0197-c6ed-4404-8ca1-687a9dd99ced", "comment": "Malware payload (Gafgyt)", "value": "c8a029742902dee60f724423c5efd106", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747421978, "uuid": "ec806eb4-77b0-4111-a79d-83a07c11739d", "comment": "Malware payload (Gafgyt)", "value": "8a1e435d22380ee883e7fc0d7d337771b54194b815b13744d7730de18b3972c4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747421978, "uuid": "de0a62ae-a944-4be9-8b7a-4672d7d2d1bb", "comment": "Malware payload (Gafgyt)", "value": "e7aa3ddb308a72c31ee734e146113c9f9c23141f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747421978, "uuid": "4be4f0fd-206a-4a7a-992e-3e400a22c159", "comment": "Malware payload (Gafgyt)", "value": "9722b890d64bd05060c6f96f0621d84a4300ab6df1a89549b1031f64ea276f2d125ee6fdb4203073d64028a703911914", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747421978, "uuid": "fb9f752b-bcce-4a69-ad24-824ac5036b2e", "value": "T19D04B72E3E11ABBEE164867107F75B70C3952AE725D19382E26CFA185F7028D185FBD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747421978, "uuid": "3bdc27d2-28a4-48e0-bf2e-d35d75161a8c", "value": "3072:SbCOQz0L+xfZZNcKetJ8add9Qzhs/d5OOPfqndfi+KqLwZi+LUk:aCVU0raKetJ8addQyd0dfi+KqLwU+LUk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747421978, "uuid": "f944a26f-ad2b-4af6-b695-cbe31f75efac", "value": 174954, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747421978, "uuid": "a6255f35-c379-4017-9a4a-296cbe9572c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747421978, "uuid": "0875a1d0-eadb-47a9-a1b4-81cb9756ba0d", "value": "ntpd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9d7f8c7-3250-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1747398381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747398381, "uuid": "e98a81b0-e915-4147-ab26-7a5f9f64b165", "comment": "Malware payload (Prometei)", "value": "95871a914c3be50d2ce21a91984a9c07", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747398381, "uuid": "cc22bd45-134c-476a-b2cc-ab5e13550f25", "comment": "Malware payload (Prometei)", "value": "8a7071b73fe2712abbfcfbca554f1ba27f464b58aece87c5a7b0cc71c5eff54b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747398381, "uuid": "45b47e53-d82a-4d0f-aa37-0db0477ccfef", "comment": "Malware payload (Prometei)", "value": "057eba89990ec3fe230302b5af1067b083f56627", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747398381, "uuid": "2add67ee-8621-4db4-a5fe-350da055b09b", "comment": "Malware payload (Prometei)", "value": "8f1ac31cb39ca1248a508a18699612654b7d8508c3c35ec899a4c65aeaf48107c03cee19fbea94ca9ac8b3ee4aec387b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747398381, "uuid": "dd47bcc4-55ea-4f53-b4d2-0426c25320d3", "value": "T1AE9423F8C83D2E3098169F3CBB5A826CF0A15772D9562F6AB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747398381, "uuid": "48098894-38f3-4cdd-8ad9-c1ef27a133cd", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgr:25WOSACZSV6eKRH5EPiamb4DsDwwcb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747398381, "uuid": "7327142e-a007-46b2-a5ee-148eed4c46be", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747398381, "uuid": "02cfde50-8d84-4f6b-b0e4-1928a90aad82", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747398381, "uuid": "99b64fde-8f89-4731-b2cb-eeceffe658ea", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5f6d624-324b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1747396147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747396147, "uuid": "4a488307-b8fc-4197-8146-17ce4a18c071", "comment": "Malware payload (Prometei)", "value": "07baa27c5d58d8f9f9b9819c0983fd84", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747396147, "uuid": "fca2599c-e446-442a-807b-0cf5d201c2a2", "comment": "Malware payload (Prometei)", "value": "8a8672b3260fc2126d564273417b0e6af983e117d7a31a676a800f52802c8fa3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747396147, "uuid": "effe06d6-1011-43ff-b82d-4df79d28cc1b", "comment": "Malware payload (Prometei)", "value": "0bdadde69da4c0e5a17c246fdd256f9ecfea53c9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747396147, "uuid": "193e297b-fa6a-4249-9380-af523594efa1", "comment": "Malware payload (Prometei)", "value": "26fb25a506eab25020e79630b176f88a81404283783a707fe7f7dba58ddd00fbda8746f1407d715626817c09d97952ca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747396147, "uuid": "0e028862-25db-4f2b-9886-c06c36b9d990", "value": "T1A89423F8C87D2E3098169B3CBB1A826CF0A15772D9562F6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747396147, "uuid": "c904bf32-6c21-46dc-a62e-fad3f73a0178", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitg8:25WOSACZSV6eKRH5EPiamb4DsDwwcM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747396147, "uuid": "2497ae53-45ab-4749-b8c7-1aefe3152fc0", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747396147, "uuid": "17e1af85-75bd-4998-9e96-f0167605cec0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747396147, "uuid": "f945c0b7-d2e7-4ba9-9e2d-efd10bedfde5", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6924a75-320e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1747369949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747369949, "uuid": "faa4fed1-d807-43a6-afc9-c227de1efeba", "comment": "Malware payload (Prometei)", "value": "0d7271f50a7796935ab345b87c9b706d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747369949, "uuid": "f99e6193-2aa8-44e3-8914-e4a9020ae0f8", "comment": "Malware payload (Prometei)", "value": "8ae3086a829031ee4cc6551f656ae383f1115f9ef505fe433fe7a5c847c5710f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747369949, "uuid": "b4cbff63-4140-4045-ba65-3d6d1469a0d7", "comment": "Malware payload (Prometei)", "value": "6b9fa88c4017d4f094d9a821568b8a5acef5f80f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747369949, "uuid": "1801e4d4-94c9-4fa8-b4c4-c89772baa788", "comment": "Malware payload (Prometei)", "value": "19a6c23d36008f18009972eb3e9ce8e1ac78fbdb3f0e56d7eb48328153abe72654bd12703c4bfa519f68e5750b9aead4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747369949, "uuid": "541108f7-5b4f-4768-a469-983a4983eddf", "value": "T1749423F8C83D2E3098169B3CBB5A826CF0A15772D9562B7EB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747369949, "uuid": "c4f9c6b8-edd9-4ec6-ad67-871ad8de1a7f", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitg1:25WOSACZSV6eKRH5EPiamb4DsDwwcF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747369949, "uuid": "e2b6ae5d-fefe-4fe0-8d0c-86e977d2d8ba", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747369949, "uuid": "69c21844-a12f-40b3-84f4-7f5da16afea4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747369949, "uuid": "b7851783-7777-4e56-ace8-0ee5cad853c4", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47e12c5e-3295-11f0-8bd0-42010a9c0005", "comment": "Malware payload (DCRat)", "timestamp": 1747427718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747427718, "uuid": "ab2e778e-afe5-4d27-a0a1-6d693b7d4732", "comment": "Malware payload (DCRat)", "value": "0c461478b1b7fd0226d03a9d173facc8", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747427718, "uuid": "3d827173-255e-4600-aae6-17d8da3a6f77", "comment": "Malware payload (DCRat)", "value": "8b6f5e8d604cefb319e3b76a745ecfb6e98e866b8dd190192a594488229b6a0f", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747427718, "uuid": "cdea99e9-f94c-4717-ae5d-80f10a611cca", "comment": "Malware payload (DCRat)", "value": "9540a9e3dfedfc5dfc09995c4af17940cba38b39", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747427718, "uuid": "11497a0a-acd1-4eae-b503-9b9de7944bb0", "comment": "Malware payload (DCRat)", "value": "5d38564f952d8c605b176299bcb18f7e56bfc1576675922a25a85fa0a07f85402384f8ab5153fce1e8fa9bc7b9c35824", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747427718, "uuid": "3dfac97e-9545-404a-a09f-7152b833b02a", "value": "T16306E14AA5A35E73C2A53F3184EB046E52B0DB667932FF1F761F94A16C072318B521F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747427718, "uuid": "52c21c83-88dd-4cbd-9aba-3b260825ff19", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747427718, "uuid": "03085718-dcac-4f21-8c60-1fa5cfc54923", "value": "98304:EohQ6rR18UqSlsdObh+L6jrMWS12uwXB:EoOG8Uxswy6PMWSsHx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747427718, "uuid": "d539626b-db85-42bf-a29a-ba71256b5266", "value": 3670528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747427718, "uuid": "5a0309b7-001d-4f15-89ba-9c41c9772405", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747427718, "uuid": "fd674b86-3ad3-4b93-94e7-1e7fc520bae6", "value": "0c461478b1b7fd0226d03a9d173facc8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b16dfb5-3258-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1747401551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747401551, "uuid": "e46996b5-a64f-4adb-a045-e665164d472c", "comment": "Malware payload (Prometei)", "value": "1f12ebd5d1980be16d751eced0bb35f8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747401551, "uuid": "2d8a7257-e8c3-4489-9811-418e1be0afee", "comment": "Malware payload (Prometei)", "value": "8baf9b332f5be0336f66d6b49d0702e7cfa59fc77147cb39f5a01fdd0f73fc3d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747401551, "uuid": "32614c4f-9bb7-4f6f-8856-037d2192bcd5", "comment": "Malware payload (Prometei)", "value": "8144b47d2314fbea8340d03d5a67a5d62293a57a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747401551, "uuid": "7eca3ade-ced8-4ad5-8ae3-26184545d88f", "comment": "Malware payload (Prometei)", "value": "55e041180d306516ad23fc1360901601b6a946372267e06d41bae2b7fbbc7ad1e412ac667f00392741df32a20e579f65", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747401551, "uuid": "98eadbc2-a814-45f1-8e18-f4d53b5ff33b", "value": "T1F59423F8C83D2E30D8169B3CBB5A826CF0A15772D9562F6EB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747401551, "uuid": "212238c2-60b6-4f4a-9911-53aeb8aeff3b", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgn:25WOSACZSV6eKRH5EPiamb4DsDwwc3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747401551, "uuid": "44f291ce-2760-48bc-ba30-38761555dbd6", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747401551, "uuid": "300b06e6-a136-4afb-ae60-2a3735d81d4b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747401551, "uuid": "9d54e047-747c-46c1-916c-b4ef3554e981", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fef4af85-3272-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1747412993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412993, "uuid": "bd62c4c3-385b-4386-bbb5-e9dc695dcf82", "comment": "Malware payload (Gafgyt)", "value": "f87bb1b77b61eb73efb6e6f6b69085ac", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412993, "uuid": "37c06f10-afbb-4836-b49e-71b870c3c5b9", "comment": "Malware payload (Gafgyt)", "value": "8bba5e64590d99831d4b6de979370287111c9da5068f93fb41bb632c9c4a4111", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412993, "uuid": "36ba8e48-9c43-456c-bb32-0c038ce8ce89", "comment": "Malware payload (Gafgyt)", "value": "223a688c3d0ed01dbc67d3f8b3d2b66984bbb184", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412993, "uuid": "1bc1e901-c456-43df-a9e9-21c7d415056f", "comment": "Malware payload (Gafgyt)", "value": "a5a5825b9f967d2834112e85e388d67c98e09789444291b6ffff72b9a81caabd390127048205f1981daeebe5ad7e1003", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747412993, "uuid": "5b8c7925-73aa-4e74-a0c8-20670d1d9119", "value": "T17A51F5FC41B0E262C5EADB5E7A65C0E6756CE0D3789D29DCA8AC4D35BC5AD00B44BF80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747412993, "uuid": "1938e7d9-480e-4635-8ee7-bed52a1e942d", "value": "48:lTiLTfLTLlTEhbIhDTnh3T8bCBETfchtNTrWJXdTXCsTiLTfLTLlTEhbTghDTnhc:FOZWWB0cPQaZWWB0cPMaZWWBgcPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747412993, "uuid": "59acc480-5848-4435-93c9-587c2e256448", "value": 2705, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747412993, "uuid": "ab618242-bf81-45c8-adb1-27f549101533", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747412993, "uuid": "6871a2b8-f56c-48be-b5b1-5c50571c7e50", "value": "gtop.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "069f0a37-325e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1747403986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403986, "uuid": "6c5caa66-1c62-41ca-9819-1e230cb23fec", "comment": "Malware payload (LummaStealer)", "value": "8c9e5bf2d91d6555bb836c6504bcbb0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403986, "uuid": "9fe224e9-9543-46b2-b43f-c319a8228680", "comment": "Malware payload (LummaStealer)", "value": "8bcd87aebddfd8d5810fb0831a71229bc80efa384989484141dc2808529885f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403986, "uuid": "523cd065-e66b-46d9-89af-7f66e93ccd73", "comment": "Malware payload (LummaStealer)", "value": "ddd7107e166df63a174c5469da76b1d86f6371aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403986, "uuid": "a854015b-ce68-4f50-8dda-e73a6a753911", "comment": "Malware payload (LummaStealer)", "value": "d3e0193c8ecfb2e5d7c9fa4b4159cb0462914405a3518e2097f6bef086872ab70d29fdbb05388a1f809188914d81642f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403986, "uuid": "95a307c4-2ce4-42f3-ae92-66a49ad118e7", "value": "T17495338CB882596ADD485BB3FA631E13FB7CD6D80E37652602DD143C3A0787FB50A54A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403986, "uuid": "904a1aac-a0d1-4a52-a003-67c7818a8f57", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403986, "uuid": "4bcd4ee9-56f5-408d-b535-07e4aa8d1779", "value": "49152:7NWz8Mr2IJbyZQxTaPcH3o8Hx0SBVbZ5e8I8gK9+s:7DopJZBP3H2Sfbq8I8J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747403986, "uuid": "ef327d52-440c-47b6-895f-080226b11edd", "value": 1931264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747403986, "uuid": "8824e08d-ab3e-451f-80d6-7a194eed29c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403986, "uuid": "425c4d17-2926-48f0-9a6f-114ec3174664", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a25c22d-322b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747382303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382303, "uuid": "77a759fc-5a9d-4908-b519-d376de7342f9", "comment": "Malware payload (Mirai)", "value": "3bbf498345440b9096c006ba50f299e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382303, "uuid": "672b0935-52b0-43d2-a3c3-1967de40d53c", "comment": "Malware payload (Mirai)", "value": "8be48a18b967b769d83041dd3d94e81e1568df417844609b680bcd253a6697c1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382303, "uuid": "96ab370c-7b1b-4f15-8036-e0bef0803ee6", "comment": "Malware payload (Mirai)", "value": "46dc18d666b95f35403b33c9d1e975697f5a699e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382303, "uuid": "b09b4491-6fcf-4508-927a-6aedba3b3b92", "comment": "Malware payload (Mirai)", "value": "0e15c8896e22a74913345c353ee7bc479d6c8a7abd601d63c9c6c0571137e16e45f0bf26963ffcac2fcc77d90608a301", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382303, "uuid": "03e2f55f-2252-4e2c-9823-38e4262afa2f", "value": "T1E5C2BFBEE0856985CEDD5C76908C0A669CE571D073B76738072AD88CB299A5BE04D0FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382303, "uuid": "3f99a5cd-e331-4018-9992-ec3a41e1ffc3", "value": "384:4XB5f+XS5+1U4M3YVBPnwc9Oj2GoImkWNn1Q3nS47uXxKMLAMloFRWGVCz0NvD:2v+/n/qofkWD2uXEMLyzWW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747382303, "uuid": "96c661d8-60eb-4cb2-85ed-b7378f2b055d", "value": 26368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747382303, "uuid": "beee4649-e336-4a1a-8dfc-3cd6ca1917df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382303, "uuid": "a061b6a8-b6ff-4fcc-8471-fcaeeae1c352", "value": "kwari.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0381b60b-326f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747411283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747411283, "uuid": "ef26f54c-6188-4de5-96a3-3454f8832429", "comment": "Malware payload (Mirai)", "value": "e532b868f07da32905df2e4f73709210", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747411283, "uuid": "635356cd-9f5c-4e24-87df-dce2ed50182f", "comment": "Malware payload (Mirai)", "value": "8c39d3b14548e40b01f9950f1a933fe3b1832d925463e82740cfc26e168a4832", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747411283, "uuid": "576dac74-2842-4045-af05-75ad37addeeb", "comment": "Malware payload (Mirai)", "value": "d75c6f0e85145f3aae8da965ddbb7455e43644da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747411283, "uuid": "dc041568-112f-4dfb-ae35-e1132a6d012a", "comment": "Malware payload (Mirai)", "value": "b984b5ba8d2c70eab52fa15da89cdd13874634e23bc0536d95de1dd7f7280e21a02f0e017145c116f0501485023467b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747411283, "uuid": "e1d7edd0-3f1a-4b1a-8bd4-ab37fb59b095", "value": "T14A83854E3E759F7EFBAC863987B39B10924933A616E1C584D15CEE020E7034A741FBA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747411283, "uuid": "e9001749-4b1f-4db2-935c-2574bc2fa992", "value": "1536:49V14JYRJ4AGk15EKPd0vpi8IQL606ddiqhgfJRP7T7D:c1hRJ4Axb0R7Ic6ddiqhgfv3P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747411283, "uuid": "e92b1ba4-c12c-482d-af97-14985223c833", "value": 87904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747411283, "uuid": "58bf9c51-7d14-4a23-b370-3dac95143c1d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747411283, "uuid": "29adfcb9-2914-4825-99ad-b5e85b695d0d", "value": "z3hir.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1269c2c4-322f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747383820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747383820, "uuid": "21227b05-9849-4162-8620-ce13acb5dc46", "comment": "Malware payload (Mirai)", "value": "ffcf5ca7acfcfb9eca42b04c4137157e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747383820, "uuid": "43571783-e691-4ae2-82be-cb5f9f08cf48", "comment": "Malware payload (Mirai)", "value": "8c9ecd4778b11cdde9b7443a24866bae6250e67c1e54f5b63defb7688fe4f135", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747383820, "uuid": "2b8b7258-f186-465e-9601-232fcf637653", "comment": "Malware payload (Mirai)", "value": "37de5e45452b12faa6234b697a97ef0e0dc6e08c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747383820, "uuid": "49e66f1b-6341-41d5-8cc0-8bbfccb83a59", "comment": "Malware payload (Mirai)", "value": "5af50a49d6b03e94f1f612563a2f705bd32bb8847f66c7dbaffe3a3f84f3bac871ef81c4df69ff03f333ed451d0b2ce2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747383820, "uuid": "4ebfb6b3-120e-4671-9800-5063d9f17650", "value": "T109530218E3E86B94F7FD503E04AD1B0F1054A65816AE8F15E6FD2B63CB94B012D782E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747383820, "uuid": "cb38a985-38f3-4882-a08d-445921b22dc6", "value": "1536:45BQOwCyzG1gGtBEZyUEnG9BZ2FSGiuQfNzCIoEwinouy8zyV:4D5azSEZdGuBZYSGRQFzJoKoutO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747383820, "uuid": "a86ae3c2-54cd-4b2f-b9a5-bb67cd5c6bdb", "value": 63920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747383820, "uuid": "be1c5364-0b53-4585-961d-fd90d0d7a412", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747383820, "uuid": "086054db-7d86-4aea-841e-9607190691f4", "value": "boatnet.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e961a9f-3299-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747429501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747429501, "uuid": "3cadffca-0c31-4ff1-b1ff-80b9fa364ebc", "comment": "Malware payload", "value": "2cd475395f4ee65c2c2337c112916997", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747429501, "uuid": "6cbf3898-8c58-4563-bf00-6553f70dce86", "comment": "Malware payload", "value": "8cec1e57c3128cac6a2f7138110d3b5fe5cad33cea9421f5111e9ad240524234", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747429501, "uuid": "996449d1-603b-48cb-9c7a-bdf4d6487b78", "comment": "Malware payload", "value": "b9e6957225dacff76c0f23c4e118fafc4b6ca046", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747429501, "uuid": "a5d6c44f-bed0-4f79-b512-83579971d857", "comment": "Malware payload", "value": "747efcf159c1073d0cace5473bf5c6d0a893648dd94a75ce4a01140311d3d05037abfb2f325fc4ad70f35adec3de7c0a", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747429501, "uuid": "23acdeaf-5fc2-4a32-b651-00e4d525ea1f", "value": "T14092F1028D353DFDA16F24A72EE3104451D2DE1A3F7A6463C12724B11D39AD87AE2EF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747429501, "uuid": "02f12c83-0676-4514-af48-42e5687239a9", "value": "384:Uc0fpTAsQig5DmV/DR3bC4gLQUuAwtCqv:eRTAsQicKV/DR47z2Cqv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747429501, "uuid": "cab2dd95-e765-4108-bd1c-e6a737784179", "value": 19480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747429501, "uuid": "3a5c89a9-9893-4d60-8ec7-9add3ab58cfd", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747429501, "uuid": "de7ced97-28e9-4d50-920a-60c21f016fac", "value": "txjyh.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a361c59-324e-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747397281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747397281, "uuid": "3e0a6a47-9771-4edc-b4e3-4906d4c30776", "comment": "Malware payload", "value": "44d2b9fcc37b9e79688a3e6b23dba09d", "object_relation": "md5", "Tag": [ { "name": "InvoiceXpress-zip", "colour": "#B98988", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747397281, "uuid": "89d32d91-41b2-4f96-a86a-1f3d07f7a4b6", "comment": "Malware payload", "value": "8d651f03afee9e3a6f0013bccc6c0cc4522027eae90b68a94122128d77747301", "object_relation": "sha256", "Tag": [ { "name": "InvoiceXpress-zip", "colour": "#B98988", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747397281, "uuid": "7618467e-1c59-4a52-8604-c82eedee4e4b", "comment": "Malware payload", "value": "aca1ed830a5bd0895e0f400e7c162996aa0597f5", "object_relation": "sha1", "Tag": [ { "name": "InvoiceXpress-zip", "colour": "#B98988", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747397281, "uuid": "fdbd99fe-6e87-409d-8e76-4eec68b8d331", "comment": "Malware payload", "value": "f06b9592e5b945fbb66027f31bd366ae42b2831c7b23dd525b712afba856e37d87821b25204aa43eb8db6e5ad17f41ec", "object_relation": "sha3-384", "Tag": [ { "name": "InvoiceXpress-zip", "colour": "#B98988", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747397281, "uuid": "c89f795f-477a-45aa-86b4-48c35069220d", "value": "T19A1833E9ECA50E4BE823C23BDE79979F839451C617019D37E604C7639AC6BD36A3240D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747397281, "uuid": "952a7b37-d5fe-4ce0-982d-3c7a2e320c57", "value": "1572864:d+pSwMZWKoUHXNjgDtLcLX7Bu/WqxqMXYEXh3X8n00F7waRlbXx:d+45HXmhQLX7BrqxoEXhY5Vl1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747397281, "uuid": "838935c0-2870-4df6-a92c-62c711e0ae76", "value": 92182198, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747397281, "uuid": "ca7215d2-2fc5-4ee6-b953-c6b492bc772a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747397281, "uuid": "249437ad-d585-4a55-bfa2-f94cd03ff66f", "value": "8d651f03afee9e3a6f0013bccc6c0cc4522027eae90b68a94122128d77747301.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c28866f3-3291-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747426206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747426206, "uuid": "ebd5906f-42b1-403d-84aa-78f02168f2e2", "comment": "Malware payload", "value": "7908cbea48604c9ec704cdc934bca263", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747426206, "uuid": "a19325ba-f389-4f1b-9872-f08e8f5b3978", "comment": "Malware payload", "value": "8d9e04b6dd9110ca01e9e48c2a895e0169e520951f93da7a688a75bf91e3ca7f", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747426206, "uuid": "335aeffb-6d19-4f4d-8a48-398c0d784de3", "comment": "Malware payload", "value": "ef862dc6418a03bb19b554ddcec5d09e15d47a0a", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747426206, "uuid": "1b4c2d43-7472-4b5a-aa95-10190f9d3efc", "comment": "Malware payload", "value": "601455d1423292acb720b69e081746e6ab185747809fbc9d54927d23695934922b737c53c2b3d6d439a99927ec2ae63f", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747426206, "uuid": "6bc80466-0603-4487-a5fa-64d9a0931a12", "value": "T1E5C2E113E749FB25DC8621B538A5009FCE91C1A7C5248E2DCD7B08B90CA4A629F7314E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747426206, "uuid": "9578cd13-302e-4f27-89e4-d7509163f547", "value": "384:2VVbCEh/70cpShMoU8bbL92+hVCT6QujZryo91nuXh2YnO8Csl0cRqX7ksSqz:4CER7pNX8nL9XhVCMJsh2YO00cRqX7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747426206, "uuid": "0a3df9d2-2fb9-4b4f-96c2-0554afea74a7", "value": 28146, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747426206, "uuid": "b60715e8-281b-4f84-8565-3aff26280f2c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747426206, "uuid": "d16142df-9a28-4c1c-ba23-aee99f24b834", "value": "DemonDos-main.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f16dd712-3272-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1747412970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412970, "uuid": "5f201a24-dbd9-4635-8ac7-98ec91cd7add", "comment": "Malware payload (Gafgyt)", "value": "a22714eaea4891bf46b661bb1a790ce2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412970, "uuid": "6ac640c6-26a8-4d08-b328-3f2fdbaf78da", "comment": "Malware payload (Gafgyt)", "value": "8e3747539ca959ccd25a106893a8213d04b5736d690e85a977826eb8711946b9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412970, "uuid": "3c388abc-3973-4739-a8e8-8e22dc0be89c", "comment": "Malware payload (Gafgyt)", "value": "e9357bba7cfa1e01bbdedb82762492d5ccfc5cfe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412970, "uuid": "1d9f2617-a5af-48f9-93cd-71581ab7d5e4", "comment": "Malware payload (Gafgyt)", "value": "b3ccf2ab7767395ed522e5de262b94c90a43dc9e218f8b50e0ac6db93ab1da6fd5ac60dd6b8f09376a4c538ffa7d5f20", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747412970, "uuid": "90ae39df-80a1-4058-b430-c8e428c8fe8e", "value": "T189041919B52AC5F7C9620FB102537DED0B6EBC355ABAED84F3187CB40AB14A57D1E208", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747412970, "uuid": "11a73ba2-ecc3-4598-bad2-093dd3011d04", "value": "3072:BhC2ejFA6fjn77YnHxWEbKRkdhQZD1pegmAeL4Z/yYSygPBsBsC:Byj7oxWEOqdC7mAeL4Z/yYSygPBsBsC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747412970, "uuid": "89eca07c-f8f0-4f46-920e-53cb62dea9ec", "value": 186296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747412970, "uuid": "3d200b1d-364b-44c3-8a6b-a74caf62c1bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747412970, "uuid": "384728c6-92ed-41f2-8407-52b549abff93", "value": "jackmyi686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bddc4b40-32ab-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747437365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747437365, "uuid": "07a3a15b-832d-48d6-ad4b-cb280eb2dab0", "comment": "Malware payload", "value": "740666a1cc8903a4430169f163e44e47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747437365, "uuid": "ad6dafb5-49e7-467a-ac1d-265c732c6e9a", "comment": "Malware payload", "value": "8f3370aaf5651d6bc98794269a81acaa9f6990847636cbc1085d50cc36673d7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747437365, "uuid": "01342971-079a-42fd-a57e-3b73f37f7fa2", "comment": "Malware payload", "value": "ea35df49846b7057f24e52c8f93ff8e9ea78d0dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747437365, "uuid": "2bffd7c8-e34f-4af2-a2df-21fdd6ddce18", "comment": "Malware payload", "value": "fb7a9f9e560c63201581d2b776aaa485f663c8c0fd4fcfb00071c0fb56bedea5c0ef21cd6dac518fb7508d3c71de7d5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747437365, "uuid": "30acd181-c2b1-4304-997d-e4070cdfb911", "value": "T18225F164C24664EBFDA741B54A82AA82F92378B08B281FBF51D4E3772F173C45D2D760", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747437365, "uuid": "2ff89f40-c50d-4900-b830-5c0f65677df9", "value": "cc56030055f1b3ec9cc1fa678dfddfd9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747437365, "uuid": "9f714144-6d7b-4113-8eec-3e34c58dcc52", "value": "24576:p88xQ/Sz/clrxu60HN4tOY9gu0HN4tOY9g9:p88xQ/SzWrk6DOY9guDOY9g9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747437365, "uuid": "2ad0bcc7-e709-4dc7-b74d-130b0d0aa9bd", "value": 1047040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747437365, "uuid": "99e2a74a-2eb5-4bf7-977f-18ba2fffe12c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747437365, "uuid": "3b945a27-1fe3-4d49-a605-eb8058e2b7e0", "value": "ZectorVector_crypted_LAB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa224bdf-320b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (ValleyRAT)", "timestamp": 1747368612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747368612, "uuid": "d72db446-8a18-4a53-8dc3-059da9aec8c2", "comment": "Malware payload (ValleyRAT)", "value": "8251e0a0f8dfa8409a88dd8f7db13edf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747368612, "uuid": "2cd04311-0fff-4818-bd15-f57dee951a13", "comment": "Malware payload (ValleyRAT)", "value": "8f584356a9d39e8029dabdc6690becc7fca180eba0ef3b6233a1e180c028ec12", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747368612, "uuid": "7e386a2a-0e3a-4836-a6c2-f55f0c23576b", "comment": "Malware payload (ValleyRAT)", "value": "200f4296e766b23d1f5a9c4a8ba80347ef0342c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747368612, "uuid": "15947192-4a3f-4b5a-a154-13f4bee15c83", "comment": "Malware payload (ValleyRAT)", "value": "59f5f9d80273ce80d7c2af7ea4523a8114cc315e0688bace1de5569ebdde2f72a7f7d41886c3afd60f61033dbe0035a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747368612, "uuid": "4b730ca5-6d5d-4168-9795-f10bb0284140", "value": "T1BEB37B2172E0C072C093253199F9EBB24A7EF93117B845CBB7E416BA5F603C16A7539B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747368612, "uuid": "2b2c3249-688e-4746-840b-2307479cfd1e", "value": "b8bf08fa843a9ec1ce10d80fbf550c26", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747368612, "uuid": "3ca57910-78e9-4dff-88c5-29e7c61cb136", "value": "3072:ObWjdInbcia0NFtwwnILn3py6D268XEPKk2:ObWj4bcCtwwnchx1y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747368612, "uuid": "656fd420-f45a-4483-84c2-b3d479f32454", "value": 111104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747368612, "uuid": "7c302985-0703-470f-b662-f1d39ebcca31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747368612, "uuid": "0b4c3a34-9f23-4f69-85d2-3f5f86b1783c", "value": "8251E0A0F8DFA8409A88DD8F7DB13EDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e4cfeda-3236-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747386819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386819, "uuid": "04bc47ed-b167-436f-ae7e-8f597a7bd288", "comment": "Malware payload (Mirai)", "value": "d240d0d2b6aba7829cd81cfa9bdf1bfe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386819, "uuid": "2d483beb-7603-4ac2-a57e-2150798f5fed", "comment": "Malware payload (Mirai)", "value": "8f719044a94f858858890c1376c0f41740401dbdabd374bbeeb3ed092004d912", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386819, "uuid": "23d01930-f444-4215-99a9-b1b46e00a091", "comment": "Malware payload (Mirai)", "value": "133e72f97dc79a0ff5f16372871bb48be88b26ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386819, "uuid": "02de47da-ca6d-4a58-80a5-6f9761cb634c", "comment": "Malware payload (Mirai)", "value": "d58f7afc4fa749b48532be0aac7dfc5e0998342d185abb7ba4e45d8e8dd12fdc171ce191696c55046e7093369ce815fc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386819, "uuid": "d2947c24-6a5b-43d5-a410-76c16319566c", "value": "T15233F1A445AA5E114DA4E9B2CE189E05AF275AFCF676919128FC0FF466F780D833E006", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386819, "uuid": "b61f973e-2259-42d8-9393-780f74ebd818", "value": "1536:EKoqJLmpQvwoygXR5yaN/niyL26rb2uyuc7+:EJqA4R5ZnBL26rNc7+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747386819, "uuid": "5a5bca09-37a8-4393-9946-e996255cd00a", "value": 51272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747386819, "uuid": "0d7d1bf8-71f4-4498-8a7c-d3c864de52cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386819, "uuid": "b900c84a-a62d-4796-a381-ac6b30be844d", "value": "Mozi.Arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27d7da93-3236-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747386862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386862, "uuid": "4e54ad57-2909-4ef1-ae57-e2a6eeb10cc0", "comment": "Malware payload (Mirai)", "value": "9f58854c84f3c1bb2741c319f0365031", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386862, "uuid": "1cff5d8a-ea79-4deb-bf54-b1e0c94001a9", "comment": "Malware payload (Mirai)", "value": "8fa79eae7543cc132ab7c1029a952b09dda6620d7f15f4f7421af0cfbd6b2f21", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386862, "uuid": "20a1edae-72e8-436d-b2d1-9c4cb213e5dc", "comment": "Malware payload (Mirai)", "value": "74f5e3652524eec0d0fe1db9f8060e71380cf9ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386862, "uuid": "eeb63dd9-7305-4b9c-8525-7c5c25707f15", "comment": "Malware payload (Mirai)", "value": "fc36f70b7a44f0cb884572fa5ae8db6751b0bbbbd24be6cbee877861e0ba51b1078299de4351ec09cd46c5259319fc88", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386862, "uuid": "8104d8d4-e687-4355-894d-e9bbc9fcc750", "value": "T1BB030985F8824A6BC2D0133DB76E591E3720A3D4E2CF770BEE694B5137DA60B5CA6D40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386862, "uuid": "97edcfda-94ae-4d92-a0b9-c418dc83a55c", "value": "768:m/Tth+gl2F3GeCLdhseydqTcBKpRoJp9IQgKG:MlmGRD5uBKp09IQy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747386862, "uuid": "4833ef23-ca13-42ac-a459-ad3eb5bd933e", "value": 38256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747386862, "uuid": "4dadbdcb-54a1-4793-bd15-b12550d4fa52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386862, "uuid": "525e41dd-99d3-418a-881f-c7ae5a792cee", "value": "neon.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e450b2b2-325c-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747403499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403499, "uuid": "36e7b504-0cba-4639-be58-906e892703de", "comment": "Malware payload", "value": "41043edcc5372c79a57cd5fd9f2d778d", "object_relation": "md5", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "midie", "colour": "#292A97", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "shellcodeloader", "colour": "#9FAE81", "exportable": true, "hide_tag": false }, { "name": "Themida", "colour": "#A0DA3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403499, "uuid": "638dea7d-99b9-4c8d-bd1d-be38181c5a5a", "comment": "Malware payload", "value": "906210f988324bbea7518dbd056718c3a654ee8c0d19027424a0db1fcea33872", "object_relation": "sha256", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "midie", "colour": "#292A97", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "shellcodeloader", "colour": "#9FAE81", "exportable": true, "hide_tag": false }, { "name": "Themida", "colour": "#A0DA3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403499, "uuid": "1bbdf457-a154-404d-b131-904948f2c2d9", "comment": "Malware payload", "value": "0851f17170370ad464cd406c4adf4b61262ab38f", "object_relation": "sha1", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "midie", "colour": "#292A97", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "shellcodeloader", "colour": "#9FAE81", "exportable": true, "hide_tag": false }, { "name": "Themida", "colour": "#A0DA3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403499, "uuid": "d757c1d5-b876-4e7b-9f0b-64590808a9b4", "comment": "Malware payload", "value": "6e3a76277802901e57a3638c5017a27a861478acfecc76ff4f75c7efa98c6a6ca5fa237ae6fa7e2bd80666b91bfdf299", "object_relation": "sha3-384", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "midie", "colour": "#292A97", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "shellcodeloader", "colour": "#9FAE81", "exportable": true, "hide_tag": false }, { "name": "Themida", "colour": "#A0DA3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403499, "uuid": "92025e52-885b-4b42-bfbe-a43d5fb3b3c5", "value": "T17A8602527AE80179E2E7CB39C6C3619EB0A17047A7169ACF09D414410F21FD6AF5BB3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403499, "uuid": "011f0b6a-8786-40dd-aca2-454f00e81d76", "value": "9ec7581dea90df981b33a5809693cf6d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403499, "uuid": "bed14c91-7175-400e-a609-c2e1dcd1b1e2", "value": "98304:WJx1aADjtH+7ajt62ufSJIi64ueLCdcRDnWO7wOpYX0Eg7PgXL4PPjjJNvnhoKR9:Wj1acjtHS3lSgGntdzYX0HPggjJjJR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747403499, "uuid": "635df1ad-ed41-48e9-8187-72bfa3ed2ce2", "value": 7940096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747403499, "uuid": "25a449c4-f5a2-4489-be40-559270bcf197", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403499, "uuid": "01584d39-0b96-4bf5-8f25-1d7df9b3ebd1", "value": "wezDBrmpI.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f3155c1-3227-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747380432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747380432, "uuid": "e1b9d6af-50ae-4eff-983d-53c6606a0de9", "comment": "Malware payload (Mirai)", "value": "8ffa235774b735ddb44efbabfcf5aa6d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747380432, "uuid": "09706503-7bce-44a5-9326-b5b2ebfa3887", "comment": "Malware payload (Mirai)", "value": "90c5b4a34c11efbd99ef89251e85278a6fa179a7dbfae9468e974ed03137c45b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747380432, "uuid": "12952fd5-9c94-493b-bc96-a7a0080fa2c8", "comment": "Malware payload (Mirai)", "value": "1ca440be50b2493a80ca2e5c1079deec90fd5c28", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747380432, "uuid": "6d52cd6b-9ff4-4b6f-8b1e-bb35015ba8c9", "comment": "Malware payload (Mirai)", "value": "0e50a6f1e2933d95c8ed7eb3864b35301352bc8a2d5cd790e5d602ecd87d8f7c76a10bba8c152c9000d113efae3d8eef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747380432, "uuid": "c7e8cbc2-71b9-433b-ab14-9ab61ca48407", "value": "T1D4B3ADAFF2470661C85247F047CB8F9E3E6322806F5798E32D1D2A7A19751DB5E06F82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747380432, "uuid": "d0b3c018-2f64-4ffe-bbf7-c79b3f5e93eb", "value": "1536:S0PjnbaZSP2isK6OnZFXTblZn9QGyxx4P1gY/LWj:S0PjbaZSP2XK6OnHXTbj9QGr1gYq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747380432, "uuid": "c5b6e822-0253-4660-a882-ea46cfae3287", "value": 107836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747380432, "uuid": "84885be2-bb84-44ee-987e-694d653ac598", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747380432, "uuid": "b59d5aec-d436-48d3-b627-0aac2e59337b", "value": "neon.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4c3ebe4-324c-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747396628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747396628, "uuid": "99f694f7-5872-47dc-b75d-9ffb1a85e409", "comment": "Malware payload", "value": "441545a4a259af172a4999b08ecdeff8", "object_relation": "md5", "Tag": [ { "name": "1po56mdxc-localto-net", "colour": "#E5C76C", "exportable": true, "hide_tag": false }, { "name": "AgidCert", "colour": "#56D604", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747396628, "uuid": "413f3c8f-3d57-440e-ae74-f7c57ecc94c1", "comment": "Malware payload", "value": "90c7c86dd906597243800ce74c7cc08157c71e1094743242bc59f074c809ba00", "object_relation": "sha256", "Tag": [ { "name": "1po56mdxc-localto-net", "colour": "#E5C76C", "exportable": true, "hide_tag": false }, { "name": "AgidCert", "colour": "#56D604", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747396628, "uuid": "745bb006-f053-42b9-8aba-e734c06fd890", "comment": "Malware payload", "value": "7ef54c99612ab34e4ef40dab6dc048a5221104f6", "object_relation": "sha1", "Tag": [ { "name": "1po56mdxc-localto-net", "colour": "#E5C76C", "exportable": true, "hide_tag": false }, { "name": "AgidCert", "colour": "#56D604", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747396628, "uuid": "924c7339-7faf-42d0-add2-9a98f932630b", "comment": "Malware payload", "value": "33752d322ec0d06a70a4c47e9e7fd885c3ac0a05aabbda8c8cedae3ef95fd29946c25f87bde71c6af538704567886b0b", "object_relation": "sha3-384", "Tag": [ { "name": "1po56mdxc-localto-net", "colour": "#E5C76C", "exportable": true, "hide_tag": false }, { "name": "AgidCert", "colour": "#56D604", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747396628, "uuid": "bfbc3fcc-67d2-4436-ba7f-833b61fb8f4b", "value": "T1B8460237ADEAC468DEA7C4B35BC28249602F6564EC0B947F0BD85D898F24C470752FE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747396628, "uuid": "fba85a3e-34ef-4221-beba-cef27f15352a", "value": "98304:vX31CdASrl++OzcrH221Kg8Gbqv+LlvXhaJ/BblTlcloRxPcKjAv9lDl:vn1CyKyzdKqv+xw/RsSRxUR9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747396628, "uuid": "80b38cf4-a4f6-4382-8ae8-c230d3342528", "value": 5588671, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747396628, "uuid": "c8f2b201-9e98-4706-86d0-468a5cfbb783", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747396628, "uuid": "102d4692-6dfb-43c9-835c-130c06f72041", "value": "InvoiceXpress (5).jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8ebe745-3223-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747378999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747378999, "uuid": "9e505379-b65d-4edc-9f60-48bffa405465", "comment": "Malware payload (Mirai)", "value": "74648d704dd45a268fa0a7ecc295a4a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747378999, "uuid": "b255c553-578a-460d-bc70-bffedee5eb9e", "comment": "Malware payload (Mirai)", "value": "911cb15d6736f2d743782cb54f1e37520eaf90a04647412ea15a3925d721247f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747378999, "uuid": "1fb855b4-2ce7-46fc-bcf7-3c2da61d4fae", "comment": "Malware payload (Mirai)", "value": "a1239a0eef9c186d04d817b181dd016163eec12d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747378999, "uuid": "d0209ce4-c38c-4c51-95ae-d525742c53fb", "comment": "Malware payload (Mirai)", "value": "98ce84ddf7258c9a72196b1b9fa5859cac002594d7a25f814088ce7f190ca04313605ee496a78752217b353e233cd454", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747378999, "uuid": "363fe265-f7da-4d2b-b93e-aa8e6c34f64c", "value": "T1DD93C749BB511EFBD86FCC3706AD1B0228CC699722A53B367674C528B24F64F19E3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747378999, "uuid": "eeaee3bf-331e-4b55-81f3-9fe486497c87", "value": "1536:s5LFIxI9iDHqzGdyvxmc26C3fZxiK3b18ZtOIGGdG:svIxoi8vAcfC3fZKiGdG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747378999, "uuid": "61837a01-4a1f-415d-93dd-31042e1574b2", "value": 88868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747378999, "uuid": "57cf8c56-c44d-436b-8141-5ed5d7fc2c0b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747378999, "uuid": "7a76d447-3a9b-459e-8a2b-ba3cc49a4935", "value": "neon.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b155c620-327a-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747416299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747416299, "uuid": "b6645168-3950-47f7-9862-f6eb6094df3b", "comment": "Malware payload", "value": "c4a9e64fc7b9053fabe1af3586cf81c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747416299, "uuid": "838d8960-ce64-457a-b709-929003663723", "comment": "Malware payload", "value": "918fea79c5f1a56290f2d1e3918f8db4c29bd622d0cbdc6961dce7badb4c3fa4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747416299, "uuid": "f38792cf-29d5-43c5-9d9d-d801d1256613", "comment": "Malware payload", "value": "694d5cbef81eaf4460161068bfcc6303f9176f9d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747416299, "uuid": "564916bc-c882-4eda-8e07-e503dfcab0e0", "comment": "Malware payload", "value": "9dea9379e3426a28b25932fbe04ef228ca4c23f4cddfe44777b4efd142b26fea1826b1ea712c5dd6b28a00a30fb57494", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747416299, "uuid": "deac1914-0c95-4b65-8d7f-a784b83ec611", "value": "T1B936DE1CEBEEA69ACF6F0070496DADB5202D7F141B290EE3D5B239186DF59F43560AC0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747416299, "uuid": "d0935a41-f04f-4913-aa3f-c25740008285", "value": "f67c2d48a0d9fae633478c7ae08a5655", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747416299, "uuid": "9d3e3bf8-7696-49e5-acf6-715df5ab8564", "value": "98304:POjvrclYjyuX4EwNNRWgQ/3kX2r3bhrvnqE8r3bhrvnqw7XgYz:CEhuX4EwNmB/35jbBn+jbBn1Tz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747416299, "uuid": "178d09d9-5de9-45b5-af93-2c0563d45374", "value": 5060413, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747416299, "uuid": "cb75e4e0-0cbd-45cf-983f-31b47c6dc54b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747416299, "uuid": "02be3dc9-157b-4342-94d0-5a79c26dfa19", "value": "Weegee Virus.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93220721-3256-11f0-8bd0-42010a9c0005", "comment": "Malware payload (MassLogger)", "timestamp": 1747400786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747400786, "uuid": "466f51b4-1950-49f5-893d-417238c7d3b8", "comment": "Malware payload (MassLogger)", "value": "12bfa564820807f554c272067d5bf2fd", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747400786, "uuid": "e56df882-9b01-4568-b78f-0e888baffbc5", "comment": "Malware payload (MassLogger)", "value": "91a053b787648295c22f78dd44aeac1c48dd8a2e7dfb051edc10aeb1a089cfe3", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747400786, "uuid": "1aa6fbed-f537-4185-a4c6-a7e635eb3758", "comment": "Malware payload (MassLogger)", "value": "256ff2ae800c2c76c5d30f16f0387f269d8cb8f1", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747400786, "uuid": "ffd8e09d-839c-432b-8206-c0f249a4e9e8", "comment": "Malware payload (MassLogger)", "value": "ed7a169bfdf93e66f945e2fd39b1b1a5933af4794a575081e82b0717be5f8a65d12c71bab1313fa5af525f7a141de9cb", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747400786, "uuid": "e967dcd9-dfaa-4b60-a49b-f51f96392777", "value": "T169152A5D9070ADD26014FEB0F951AF97CCDA139517278B421FD1A1A92326883FFAB3B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747400786, "uuid": "df73563a-97bf-4cc0-a736-8e8bf5957dc3", "value": "24576:vK4xPjHoKsrSwhPrjZWcCRLDhKkZQcv9vSHzx1Op:T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747400786, "uuid": "e3e0e24c-2d92-4c40-9c42-a7f2ae43214a", "value": 891316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747400786, "uuid": "49541055-7a1d-4a4c-a3de-380a4e5e15e9", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747400786, "uuid": "b8730dba-8e17-4274-9630-af66bfa774b5", "value": "rrc90876.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0787dfcd-325b-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747402699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747402699, "uuid": "77b0fc56-e08a-4431-a260-99eca6bb0ad6", "comment": "Malware payload", "value": "66fc08f13bfe230309771a85ab092c66", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "shokito", "colour": "#A9E8CB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747402699, "uuid": "c83abb54-0f7f-4da3-9844-6898782e6d70", "comment": "Malware payload", "value": "91d58e4bbd687b1cba419a2e54b00d385f2461faf53dd31a369da369450579db", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "shokito", "colour": "#A9E8CB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747402699, "uuid": "20ff0ac3-65e0-4429-b472-4ba11d3936e6", "comment": "Malware payload", "value": "8b06d570f338dd4cebc31223b79a72d987f28e61", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "shokito", "colour": "#A9E8CB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747402699, "uuid": "496eb5e5-e4f7-4dbe-8ba0-a70942ec15d5", "comment": "Malware payload", "value": "7be4c3d832a59505ab868f691768739cf8454946bf9d6563313492689e99255c7d718ec213d4146ed43449276a4553a2", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "shokito", "colour": "#A9E8CB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747402699, "uuid": "597f5ede-5ffa-4366-83dd-74c39b4a116f", "value": "T127D62342F369D81FEC37413208AA0B3681468D96CB81E7CB9568774CBCB7AE40F55BD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747402699, "uuid": "dd0c5a74-f966-44f7-8259-b75dc7d95db5", "value": "393216:iYwsrjOsjto38UpS/ExRmcspnG9oax1dOnMGQvIBap/11AMa2o:iYwYOsjw8UEIRbauZ/QnM5wBap/XpS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747402699, "uuid": "cf02e96d-6414-421d-ba88-4bc5b0f6d9bb", "value": 13682721, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747402699, "uuid": "faadc658-c9eb-4930-936b-35c65900f019", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747402699, "uuid": "5e1e2f09-4e99-43a9-a5a2-094a73d4c253", "value": "91d58e4bbd687b1cba419a2e54b00d385f2461faf53dd31a369da369450579db.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f535189-32a3-11f0-8bd0-42010a9c0005", "comment": "Malware payload (BlankGrabber)", "timestamp": 1747433797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747433797, "uuid": "be6228d9-9316-4a5b-bec8-3619a4b9dc63", "comment": "Malware payload (BlankGrabber)", "value": "87c3187c4694b40d24f92ef1393db1dd", "object_relation": "md5", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vgszf", "colour": "#2A4731", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747433797, "uuid": "5fda0333-9bf6-41a3-9340-3b9dfa71f2d0", "comment": "Malware payload (BlankGrabber)", "value": "92157f11be0dd49d07b0ef671b5a61b168f167cb0105af08520fa0ea246541ab", "object_relation": "sha256", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vgszf", "colour": "#2A4731", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747433797, "uuid": "bb0168aa-80be-40f7-84ec-cb59ca87805b", "comment": "Malware payload (BlankGrabber)", "value": "25b96ad443fe3d45b1d7295736f1dfe9e07f57af", "object_relation": "sha1", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vgszf", "colour": "#2A4731", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747433797, "uuid": "7155af44-ebc4-4b5c-95bb-4f8b192d1c80", "comment": "Malware payload (BlankGrabber)", "value": "26dfd295471a431e68b3146899ac84b378e7d87531507029ec27ad55bef26085698a3ff60389342165188529bd30f0c4", "object_relation": "sha3-384", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vgszf", "colour": "#2A4731", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747433797, "uuid": "66221800-fac6-4e52-a316-636de6b00cd1", "value": "T18396334666C044FAF837783DD5828A1BCB77BE215B60EAD743B047654EB36F0487A326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747433797, "uuid": "450803f7-b67e-4958-9dc2-918aa3b1675c", "value": "72c4e339b7af8ab1ed2eb3821c98713a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747433797, "uuid": "992075d6-f6e7-4537-9d56-6f7f482a587f", "value": "196608:BnDHeNkd4ZwfI9jUCBB7m+mKOY7rXrZui2ooDmhfvsbnTNW4:5SaWmIHL7HmBYXrtjoaUNf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747433797, "uuid": "59f4d522-9c44-43ff-9a86-3c384a7a3f12", "value": 8801466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747433797, "uuid": "a7926994-05d1-4085-815c-b799114ddd43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747433797, "uuid": "968d3e5c-574e-4e1e-aabe-35e15980c6fe", "value": "dasdas.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eead73a3-325e-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747404376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747404376, "uuid": "a9924c7e-5c3b-4dac-9d31-f72cc205ec2d", "comment": "Malware payload", "value": "ca5ca0bf0d0cd9da31daa7190d0175e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747404376, "uuid": "6d82e177-7ce4-4e9e-b42a-006882847df1", "comment": "Malware payload", "value": "926ba1f8efd8bba4ff2ab9d1aa0b0e6d112c66ddbe58feb2b4756c57e7433ed3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747404376, "uuid": "68f85f3b-ce08-47a0-9fd4-bfc143f41862", "comment": "Malware payload", "value": "ca0e51a1622044adbc8dd94dc2e6de663789b9fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747404376, "uuid": "f7f553eb-7f90-406f-b1e1-f9e34bb87108", "comment": "Malware payload", "value": "c54d8710d5e5f27acd24c40f9fefca724d8fcb371e1d3b69d406c557b75af97848e6a3d229add9e0d083bcd4854e4384", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747404376, "uuid": "a8ac8797-2f2f-45dd-9a6d-62dd196a37b9", "value": "T1E9A52342F6C648B1E17228326B7867216A7CBD305F758EDF67D03A1DE9605C0EB20B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747404376, "uuid": "b85564fa-85b4-4c78-afbd-c4456c9e059d", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747404376, "uuid": "6aa6f95b-7989-4992-8347-9703e0436703", "value": "49152:IBJWTpc8iYMljoCIrtufFEUPtPSfdjh/SXjl8:yITFMlFIQDP4fdj4m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747404376, "uuid": "32658ba0-7f30-4048-bb04-8989c2137056", "value": 2230224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747404376, "uuid": "82b4e151-632d-4be5-92f7-79852deca06c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747404376, "uuid": "1801d0d3-8ef8-4670-85af-17a2fd3ff382", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a09cbe6-3224-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747379296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747379296, "uuid": "33a621dc-3f60-47fc-ad18-626bcb023451", "comment": "Malware payload (Mirai)", "value": "0b75e717adee7b1cc13c2925c3367f4f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747379296, "uuid": "f359e445-649b-4808-81ea-2cdf4607c418", "comment": "Malware payload (Mirai)", "value": "92c04651342f63bd67d6847e60b2819138679065a6e5f996a266ed0ac8473a26", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747379296, "uuid": "29f523ba-c233-4bdc-9a56-8aa0dacb5bb7", "comment": "Malware payload (Mirai)", "value": "99809266a14ceeab47426062f0e8ceb36f2a336b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747379296, "uuid": "a1b486f4-6fae-43a3-88ba-8c444a139a9e", "comment": "Malware payload (Mirai)", "value": "80c2820e513ea1dd48b259f3473cf19f9e03e9c3a47176392cd56a89e9bcf6f97f7c90f86057ce7b95db702c9c6cf84f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747379296, "uuid": "62fca5c1-7402-4282-9d89-69866ef1e3aa", "value": "T12B93B60E7E329FBDFAA9823087B79E116B5923D123D2D685E19CD6001E7034D681FFA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747379296, "uuid": "200e6286-5f04-4be8-9707-f955f57ae483", "value": "1536:sGgz60b5FWB8sVeX/djZajjXIXYe0LdMhhRkv:sGg1b5Fa5ePdjZajTIXIehRkv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747379296, "uuid": "304a6427-7a99-422e-b9b4-e7f793df537a", "value": 88868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747379296, "uuid": "a3f12fd8-4c8a-4d13-8d3e-10af8e48cf9e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747379296, "uuid": "014e352d-f0cb-4e2a-b39c-6e7669c5b7f2", "value": "neon.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3c4f9e8-322b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1747382399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382399, "uuid": "ecb89ffd-2f47-4017-9be8-e74ddb85bb78", "comment": "Malware payload (Prometei)", "value": "8ad78d20a85a67179cb1706a9950ebad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382399, "uuid": "42198728-3772-4486-a2a4-703f66ed7ce2", "comment": "Malware payload (Prometei)", "value": "92de0af25b0091423e6628f5f3b23e49625eea868d904c18b02a6cb742bc420b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382399, "uuid": "101872f0-ee1c-413b-b885-5b45026a5208", "comment": "Malware payload (Prometei)", "value": "3d0f54c3705fccdae2a8a425f819cb6ddbf428b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382399, "uuid": "7991a33c-7e10-4947-8db0-134b9a72163d", "comment": "Malware payload (Prometei)", "value": "3871c172a3232adbc484876a9c32cd0f0b9427c8fb6d03835116a0ee7262f6df27f7a2abf3e23bb1a89c71e8d54c2071", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382399, "uuid": "41a4e457-ebdc-4b8f-bee7-f50d9fd4c238", "value": "T1E09423F8C87D2E30D8169B3CBB1A826CF0E15772D9562B6EB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382399, "uuid": "6440c171-a00c-4614-95eb-3b5d48adc3a1", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgA:25WOSACZSV6eKRH5EPiamb4DsDwwcw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747382399, "uuid": "f34dac50-97a2-4854-8061-6c93dc568f47", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747382399, "uuid": "1aef9d20-fd00-4df7-aff2-fd1b3b263fcc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382399, "uuid": "cfc83af0-176d-4f95-acc5-833208aa806e", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5d421c4-3200-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1747363934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747363934, "uuid": "0c27643d-86f4-434d-a94a-ca0148e9ff42", "comment": "Malware payload (Prometei)", "value": "a541dd363d4fc37fcc6c60321517bf88", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747363934, "uuid": "e30b4fba-c839-4a8a-bc01-dff7018ab48c", "comment": "Malware payload (Prometei)", "value": "9317ec4f7fe06366c3fa92c7bf3079c7947255ccd3a56966c343f9363586165a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747363934, "uuid": "e935a525-6a71-4adf-9f89-2fcbfca6d8d1", "comment": "Malware payload (Prometei)", "value": "265532d60cacbcede85915874610514aff97f749", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747363934, "uuid": "11cc8e95-e1e7-4299-af08-8e114f06c109", "comment": "Malware payload (Prometei)", "value": "a920f0202cad23817159074b6f556ac7e94474e0ad79d6d1e14d61c113dbedb1bed19f9a10e981e897f1d35f5981d0b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747363934, "uuid": "58a18ecb-d5a3-4ba7-a68f-92e7cb4dada0", "value": "T13C9423F8C87D2E3098169B3CBB1A826CF0A15772D9562F6EB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747363934, "uuid": "fec6eccb-6388-4a58-9a92-93ec24b5418d", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitg/:25WOSACZSV6eKRH5EPiamb4DsDwwcP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747363934, "uuid": "0ab50cd9-9d42-4764-944e-4dfd71193675", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747363934, "uuid": "4ef487bc-f18e-4e4f-b760-dd8f319febf8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747363934, "uuid": "b0f63082-a946-4d1f-bd17-214b88eb7481", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75558ca4-3241-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AmosStealer)", "timestamp": 1747391717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747391717, "uuid": "7a1a9070-53d6-47bd-b03a-1e20494ac26c", "comment": "Malware payload (AmosStealer)", "value": "0431630fd140727745cc62693dacdc26", "object_relation": "md5", "Tag": [ { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "security-check-u8a6--com", "colour": "#68A0E7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747391717, "uuid": "0f9d35cc-5840-466a-8c1b-557b0ee7f3d8", "comment": "Malware payload (AmosStealer)", "value": "93184600e65e7943764e2501afecd5da1405d89d6585b62a902a53e49ee4289e", "object_relation": "sha256", "Tag": [ { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "security-check-u8a6--com", "colour": "#68A0E7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747391717, "uuid": "808096ec-fe32-490c-a8ea-3d6cb900ff1e", "comment": "Malware payload (AmosStealer)", "value": "1744666fef8cd4f6e0a89ba17b3a095ea07663fc", "object_relation": "sha1", "Tag": [ { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "security-check-u8a6--com", "colour": "#68A0E7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747391717, "uuid": "0f9ebdf9-320e-4966-b089-fcb9f6fb1d60", "comment": "Malware payload (AmosStealer)", "value": "aad01a201f76ff061a98e3c240b35be33408b271da04184b85ed7c8abddbb4c2f55c82f54ee58b453dfbd79188838a15", "object_relation": "sha3-384", "Tag": [ { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "security-check-u8a6--com", "colour": "#68A0E7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747391717, "uuid": "c2494611-2aea-409d-97b7-eb483d8cade7", "value": "T16AF4019CF1C83F07DDAB01BB1109169960ECEE512390C76BFD5147BBBA643AD1C276A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747391717, "uuid": "777365ea-90bc-4f06-b92a-2194b4687bc7", "value": "6144:KyuNRkuaT7A6M1/UbFTcWnq8YFUY/IN2sySadNtsDIEurgIaBxEKJYmh7YJ4DZn0:KvIT7S+2WniUHpFCbtMp8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747391717, "uuid": "ade3b527-7eb4-4e47-8184-9bbce4de52a3", "value": 748816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747391717, "uuid": "b79213ef-2a9d-4c8c-aa9d-6edbdb9e85fb", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747391717, "uuid": "7e4e0e92-11cc-4bcf-9b8c-a3311c7b4cf7", "value": "93184600e65e7943764e2501afecd5da1405d89d6585b62a902a53e49ee4289e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f6d7dd8-326c-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1747410256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747410256, "uuid": "50ed3c30-6638-4f5b-9245-9305ceee3242", "comment": "Malware payload (Prometei)", "value": "7b5486448f1bbdf0355e9da619c936fd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747410256, "uuid": "016bb812-ce66-4c83-9a95-d9f57948dbd3", "comment": "Malware payload (Prometei)", "value": "9388a028e388a4b53e3515ddf1a6af304eca3bd7316c09a05e36d4880a09331e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747410256, "uuid": "c0fbd101-7189-4bf3-8744-0de2688fe22c", "comment": "Malware payload (Prometei)", "value": "db36aa274c0fee316a89dbc44db693c89380da30", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747410256, "uuid": "c29c583d-3936-4e05-8318-e5df39097e78", "comment": "Malware payload (Prometei)", "value": "b97e1f559038efd0fc70ec6ab30ae3cdc57b06a77dc913e640dfe9eacd9ec20f2a63ad8c275307ec5a8204e3dcc4ddc4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747410256, "uuid": "d70d9f47-1ded-4d87-8ce2-7dfcd0c1c337", "value": "T1C39423F8C83D2E3098169B3CBB5A826CF0E15772D9562F6AB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747410256, "uuid": "d9bcf861-3f54-4766-872a-9e75048e8b71", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgS:25WOSACZSV6eKRH5EPiamb4DsDwwcC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747410256, "uuid": "50e74321-8c99-48a5-b6c2-18b2e64fc3b8", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747410256, "uuid": "a2d994aa-485f-42f8-ab73-76ff36234285", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747410256, "uuid": "63046abd-df53-4bbc-bf6a-e75547cc786e", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc999de9-326e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747411164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747411164, "uuid": "b48bd8d6-aec9-43ea-a010-9b72417d0e15", "comment": "Malware payload (Mirai)", "value": "17e31268e68403476e4d63f1e131b263", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747411164, "uuid": "f75a575d-b8cb-49ef-ab9d-90e4cf11cea8", "comment": "Malware payload (Mirai)", "value": "938f7754e061d9038b2a5f8887b03a4a55986c8b7be4f48cefeff25504cfc6eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747411164, "uuid": "31fb5ebd-99ef-4a4e-bcaf-19ba817027cc", "comment": "Malware payload (Mirai)", "value": "c981c058c37091e1273b7bf47cce91ca72922f1c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747411164, "uuid": "1f34f354-558c-4ede-b221-e3f3fe7b9c72", "comment": "Malware payload (Mirai)", "value": "b3b2ad1f214134ab761c92265b6a2f61b5b40d53055102ad9d7f3383f4b2bdbe0a7707aa1bfa345fa0f358347563707a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747411164, "uuid": "1cdc2328-6ff4-41ce-9869-fc23195697ec", "value": "T10BC2D035270F6435D2E04078C990C29961AE5798E2DFF22739440F2CB66690E72FDF8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747411164, "uuid": "e14eb3c4-50d2-42d5-8ff5-c09d840974e1", "value": "384:qda751FK5G+8qsM9poBAYYKN3gB6OzKRHMAyEZjvX4qw2HAxHM0YzHhymdGUop5S:qc75KMu5z6sOj4qAB2s3UoznS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747411164, "uuid": "8978c3af-fc4f-49d9-acf9-ef9bb6081ae1", "value": 26296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747411164, "uuid": "104aa624-e904-48e4-8dbf-c919ff832fd7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747411164, "uuid": "3c8ec346-5010-4208-902d-0fa7651d740e", "value": "z3hir.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edb5412b-320b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1747368726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747368726, "uuid": "4da95a1e-077a-40e6-8cee-9449ae471798", "comment": "Malware payload (Gafgyt)", "value": "0f0eb85e1f7f34c992de558f3fe029d0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747368726, "uuid": "ad998eda-a5ef-4d56-9572-957548f30688", "comment": "Malware payload (Gafgyt)", "value": "93de908589c62d030aa56a41d1d66a301c9574562d60e7359a520fb88fda5701", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747368726, "uuid": "4f15b500-f009-4457-bdff-4ea7c104f6b8", "comment": "Malware payload (Gafgyt)", "value": "76922d0943fed4d58fdfdac6edf8440f34694051", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747368726, "uuid": "9d134696-3326-4b92-8adc-431af95adbe9", "comment": "Malware payload (Gafgyt)", "value": "a25b55ae65fd1ab36d1c8ebd80d522126794fdd555e38cd3d9483199b3034afbb0316a9faa5b31d37ea551b809da7372", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747368726, "uuid": "db81ae0b-a1e7-4927-919c-9888b4e06806", "value": "T14773D60ABF650FB7DC6BCD3706A9070535CC551A22E43B3A3934D92CB65B54B4AE3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747368726, "uuid": "d7d4807e-e053-4c03-9ffc-1c42362578d8", "value": "1536:UyEGawglZarjNftLsNtyZ0w2TZB2+c9UPuhgZ89P9SRt:UfGawglCjN1qk0R2+c9UkgrH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747368726, "uuid": "4ad324a6-5b2f-4ce6-927c-30ded2ba7aa2", "value": 76604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747368726, "uuid": "e214088d-6db6-4622-974b-ef37ec8f0c79", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747368726, "uuid": "bfa352f7-18cf-4002-8213-2dcdb2c46017", "value": "gmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbebc268-3275-11f0-8bd0-42010a9c0005", "comment": "Malware payload (QuasarRAT)", "timestamp": 1747414223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747414223, "uuid": "4c01f2ca-537f-4c32-bac2-b9548cbbfc3a", "comment": "Malware payload (QuasarRAT)", "value": "e8afe371b2d9c56b771befb5efc0e854", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747414223, "uuid": "03385e98-aa95-4581-a632-19875b1ab41a", "comment": "Malware payload (QuasarRAT)", "value": "943699ed8f49842c31c0d7de09dce2b105e65b8931babc996d0beb67dd53aaeb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747414223, "uuid": "7b26c478-3344-4690-ac5c-8a5336b5a6bf", "comment": "Malware payload (QuasarRAT)", "value": "254cd717c711a3c43692a53ab27a0f6123eaca6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747414223, "uuid": "ad3eebd0-dd81-436c-b987-1e150753b67b", "comment": "Malware payload (QuasarRAT)", "value": "f79757a715156900c55869f5bd8780c7b532b74ea4de25026861659e2019989d9a065c743b08f6a2dfe4c1b5da3deadd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747414223, "uuid": "8c7075d3-2ba8-4a6b-8f52-1b98d64eebb4", "value": "T12CE54A0477F85E62E56AD3B3D5F0542363F0FC2AF3A3EB0B5191667A1C93B4098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747414223, "uuid": "cd963b7b-8d4f-4057-8daf-cdcc39f79905", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747414223, "uuid": "ccd1d5d9-2921-418b-9c8b-ddc9920d6606", "value": "49152:3vyI22SsaNYfdPBldt698dBcjHq+momzTcoGd6tTHHB72eh2NT:3vf22SsaNYfdPBldt6+dBcjHq+myK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747414223, "uuid": "23f34b8c-1ad6-4cab-b56b-6ae59c88d060", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747414223, "uuid": "698d99a8-21d8-4ac2-9dca-6d6ad0684577", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747414223, "uuid": "2172863c-af2b-4acb-93a7-6dd7ac47ff68", "value": "943699ed8f49842c31c0d7de09dce2b105e65b8931bab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc235a12-327c-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747417176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747417176, "uuid": "c58487a6-52e2-4e6e-94f6-1618ca105446", "comment": "Malware payload", "value": "e6741ba187508c69161739fd620af856", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747417176, "uuid": "a6ab4424-4d74-43c1-91db-3e1bc12d3a17", "comment": "Malware payload", "value": "94b286721b20b160729d272eea944ddd854f6aff6ed791bd54a3420522886750", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747417176, "uuid": "9ab88233-30a8-415b-990a-eb05997fbf8a", "comment": "Malware payload", "value": "fe060f5bca8396b2eac342c497f369267440b220", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747417176, "uuid": "ffc24b3c-d43f-4bb9-a234-1208f6f905b8", "comment": "Malware payload", "value": "ccc2b356b4b8891995ca8695da60854fa8fb4d16c55b26c8f74a4b40e5644b816fe3f6bd241c81c537d2e41680e4a1a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747417176, "uuid": "30ef8fdb-9464-4c0b-a6a5-3c4dab3c3581", "value": "T153D27D3AD07EE5E8C8514B38DC2654B01F93B14482767DBA9FC44676148B9B8FB283DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747417176, "uuid": "20864d2c-5a19-4f3b-81d6-560511f51aa0", "value": "768:0aNGQdKEVyU+ne2CWeQyiwt1yy22d1pOZhTZJV:0aIB1nkW5wt1l4ZhTZJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747417176, "uuid": "a1c4ac1a-1621-4c11-aef3-4e9ae0efcc7d", "value": 30145, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747417176, "uuid": "d875c6ed-e207-4c21-8d0f-ecb49f12f974", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747417176, "uuid": "bcbdc45d-a8c5-4521-a6cd-ba8b59d3a2be", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86d672a5-326a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747409355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747409355, "uuid": "314c7e71-cb34-4d6e-88c6-f560e2e3b2cc", "comment": "Malware payload (Mirai)", "value": "3667842e7641367b2403d0815af64afd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747409355, "uuid": "7365b244-18c1-47bf-a2c2-74a853792289", "comment": "Malware payload (Mirai)", "value": "95560d4e5681996f22efa618770aa4e4b822c55726b88154dbadf2013ee871ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747409355, "uuid": "9bba80b5-a576-4334-bc0c-433d2fd403e0", "comment": "Malware payload (Mirai)", "value": "3044519aecf0fdf130b60c568cb49cd7352e9932", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747409355, "uuid": "b6f0a891-9817-46ae-b2dc-9e6437255ca1", "comment": "Malware payload (Mirai)", "value": "3c0102bc46b5704a84d84af860814140180e35538c9efdb77928ef2156ebdc2bb3e41e124efe89213a1a7d5ab1ded511", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747409355, "uuid": "482fa099-dc0e-49e1-ad37-0f211a5b43fd", "value": "T1F3434B0232680E17D5A21EF5353F27F083EEED9121E4F689254FC796463AE33458AE9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747409355, "uuid": "d39dc2e1-4e7a-4294-a013-e357a498b557", "value": "768:vETst2s/uhZo7Fgbb1vJdQ/uQ4GNLK5302vyeLr6QjMXjhu6keoSnuNRvVx:2hrb1TY2LB2foSnEdx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747409355, "uuid": "9ac8d852-9aec-43cb-b881-1e08ea38954a", "value": 55604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747409355, "uuid": "0340da00-8bcd-413a-8cc0-127225b11606", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747409355, "uuid": "b90ee79d-5b78-4d0c-ab15-a3e7a7580d73", "value": "kwari.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "853446bf-322b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747382294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382294, "uuid": "fda11869-96a4-41ab-af9d-66690783a38d", "comment": "Malware payload (Mirai)", "value": "d005c8a6d4317cb75dc8caf56cb7037c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382294, "uuid": "e258b9ad-334e-4755-922b-dfb6bf55b7e7", "comment": "Malware payload (Mirai)", "value": "957aaa2fb4de7e675184fffe73e4a6aeedbf0c3f58f2e2093acf28c5a3ab97ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382294, "uuid": "b10b9e25-a101-45fa-b1d9-663a193e466e", "comment": "Malware payload (Mirai)", "value": "2b1650aa2790b7da90fa641fd729ac4e8629b071", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382294, "uuid": "52e80f80-0ae1-4192-9024-ea3e310024fd", "comment": "Malware payload (Mirai)", "value": "57db324ec834f203b1dbc7e9876393143966467c061a707227e3106294c840acff6c88524c8ca58d0ba5d2a3b1df4fd6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382294, "uuid": "ca73a833-8fe3-4ed8-85ec-da18ac807026", "value": "T166B2E1327258BCB1DFF10436E92C57C56BCB053880AA74252AE35A68B14BD4B6EFC5D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382294, "uuid": "d253057a-c99b-4af3-bea6-d84b3b8b390a", "value": "384:jIVp8aUiUY/dR2cq3lY6VZ3snQvGV6wdcucc0kBzLNrlhymdGUop5hi:kVp8aUyly3lMQvGQwdQcdBzLZls3Uoz0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747382294, "uuid": "e8ef826b-66de-4d9f-9e89-0c38ab7809db", "value": 25048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747382294, "uuid": "f76d8cd2-d790-4b7e-9962-d124074d83ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382294, "uuid": "4fcce9af-9dde-4135-888c-57f18a5b1145", "value": "phantom.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eaecb09-3257-11f0-8bd0-42010a9c0005", "comment": "Malware payload (XWorm)", "timestamp": 1747401020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747401020, "uuid": "f00df5c0-7e4f-4ac0-ad51-4407b2466240", "comment": "Malware payload (XWorm)", "value": "16c23b969201d73e1d09f363c0892c77", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747401020, "uuid": "51abbee2-47b0-452c-951e-fa80523fed18", "comment": "Malware payload (XWorm)", "value": "95a8f71b9a4b9ed48d1832528f1f13d39d35cbbc42f4469a43ff5c9e726722f0", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747401020, "uuid": "36315a79-3410-4cf3-8675-477aa2c7ad92", "comment": "Malware payload (XWorm)", "value": "81cb744f2c55733de223a41d93499a88f40a4451", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747401020, "uuid": "6d31a1ce-b8ae-45fe-b002-697d2fca7e88", "comment": "Malware payload (XWorm)", "value": "337da06a33b9794dfccc04a916218707105024eaf89be586d668f2951bf92addb7836235e71f490223d9b2dffa68ecc3", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747401020, "uuid": "d743a027-e5a4-49ee-9cf6-c5e186877e1f", "value": "T1DB4189E533B3B8C379D890CCD6AD1066E55E96E549F0D034E882A85B1227F51F0F9B87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747401020, "uuid": "983bdd68-ea50-4077-8e60-a0a94478f36e", "value": "48:RAkzWPKu7hrmlPseyyOgXXOBbyl7QllXCXVFiygfM8qXnWwmGQFOYm8ix7wFPWND:RAkzkk98+BVgzAY+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747401020, "uuid": "0d96d52e-2266-44cb-b4f9-253cfe8ce154", "value": 2422, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747401020, "uuid": "e2e3d236-8227-4459-bdd7-63bab33a810e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747401020, "uuid": "2f85ed68-1a6f-4893-8f42-f4688b528fed", "value": "000-05-734277.VBS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bbf730d-3232-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AgentTesla)", "timestamp": 1747385258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747385258, "uuid": "9f3f1253-8283-4c8a-ae6d-c2b8f8a251df", "comment": "Malware payload (AgentTesla)", "value": "269fd4ef4229c68e13108acb44705343", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747385258, "uuid": "b9a335f1-49f9-42a5-96ae-64739607790c", "comment": "Malware payload (AgentTesla)", "value": "95aa8b4c73efa71946b6e56867a1de15914df56b43ffff7197cad8efd8432111", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747385258, "uuid": "505d1b89-ccaf-4bb1-87cb-c6369031bf11", "comment": "Malware payload (AgentTesla)", "value": "8d756218fd32280a98a167de80b2937945a3311f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747385258, "uuid": "a2d9a8db-ea5a-457e-ba8b-79a224da1d11", "comment": "Malware payload (AgentTesla)", "value": "672676c048d9293872be46a249a8e47aca238f848c05a335245310b1f7e57485f889a8d25832bb26afacbda3709df862", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747385258, "uuid": "1cd87347-1487-4c4c-bcaf-56bd2c795ec8", "value": "T19E45260026A8CF11E67F17B1C8A2D5F48B6B6D4ADC29C3CB5DD1BCDB39B2B415A50A13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747385258, "uuid": "48966700-1ed2-482a-8cfb-52abd5c080b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747385258, "uuid": "f5c2ef22-9f8f-409f-9be7-3c0910f8eb46", "value": "12288:00QFxURyoJMUq1BUB+XjD9H+eEyQqAbVMQlbL7aGNUm5zdNwxzbv79F8B:0zUj61B8+X9ebb6IbCGim5ZNwmB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747385258, "uuid": "e1f71a69-604d-4668-8d4a-fbb01f21bd3d", "value": 1251840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747385258, "uuid": "c7ed44c2-df96-441c-b359-9dc731df0a87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747385258, "uuid": "88d0e9b7-0f7f-4c0c-8da1-19b9faa25d65", "value": "Request for Quotation-05152025.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17ad98da-322f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747383829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747383829, "uuid": "25f02ad7-af3a-4d89-b649-f062215a9e92", "comment": "Malware payload (Mirai)", "value": "3a175a37630281d3cacd896f1d66649b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747383829, "uuid": "f4295c8b-0143-43c9-992d-0b11684c8922", "comment": "Malware payload (Mirai)", "value": "95b0b51968fc615c61ea3cd41c37dbd4c0c03aa8b00da8382a377330be70186f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747383829, "uuid": "fdff0dc9-9b9c-44b1-bcf6-f1836f53ea9f", "comment": "Malware payload (Mirai)", "value": "bd1b37f14ca308efd6ba8c5cc71ec2bd1230e807", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747383829, "uuid": "6d383ee3-0f81-4b3b-86ee-f51706c7e4e5", "comment": "Malware payload (Mirai)", "value": "20adb6bf35d6951da7cf6d08004c4ee74dfe242e516348e04b129b982a747b1eb0f76900ef98115b715000bac8248265", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747383829, "uuid": "e0f2484b-90af-4772-8ab9-495cdc8f4954", "value": "T19A733B4331280A47D5920AB4253F57E083FFF99034E4BA89685FEB5A8639E771186FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747383829, "uuid": "8f77168c-911a-4c96-a216-0453d0975933", "value": "1536:pfXN0w/CjRj110UWFXNKAiqFrRoGjKbpIHzU:IZSFXpsGEpIw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747383829, "uuid": "5f145c8d-1f45-468e-bcb0-6522f236d64e", "value": 77072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747383829, "uuid": "d5c190c6-87be-4268-9219-07d3cf2baf7a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747383829, "uuid": "e647601c-4478-4bee-9a92-43e785fc6960", "value": "UnHAnaAW.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e6dc0fb-322b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747382283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382283, "uuid": "0d0761ef-06df-4ffa-92ed-ea1ad8405ed7", "comment": "Malware payload (Mirai)", "value": "17b16d91b489a9e9de3c0f29d472158e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382283, "uuid": "c969e92d-a9e1-4ff4-aca0-bab456970c57", "comment": "Malware payload (Mirai)", "value": "95c785a63676d4c420ca887087090716f848622c7bbec2cba6ddbd28f23fb056", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382283, "uuid": "13e8cbbb-b6b5-4b13-a004-870895666431", "comment": "Malware payload (Mirai)", "value": "2ff767e289485d0e648b4b9e0c9e1b14f8c323be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382283, "uuid": "c33ed9bf-f9dd-4c2e-8538-ee04bc1fceea", "comment": "Malware payload (Mirai)", "value": "fff35d4b795c85554dcdfbe8c958e0a2536e174ed4711479c5c105a45db62656cf4b2f571c8e7d0f646476362334dec2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382283, "uuid": "69d94ca2-1f70-4a7f-ac86-b4fd12a824b7", "value": "T130434AC4F143E9F5E84301741026EF37AF72F2EA115CDD93D3A9EA226C92A12E446D8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382283, "uuid": "ac7fedc6-c213-49b0-adb9-68ba490fdba1", "value": "768:FmnthEsW5qnF15RY1dhPe7oXTmcdDj5gk9vWnTI4eBH+4sToQLDKFv:Yn/EsW5qhSh6amClWnU4GH+dNLY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747382283, "uuid": "dff8b86a-8775-44f5-95b5-ea31e5411a65", "value": 55348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747382283, "uuid": "66b35900-d85b-4acc-92c6-71494c030433", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382283, "uuid": "c29c86b6-1947-4228-add7-fd9ea75a0d32", "value": "RpcSecurity.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dab4cac9-322b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747382438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382438, "uuid": "6ed365f9-ba81-43ac-bf20-4024996697aa", "comment": "Malware payload (Mirai)", "value": "9916b4c8b09e9d96bbdc165ac1bdd31c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382438, "uuid": "f4fe88e9-d27a-4167-9898-0c00749deb1e", "comment": "Malware payload (Mirai)", "value": "966911b91a309a23fb236549e0bc72d4f899c37c9ca52a4f1fdc568d5c48a13f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382438, "uuid": "872fac4e-8bc0-4b42-97ed-a4c18c3d1c89", "comment": "Malware payload (Mirai)", "value": "7628756e6bb045476a2b4b755436cc625ec7b92a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382438, "uuid": "77ecaff9-3acd-4fa1-b54e-02fe0d38f71a", "comment": "Malware payload (Mirai)", "value": "83486f829e4fcf09e1a25dcdcba439ea45c8b37508c1274919093c27d1c7ec4689cd96b2cae5b6e6150e018f12aebed2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382438, "uuid": "88f74280-611b-4714-a928-c99893275be9", "value": "T1B66395193E229FBDF7AC823947B78A219258339A26F1D5C4D15CEE001E7034E745FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382438, "uuid": "4fb5b4a7-f711-4aa1-8d7b-84f7d159e6f5", "value": "1536:ayQXb4ub4tOOMv3MYyopu0vnPvwE9eLPJ2zKl8GEy1:ay4b5b+eBhpu0/P4ECYzKl8hy1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747382438, "uuid": "f26aab3a-4610-4599-95e4-e910b6655611", "value": 71676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747382438, "uuid": "783c0b3d-4ab1-46c9-abe8-08c10f3d1b08", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382438, "uuid": "033759d5-f84d-4386-b157-bb73df0f3202", "value": "phantom.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fcc7e04-3292-11f0-8bd0-42010a9c0005", "comment": "Malware payload (PythonStealer)", "timestamp": 1747426416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747426416, "uuid": "152c8db0-641b-4021-90c9-17ba037f4f89", "comment": "Malware payload (PythonStealer)", "value": "b22b4d0ae47d3c1b7056d117ba2f7223", "object_relation": "md5", "Tag": [ { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747426416, "uuid": "37b95aa4-a879-4b4a-aaec-408533fcbf92", "comment": "Malware payload (PythonStealer)", "value": "96bed336ecee555b1754aedba18728caed70b08adcabcec27476bfb4236246e8", "object_relation": "sha256", "Tag": [ { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747426416, "uuid": "7f50a497-8c07-490d-bb36-091dbd655781", "comment": "Malware payload (PythonStealer)", "value": "cd1d7c8dd9a5656cfa66da68dfb14848925ba463", "object_relation": "sha1", "Tag": [ { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747426416, "uuid": "db66d97d-9832-450c-9a4e-3058c66e922f", "comment": "Malware payload (PythonStealer)", "value": "698db88337b29f2b182f90cdcff97ccdf96f0fd8f211dadbd1c53d710237014b7439f48a362576fb327b087071c9191a", "object_relation": "sha3-384", "Tag": [ { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747426416, "uuid": "7c7f4c15-119a-464b-bcea-8c3b6b27c97f", "value": "T17067333A04C493F8E0A5DB058935C5B48FB995BACF9E8BBB63365FF4AE69C01047E045", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747426416, "uuid": "f97a57f1-4693-41ad-87c4-1470c93ebe4d", "value": "786432:Lt349REt2yFLvvTeGDnTN5YMpzNdb9kYa2At09vCzIx9irLPld:S9RUvqWnPYM/db9FLw09vf9irxd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747426416, "uuid": "b47b7414-41ae-42ee-93b5-cea2825cc179", "value": 32507924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747426416, "uuid": "6f5b52b5-a888-4b72-8edc-3af777d5f879", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747426416, "uuid": "8d5abba5-ec2f-40bc-833a-e9c860a4f7d3", "value": "BOFAMET_v2.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e9b305c-3252-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747398926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747398926, "uuid": "763b2a73-8051-48a8-9ec4-5090ff390a0f", "comment": "Malware payload", "value": "18f786e5a1aab0cdc0145686d48b784d", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747398926, "uuid": "5e0da7e1-c250-4bde-a3a5-df5b23b8ada7", "comment": "Malware payload", "value": "96d823196711e174f08194254366f46aff20b58615cf1aa044125d69952ad174", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747398926, "uuid": "6d1cfb5a-b5d7-4b7b-b79d-cea277f6256e", "comment": "Malware payload", "value": "5440b1b0702fae3508c6329f8a7d115405d58ba3", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747398926, "uuid": "de37a0c4-9521-41dc-8543-013f99e86ece", "comment": "Malware payload", "value": "977de1dd84e57c55ae6b355b3db68fffe6b4bd6bfcd3955f6aabce5a1e91b14cca0f8cf668deced4d02c6dc32e8e10fc", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747398926, "uuid": "abc6f28b-4c1f-4398-b4d8-5238cbaf5df2", "value": "T1F06633D01586C248E0F7D8BD9BDFD9C8BE7CA23D828F48995A9CF4A34116DF208D9935", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747398926, "uuid": "189a4d7c-6e60-41e5-8d36-102200b8649d", "value": "196608:FrFZU9CNlY6UDzXoqChRkm0V1olaAUDZT1g4e:VrUANlY9zXoqC30V1oQA4Jg4e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747398926, "uuid": "7791ac7e-2502-48b0-bc6b-383756383a5d", "value": 6653831, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747398926, "uuid": "3f7713f4-506f-4c67-bd31-1a4036f370b7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747398926, "uuid": "f918785e-aaee-4c61-9abd-1a1fcdff6956", "value": "Shrek-Tools.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96e8714e-32a4-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1747434293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747434293, "uuid": "edbbcd84-f5c8-4537-841b-a7f24a19e35c", "comment": "Malware payload (Prometei)", "value": "4bee039d2d670a5c2f141f12011e7266", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747434293, "uuid": "ace9de07-3d45-48d3-ab51-a31c9152cdbb", "comment": "Malware payload (Prometei)", "value": "96de7d05b24eb5661cd906b13c47f85acc9f23ac9954ffeb4871f55d467dca40", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747434293, "uuid": "44315e76-1166-4dbe-8878-7f3bab5f886e", "comment": "Malware payload (Prometei)", "value": "3448c937261d0751363f5d55d7a29a9876363d2d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747434293, "uuid": "372bfdc8-af2f-4a6f-acfe-68f92885c920", "comment": "Malware payload (Prometei)", "value": "651a36d2723769992dc9d7572fc123f55790820532b4059658874ab983d1d2ee264360f2b5fa3c6c6da6d5d432edbbd0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747434293, "uuid": "ed0fc4e5-28e9-4da3-8ddc-5ff288d8a988", "value": "T1439423F8C83D2E3098169B3CBB5A826CF0E15772D9562B6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747434293, "uuid": "427e5a14-5011-4baf-aac5-a3b2728b3f02", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgY:25WOSACZSV6eKRH5EPiamb4DsDwwcI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747434293, "uuid": "42036911-48f5-4b4e-8fbc-22362bdb97aa", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747434293, "uuid": "8a94a292-90ef-453e-9c5e-970f4f8433f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747434293, "uuid": "0f1b65bb-9839-42bc-8df8-9d2d1e641312", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf9cca33-326e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747411195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747411195, "uuid": "2f1fe386-02c5-4e22-be66-c18d44529552", "comment": "Malware payload (Mirai)", "value": "f540c8904ebaf6d4fa95cd6865d8d05b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747411195, "uuid": "ffa2ec4a-d3c1-4b5d-ab40-a0b0d533b633", "comment": "Malware payload (Mirai)", "value": "96e7d0e2f44d8cf1df7cd8820a548972bca2c1610528f5bbc5de08adf822a539", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747411195, "uuid": "01d027b8-1368-482c-b59f-8f8657e6aaac", "comment": "Malware payload (Mirai)", "value": "c5f82cbeec8efc205d37009064342e439b4855c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747411195, "uuid": "cbb75e3f-369c-45d9-9109-c9a8091de945", "comment": "Malware payload (Mirai)", "value": "43666324fe551282137415eebd35096bafd153baafa3e5f9962f0fcd18aaf13fb3256d7d42603e5983d058041e6578d6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747411195, "uuid": "6146a521-5ca2-4654-8b0c-1551c2cd15d0", "value": "T1CD632981B880AA26C7C01777FA5F118E3315A7DCE1EA73438C156FA576CAC1F0D6B64A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747411195, "uuid": "0ddc3156-832d-4188-8598-84372a9352bd", "value": "768:2IcI9rYg37dZobc4PrzXsOalwkbj3ybaXvoOBVUNOKo1w5kHuLwCVy/Jx+5H8hGI:YiJ3LokOaCKXtB1uBeZWlRQCUKU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747411195, "uuid": "951fd5c3-64e7-4757-8e76-a3af1300e188", "value": 70468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747411195, "uuid": "a0040c8f-0a99-4fbb-9126-586495b5066c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747411195, "uuid": "bbd48a33-3f11-4cb4-bbc1-f31f50a3dcd5", "value": "z3hir.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "394460ab-3220-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747377442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747377442, "uuid": "7d43cf40-c7eb-406b-b0e2-13d5b7b59dc3", "comment": "Malware payload (Mirai)", "value": "12fdbdc9dca589c16e57767e2f6c14e5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747377442, "uuid": "1ddef57a-fcd0-4648-b40d-d5821dc6b1b3", "comment": "Malware payload (Mirai)", "value": "97076b195f28deb770039b23c1d09dfb261aaa37770ae52d29ecc64827653331", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747377442, "uuid": "03d1e155-9ad6-4d58-9419-f11379524df6", "comment": "Malware payload (Mirai)", "value": "eae39057452165a373dfa7415e9eaa1186e0bc51", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747377442, "uuid": "f089d4ba-cc22-4375-a1b2-3e201f64c2fc", "comment": "Malware payload (Mirai)", "value": "4baad16d9a1fe18a7aa9583a965159ce915ade26923bf716cfc7544eb4609e160d1407492f626da8bb201c947482eb03", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747377442, "uuid": "4ef87f8f-9ad8-41e6-aebf-b144039eb303", "value": "T1CD511DCA79589F339D75FD1177E6E84472C4E0C220E4AF72E0C9B9B2809ED347865B51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747377442, "uuid": "461724c9-d159-4949-b82e-0ccd2f1a0201", "value": "48:vJ7A7x7KqJbolJgzgwTLJLYtJFy1J7F7y7xLJfefHxJQBHJBORLJklHJJzwhJH0F:vJ7A7x7KqJbolJgzgwTLJLYtJFy1J7FG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747377442, "uuid": "0f7b5f51-7a8a-4e6b-b966-ec324764e945", "value": 3010, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747377442, "uuid": "bcd3a20f-3fed-471d-b195-5c5a7f85b66e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747377442, "uuid": "7e2f1601-6360-422e-816a-bf11726294d6", "value": "dvr.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beeaffdb-328a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AgentTesla)", "timestamp": 1747423193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747423193, "uuid": "fbf4c969-a01e-4112-a70d-e435ad23a116", "comment": "Malware payload (AgentTesla)", "value": "7fe370d918789aebf907ca84ffd62011", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747423193, "uuid": "ef1c0238-bf3c-48bf-9485-272c63768557", "comment": "Malware payload (AgentTesla)", "value": "972f04ff875c1118a869fa79ec5d91613f0963b872a00c61cb1847de6079dcd0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747423193, "uuid": "4807db89-c4c6-4818-970d-3ac3103fd8f9", "comment": "Malware payload (AgentTesla)", "value": "5205f1631d106cb16da78db13af0aa108a237570", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747423193, "uuid": "6a18e98d-f7f7-4e2b-9689-01ef3eb0f4ff", "comment": "Malware payload (AgentTesla)", "value": "e3d436ffd22d371a7b7c26acfb50d3d09009684f34c284c91b595bb8962b07fc94421c529e0d777db3066fcf132f8aaf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747423193, "uuid": "eff8a43d-6d6c-4e28-a944-25f7fadb4219", "value": "T19F1344E6C7ABBC96CD53BB2EF5396714015D052EC9B9C880FA10740A94E5319E4E4ECF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747423193, "uuid": "caed7d22-3f80-4070-b7dc-0e25047ef53c", "value": "96:/E6gWgG6XK06gWgZ9XKcqkUxq95HF/lS6gWgZ6gWghPR6WXKsN6gWgJ:/E6z6j6CO/qXl/4666WPR6WVN6S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747423193, "uuid": "91c5ce2a-408c-4245-a147-52b888f3a9fe", "value": 45407, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747423193, "uuid": "cba16cba-b1bf-49c9-a8fb-f383ac590fa4", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747423193, "uuid": "0603c560-1c53-40d8-b6d2-f36c6305100c", "value": "ienetwork.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0376def5-327f-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747418154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747418154, "uuid": "babe2168-b207-45d6-b225-7a7626bb2069", "comment": "Malware payload", "value": "912bc7876f0202411c022f350d909514", "object_relation": "md5", "Tag": [ { "name": "Adware", "colour": "#00D21E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PUP", "colour": "#82B746", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747418154, "uuid": "c7a1246a-0c09-43a4-93f0-d29bfd66b40b", "comment": "Malware payload", "value": "97fa0096d18e4dcf3cf9b98d4f8e77390f7bb59234efbc5ed551d83abb94d018", "object_relation": "sha256", "Tag": [ { "name": "Adware", "colour": "#00D21E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PUP", "colour": "#82B746", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747418154, "uuid": "50addc89-48a5-4713-8111-7f905fde4380", "comment": "Malware payload", "value": "45e8a797913d62fdbf440278c95ebcf6a7b3459b", "object_relation": "sha1", "Tag": [ { "name": "Adware", "colour": "#00D21E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PUP", "colour": "#82B746", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747418154, "uuid": "0cf1186b-cfd9-4fee-99ec-d7d0f91a10c2", "comment": "Malware payload", "value": "e6ce6c8384e0213a66eee566806f308c025e42285a6b3b67623b139b014351a90cf9ab68909d732c041a55c42b535804", "object_relation": "sha3-384", "Tag": [ { "name": "Adware", "colour": "#00D21E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PUP", "colour": "#82B746", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747418154, "uuid": "29fe1964-e528-4dbf-a06a-01fe75986eb5", "value": "T16DE4D51137B99A61C3712A39AB77D3752967FD985A2041EB33903B2A9930DB37B34307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747418154, "uuid": "fee56aad-3b38-4f9f-96af-a0177e18e92a", "value": "6d08f9915fabebbe43de4db4341aeec4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747418154, "uuid": "8d80fb98-2d9e-40ca-97f0-a185bf97018f", "value": "12288:lutPDgi2JLQzuMO2xl00cUbtLKtOxUwqxLo9cFP2cz27RK:wr2J86Jkl5c0e0Uwqxc9cFP5ziQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747418154, "uuid": "be56c415-33a2-4275-8145-5a3ab3e968dd", "value": 659224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747418154, "uuid": "cc49be0c-abb8-43da-ba0e-5c2c85aa95eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747418154, "uuid": "0e30bf99-1e50-4a20-beba-3bc84188db6f", "value": "MaxAVPlusDM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1af8739c-3238-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747387700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747387700, "uuid": "a0612b55-eac6-4e09-aafa-e1d641d99262", "comment": "Malware payload", "value": "2657737476fc8e38d4138da0528667d1", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747387700, "uuid": "1ebd3269-5e9d-4257-a845-a5aeedbaab9b", "comment": "Malware payload", "value": "984a710cbf817c16a0cb17b58074a58dc522423bf905d8604b0731b3620a2b6e", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747387700, "uuid": "e2127ff6-c15a-453b-b518-fc954ce98b2d", "comment": "Malware payload", "value": "3692e088264b7dc4f3bbfcff43a32627cfc3a000", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747387700, "uuid": "1cd36feb-71ed-46e4-bc96-6ebc609dc7c7", "comment": "Malware payload", "value": "26a8d64e6616ae606d1b3f611b182a32000ccfc279ea68f9d997112024cec6ae7ad193e0ca9fafa8f18cd10500577eb6", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747387700, "uuid": "61e2d4a8-cd3b-4064-b141-f6a6095d1054", "value": "T199D3022D5838D86FFE06907A54B1F5D0BB7CE042276B876F8EA1918D8DFD50F2A1470A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747387700, "uuid": "497c93ec-338f-4154-ab26-e70d9fb63158", "value": "3072:MV8RvT2CYIhhDn7SIc7QEUEiFFr0/0P+CuRThpJ/8GjeL+uapibK:MCr2Ui8REi7IME5J/qquao+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747387700, "uuid": "34e0f62f-d72d-4899-b442-296c5b3e7c14", "value": 133339, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747387700, "uuid": "6a0655a5-4b8e-4b78-a20a-e9dbcc9f4a14", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747387700, "uuid": "58a14c3d-1e2b-45c5-bfe1-19b7efddb622", "value": "2657737476fc8e38d4138da0528667d1.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2a318b6-3220-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RedLineStealer)", "timestamp": 1747377646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747377646, "uuid": "54980d5b-62cd-4b16-a28e-a84a27ad6e5a", "comment": "Malware payload (RedLineStealer)", "value": "3618ecced03faa136aafd2eab8998c7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747377646, "uuid": "c8bc1966-6c8a-4c03-8bbf-d620ea5cbca3", "comment": "Malware payload (RedLineStealer)", "value": "98f027a2babd99adfb7ed9f4aaf8309bada26de5823c5bacce3ffcb979039463", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747377646, "uuid": "b5969589-2f46-4c18-b04f-71246f491838", "comment": "Malware payload (RedLineStealer)", "value": "ed45cdd9e242bd7fdaafc61f8637c404920b44f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747377646, "uuid": "af84b9bf-d7ad-456a-a207-91b91ea2569d", "comment": "Malware payload (RedLineStealer)", "value": "2668bf9611f88619cd4392cd334dfa7ab03da9891ad1448626e9d35fd141cc07a0df675344dbe2cd580ad5dd937504cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747377646, "uuid": "e252b0f3-f921-4499-ad05-24c04fb4014c", "value": "T1D245C02273DE8365C3725273BA267741AEBF782506B1F96B2FD4093DE820161521EB73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747377646, "uuid": "ea1a78c7-c774-4e3b-8d50-1ff62dea1584", "value": "3d95adbf13bbe79dc24dccb401c12091", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747377646, "uuid": "ed205640-b0b2-4a14-931e-4a5c9696769d", "value": "24576:Ctb20pkaCqT5TBWgNQ7aIMnfXgxPYSe6A:PVg5tQ7aIMfYQ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747377646, "uuid": "8e87aa47-e6c9-485b-8289-4e61903cc3d9", "value": 1184256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747377646, "uuid": "e55107fd-ef26-479f-87c7-bede538efd02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747377646, "uuid": "cdef23c3-192e-4560-9e4c-6c893962d61c", "value": "DHL Delivery Notification - Scheduled for 19th May.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaff0b3a-325d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1747403833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403833, "uuid": "42999cd8-c9e6-42c2-93ff-da98dd4ba2d5", "comment": "Malware payload (LummaStealer)", "value": "b3edc4d046207f50b2075c84430ffbc8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403833, "uuid": "2704471f-9d7e-451f-bc7f-d7c4b2c7959a", "comment": "Malware payload (LummaStealer)", "value": "995acf8dfee5d50968d18bf3d069b0647dd37ba471593a78d3fd2d95692b36a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403833, "uuid": "0eda2858-b217-4306-b3d8-03e21dfeb30b", "comment": "Malware payload (LummaStealer)", "value": "5e3014a321df810ae5200727dc15775f97f93546", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403833, "uuid": "1279f6fd-bd93-4118-ad3b-d72f018d0fbc", "comment": "Malware payload (LummaStealer)", "value": "f90f4142eda2de3e06a1931a1dbfc4db6cb26a473aa39d614c80449f9db1bbb324e532c1a78527fa0e35ed77d5d20ab6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403833, "uuid": "0313b34a-a7bb-4ec1-95d9-07f0b54facec", "value": "T13925F114D71665E6FE6744BA4565B0427862793283BC9EEFB350E3222F236C06E7F780", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403833, "uuid": "0dcdf25d-a0b2-46c9-be19-e0b96a5d6b72", "value": "87841083c800364cc44410a355a8fa81", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403833, "uuid": "bc8ec563-45e3-4a39-839d-a2aa6a6f4bbd", "value": "12288:FRQywxDqEI6QXZFb7Fqikc3YGTglXdCkTHQGSy6xJonVmawikc3YGTglXdCkTHQK:FuXZcltqpaYGUlXEvFZpaYGUlXEvFS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747403833, "uuid": "83248f3e-d2ab-4638-a2d6-79d5019ddd88", "value": 999424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747403833, "uuid": "d88f518d-98c1-46c1-9778-3416cf87a0b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403833, "uuid": "d5cd219a-037b-46c2-a53b-4367bc5329d5", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60bae19d-326d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1747410580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747410580, "uuid": "6f61184f-f9d2-4af1-9541-1cf8d4dc7748", "comment": "Malware payload (Prometei)", "value": "eb12259c8ef26f7fc954fb68d0259f52", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747410580, "uuid": "971bca7e-8073-403d-ab09-14185469af3a", "comment": "Malware payload (Prometei)", "value": "996455921f77160617cc77e78937f0eae18a809e473e4571e0da380c4cff6421", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747410580, "uuid": "7ddc8841-c911-4b30-b803-67e0882ee857", "comment": "Malware payload (Prometei)", "value": "11c0c65766cc77e0e7c41276d359ac9615f93523", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747410580, "uuid": "d301c1ea-9029-4e59-a581-db60982cabe2", "comment": "Malware payload (Prometei)", "value": "5003a39f7f930e75c3fa59bb315b2e39253c9c8929426ae686002943d8413ec4c747a9490c56cf9e20ac176cfbad358d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747410580, "uuid": "c3999bce-a346-430d-a62f-328d0fa8606b", "value": "T1A0155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747410580, "uuid": "6b993b67-dad1-4e1e-a848-95240de68fb5", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mpl5:qmShf4OTjMgXSJhBXEsVrmz9MOup1Khe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747410580, "uuid": "339ae135-eb09-4b31-91ec-8b27f06d610b", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747410580, "uuid": "d55859a3-92a5-4415-94fe-6953fd37a58a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747410580, "uuid": "a495d79a-ea80-4358-a8f4-b5240812228e", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81dc202d-322b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747382289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382289, "uuid": "62dda2b7-c3a9-44de-808b-394fc397014e", "comment": "Malware payload (Mirai)", "value": "ea9d705da222ca8bf49ecb2484bb90a2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382289, "uuid": "d0df54e8-1b76-4888-9988-d543af2e0c55", "comment": "Malware payload (Mirai)", "value": "99999f97856dc89df1c2bb04d272c3f232402ca5db75fa00759d0134dab5c863", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382289, "uuid": "9fd2ae54-463e-47fd-9a54-2765e960d642", "comment": "Malware payload (Mirai)", "value": "0b0af8e3319f4f7b6f3c5a951de3d23e2717cf1b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382289, "uuid": "f7128bd1-84ed-47b0-9e6d-bd245b63e5e7", "comment": "Malware payload (Mirai)", "value": "4b9ecad112d50e188ac87ca88976850aadb1d024639d8dd4e401218988b35c2cf0f40e2da8aa69c4019ddd72323486f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382289, "uuid": "9693cfff-b4f8-45d0-a1b7-b3d8cfbcacc9", "value": "T127438DB4E42A9D54D0850174A8B48F750FA3F2C883621DF73BAA46B1540BEB9F60DFE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382289, "uuid": "eac16c46-454f-4e99-847d-36e9578ded48", "value": "768:f3Dm+BLr3pN3b3xMmWQZ7YnYhJ2wGQDmhMOfIA1eCHo1Y4dbC2WwJZY10U:bm+JDpP/Z7VrGQDHA1eb1dbC2PJa10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747382289, "uuid": "f796ae7d-dddb-4477-bd73-1c36c59a081c", "value": 55568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747382289, "uuid": "87c4c1c4-e8da-497c-9d1d-77a30b2d3379", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382289, "uuid": "a1a59f4a-8be6-4931-b3f1-bfd60bfdac55", "value": "RpcSecurity.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b79a18b-324f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747397633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747397633, "uuid": "c9691982-66d7-4bb6-a597-bc5d4d39283b", "comment": "Malware payload (Mirai)", "value": "096a8f4984c10db95ec588a7775403fa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747397633, "uuid": "3e6de011-64e9-42ed-9aa8-d2ccd47f0248", "comment": "Malware payload (Mirai)", "value": "99bebadd78994cbddd0102281a400751050338ee7c6f1926f29093c966b6a0e5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747397633, "uuid": "6d814568-0a9c-4479-8624-407246069340", "comment": "Malware payload (Mirai)", "value": "dfb4965fd85764e05d9fb302c492cd4a21a95419", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747397633, "uuid": "048be3a8-1887-4d31-8e4a-7ec052ad2fd2", "comment": "Malware payload (Mirai)", "value": "6b4cab3ed43aae67f7cc45ca9dcfbb0cd156929e3b56d650698eb5e280f79ba8ac087fdd1fb10b9480cbea44f925208b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747397633, "uuid": "fd30202b-6cea-44c7-962c-f3e81c9d97ed", "value": "T103F2E17357A15CB09132343F9868CAC26E87BF6EC3F974B71022A13DA2A614E747D163", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747397633, "uuid": "94c5c528-f89c-45b8-a240-fdfbb63cc42c", "value": "768:NK6ildB18gYDtdcT2yemTO8DI26nbrEftq89iHRWDTa/1CHs3Uozi3:NK6GDYDtdcyyFC8DILkgZMDutC6zk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747397633, "uuid": "b16c1173-905e-4aa7-a7b1-01f0724679cf", "value": 34940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747397633, "uuid": "ad75b97c-ac2f-4ee9-8978-acb4e8860f1e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747397633, "uuid": "d8875478-1417-4e3e-b7c0-69576de0d930", "value": "Tsun.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfb49905-322f-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747384164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747384164, "uuid": "73193886-00b8-4eda-b212-9a2bbbb302f0", "comment": "Malware payload", "value": "04a49a392094f92c1e76e9985bd3e305", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747384164, "uuid": "7030b9e3-c509-44b2-a3a6-324b7ec94d86", "comment": "Malware payload", "value": "99cadfd1b82b18c5db2fe9e486a6afca08aabbd06ae05e20eb3ae8ba72cbecdd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747384164, "uuid": "5d5462ca-3d52-430b-b861-b808fae490c2", "comment": "Malware payload", "value": "763425fe3a9a91bdd7f50b7c6ff524bf6f740737", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747384164, "uuid": "76f3bf8a-b476-4f11-b4a0-90757c023376", "comment": "Malware payload", "value": "aa8c4411299e2e09b46724254f43d1375f144bbd64acfd50501f63b697413138504335772e7b8b806091a3c2f24529ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747384164, "uuid": "a410d956-72d7-44f7-9b69-382c3c9ee430", "value": "T1BDD2E09023FE9BE5F1FF23B1555B4870266CB8E5CBE9C36A0F1452B838100559EB63B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747384164, "uuid": "dce92e10-1362-4c98-9f57-2d7b4e8ef5b0", "value": "4b2df774f65211b4962a056c4da67248", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747384164, "uuid": "b907e598-8304-4665-bc0d-f0d1d6996989", "value": "768:lIRWpszd/rGZ2aWmj0tpGkAp9zsg+ll+nXGQlHssMm:uWOe2aCtskcsX8XG4Hmm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747384164, "uuid": "e6d19458-ddb5-49c0-bc2d-c652c4a196a0", "value": 29696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747384164, "uuid": "e565a10b-0f3b-4906-90df-84f4d61d24c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747384164, "uuid": "0338e130-9186-4102-a8b9-e95d78c0da9d", "value": "SecuriteInfo.com.Win64.Evo-gen.22579.9787", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0411605-322b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747382367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382367, "uuid": "efae6521-2506-4913-be27-93e9ce2761be", "comment": "Malware payload (Mirai)", "value": "e01688bdc5e8590e90495df4bdfef53b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382367, "uuid": "9c31a5a6-7e3a-45c3-832d-126d2b5a5537", "comment": "Malware payload (Mirai)", "value": "99e48db2a2babe6680e48be0a4e042be9f9f6c8ef8cdc622e37530438c2a7e4f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382367, "uuid": "4f2a8839-e1d8-4fbc-805b-4ba73190124a", "comment": "Malware payload (Mirai)", "value": "05d04c56f887f34c45fbb1dcd2f4c2e55870c074", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382367, "uuid": "78a189e8-e3f7-49be-8585-48adc8801458", "comment": "Malware payload (Mirai)", "value": "66b2e2b8680bcf1e69aaca1dfe60a6bc21434bccd76ceefbb2e856fb06297cfbd17ce05eb888ca39aaf681035ba0c7c0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382367, "uuid": "9db0f798-9172-42a6-b8fa-cf115f69038e", "value": "T107337DA2C16DEDA8E1118A74BD254B789713E100865B3EFAD7C4C69A8047EFDF2487F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382367, "uuid": "5fa78127-54c4-412b-8b45-0895ccbbfe16", "value": "768:qvgRGwtauXt5vxkxbeH9+tdvmGmwGwyWfs3IClU/UOWCUoeBQCj:UKGwtvXE1PuGmwGGfs3LlU/7WwiQCj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747382367, "uuid": "521139e2-fab4-4fde-b8b5-fcec3d38f1d0", "value": 52644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747382367, "uuid": "619ef759-44ee-45ce-95ad-aee535eb6b6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382367, "uuid": "3bd09d1e-5575-420a-af5a-b018851edc4b", "value": "phantom.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "580e7d9e-321b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747375347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747375347, "uuid": "a5c890f1-8222-4909-9eaf-afdeae4d8768", "comment": "Malware payload (Mirai)", "value": "573d2a13c458f1acd2459fbd4b74a63b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747375347, "uuid": "5254de39-9bfa-452f-9233-b8d0f9dbe53a", "comment": "Malware payload (Mirai)", "value": "99e4b8aa71693602b0c7ca95924e0360bc0cdef7049871534f4ffaddb74b7880", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747375347, "uuid": "fd7291a0-2b8e-4877-8651-f5097d9cf766", "comment": "Malware payload (Mirai)", "value": "acad61685e6eebd4a9b380e36b1a95a9b219f96e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747375347, "uuid": "f7928a33-675c-4c6b-a824-2e23a6ef8534", "comment": "Malware payload (Mirai)", "value": "4bfafb7594a8399bf0aeb15455c0e07f74beed4fdc514073b7e1b28bf4e34dcc7c6791b66c1654eab210d1a4145ff997", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747375347, "uuid": "d39bfe30-19c9-457f-a984-92a9e631f194", "value": "T184F2D08E80C9568ACFCB9D3892FE4BE58E44D8C63355135293647DCDBA4769FB5AC030", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747375347, "uuid": "3b23523b-14f0-4320-a64d-97a4b3767dd6", "value": "768:/76qxotfLAkg9OXH1Njbs0BJbgmUT9aw05Nhi8U3Wv2:/76Vt8UFNPsQJ8mcs5Hi8k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747375347, "uuid": "fcc08fd2-ee6b-45b8-94af-8048dcf1effc", "value": 35660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747375347, "uuid": "7ec03b07-4b04-4807-8298-53362484068f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747375347, "uuid": "f22d5135-446f-4eb6-818c-ec056315bf6a", "value": "neon.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bea706b-3235-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747386574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386574, "uuid": "7412a5d3-e983-4a42-88f5-ff4e6aa19c93", "comment": "Malware payload", "value": "112c63c2370485073f79b5a8b715a67d", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386574, "uuid": "0b6a3771-dff3-49b8-943d-2998ef3afbfe", "comment": "Malware payload", "value": "9a17f87dcd2208f8f62ed76a15a6c52817008e77179c8b1f7f39c079d419f398", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386574, "uuid": "9d951e9d-1649-44cf-bd40-8f850e701287", "comment": "Malware payload", "value": "49dfba129d1f7e52997191f79a35576f094f9ac2", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386574, "uuid": "e888114d-4804-45ac-814f-24a1eecefd48", "comment": "Malware payload", "value": "cd114946430a90844ffbb8cb3f19935e19408f814d2f9a2236af399df5a8386dbcd1c648c3acd5feb677245cfb9e8588", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386574, "uuid": "5ed8ca8b-1c3a-49a3-b993-d15cf5a4ca03", "value": "T1CA92C0B70C4EEC77EC13433CCB8ECB9197E512AE52495DCDEE582D42AC6A714A845B82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386574, "uuid": "1b22e21a-bae0-45cf-a4ec-019d6c9928d8", "value": "384:zlEWd//wOMUdedSHNA5vaet2LELEzoSZexliujQy:zldn+Ddmot2L+EzoSEAujQy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747386574, "uuid": "24ca96a7-e37d-482b-b1b6-95f7d9784c1c", "value": 19980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747386574, "uuid": "df419066-3308-40b9-bd5e-b21526e16346", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386574, "uuid": "a586584f-52b5-4040-b2ed-1e3b00bd96a3", "value": "CasinoEssentialsBETA_v1.04.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5e3913a-328a-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747423151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747423151, "uuid": "f5f94436-0301-4862-b7c2-5750c7884fab", "comment": "Malware payload", "value": "eb3620b923941c070b0b22f8bcd201bb", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747423151, "uuid": "ee287fbd-eea5-46bc-8ea4-701ca0d9c51f", "comment": "Malware payload", "value": "9a2b573358f1bd7f299a96c60add24c93396100dcc3d3bc887df36d720a2c9b8", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747423151, "uuid": "192fea7a-e8dc-4cd0-b13e-d9205f1a22f8", "comment": "Malware payload", "value": "bbfe3ba2747c80066074644725c750aa11408b7f", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747423151, "uuid": "2d406135-87c8-4696-9d3b-c4d38f9342d4", "comment": "Malware payload", "value": "183bc45b8335ff22ee79573093472391f70b612fb2ef73eca6a4580563e6a6cb25b04f1b7bb48e33b3daf21f48d132d9", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747423151, "uuid": "2f5c0da5-35da-4036-849a-f7720341f151", "value": "T18BF4236225878EB8DC5E24EFE6907E7B29A1B9C060015BC3942CF9FF18119E977E80D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747423151, "uuid": "26c06df2-aae4-4d5c-9d38-cf1498114f34", "value": "12288:Jt3Zn4kDOANri7Wmjoi+PIA/hCPZ6eO2H1dbJ7lQm8nV:HhpDbi7B9qi6efHv+V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747423151, "uuid": "4b857896-c0b4-4e1b-a3ae-a0b9ad3ea942", "value": 760511, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747423151, "uuid": "775625c4-a8c1-4efb-b820-3d45eeee8b49", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747423151, "uuid": "ec603432-2eab-4e03-85cf-c4aa7abfbd6e", "value": "RFQ_9876234567.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adec4289-322b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747382363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382363, "uuid": "c2f9e16c-223e-4460-81f6-7eb1a016eec8", "comment": "Malware payload (Mirai)", "value": "682c619a12290c68ac615809b9816738", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382363, "uuid": "d761bcac-7390-4a70-b527-0a7613c0494b", "comment": "Malware payload (Mirai)", "value": "9a50638cdf617d934b2d3273b3a2b5e20183d109e0d450a1761f4b7368584826", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382363, "uuid": "d3d9238d-f86f-4f8c-8eb5-0a9380df3477", "comment": "Malware payload (Mirai)", "value": "a30526c309b04afcbbde0780991565eb6df575ea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382363, "uuid": "7746b58d-19ea-4d1b-8c78-b51f3f123683", "comment": "Malware payload (Mirai)", "value": "395dd319a54b136113b039cc9e4760dedf92991622d1d9d136e8a833cce6a0c655fa543ba03f52e06dd2840a1b50df14", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382363, "uuid": "4ff744eb-3726-49d5-b6fa-9ef91c8641a3", "value": "T193431845BCD19A12CAE4237AF92E41CD372523E9D1EF7217CC112F10778A82F1EA7A56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382363, "uuid": "570a525b-a8e6-4a81-8f7e-047ee9306232", "value": "1536:D9PcRxxfdqcicMnroYVbJiYOg1VIwwh+1gAL2i0Zec1aRQFO6:DhcRxxFwwEr2itTQFv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747382363, "uuid": "d9a9aa62-e079-4989-bf76-019fddc75ee6", "value": 58432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747382363, "uuid": "07b9d719-3219-401c-8dd3-b7726d3e46a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382363, "uuid": "fe4116aa-ff57-43ce-abcb-018f5d8c7d71", "value": "kwari.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ffcbcac-3288-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747422095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747422095, "uuid": "bfb598fd-a440-45f0-8d49-aac91d37470b", "comment": "Malware payload (Mirai)", "value": "bd76cc5f8131eeee1107385d6f4e9f90", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747422095, "uuid": "619de015-4701-42fa-b42d-d28dbfca0b20", "comment": "Malware payload (Mirai)", "value": "9a5c5e8dbc0919581ad7355f77ddd18898ce604000758f878fe4817638d7e831", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747422095, "uuid": "ac2ccfbe-c84b-44a1-831c-3ce5600c865c", "comment": "Malware payload (Mirai)", "value": "52e7e1bc88da007c74ee78f91f0c759d5892c54c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747422095, "uuid": "b98a1713-7a6f-4e76-832f-8730a415e70b", "comment": "Malware payload (Mirai)", "value": "aeae3eeaa2c9b332ac152573544a1b31007f02532e12769ebe7e335bb8d7c604edb1730570e2050128aabe6982e90fbf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747422095, "uuid": "b52fefea-f42f-47cf-9253-a337754c4233", "value": "T133A3840D7E258F7DFBAD863447B78B219248339A3AE1C684D15CE9012EB024E745FFA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747422095, "uuid": "00d7a74c-b1a7-40df-b7b6-c98d34b099c5", "value": "1536:MNBwUyaccudSFIn18bSdR5H1MRNnTHGuTOdcJvDXLZrY6hfOBhJ/:nU7LudS+18bSZ2RNnkWDXLRY6hf03", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747422095, "uuid": "546add2c-6299-467e-97b0-2730a2c0910c", "value": 104776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747422095, "uuid": "40d58656-ff7b-42fc-a9e0-e92e33c09fc5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747422095, "uuid": "78affc1f-af90-4ded-bf73-4a588658c893", "value": "db0fa4b8db0333367e9bda3ab68b8042.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d7d50cb-3279-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1747415675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747415675, "uuid": "dd4c79e1-e0f1-4e35-bdd6-f3faae69cc5e", "comment": "Malware payload (Prometei)", "value": "2906f9ce858c3393ccc45bf53d6b95f9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747415675, "uuid": "dbfcf21a-b916-4680-9a03-b70a6f740331", "comment": "Malware payload (Prometei)", "value": "9a9a444bda42b39f24f64185a3bfee5ad401aeff4fb6c7927c188c5f1140526b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747415675, "uuid": "a808cec3-9db7-4e54-938f-a77994dbe04e", "comment": "Malware payload (Prometei)", "value": "6715a8e32d06cde4de3f4b833fb3edfb975008db", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747415675, "uuid": "94e64a68-7dda-4ed4-892f-ad6ffc8fc01a", "comment": "Malware payload (Prometei)", "value": "c6884242a184e4ebfbfdf534186e4c1af64975a69d318269b3a5643930f1ad604b6bb999086d08eb04c5eae066a7fade", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747415675, "uuid": "59a7e555-8eab-40ef-b1ba-efc68b907ba8", "value": "T1979423F8C83D2E3098169B3CBB1A826CF0A15772D9562F6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747415675, "uuid": "8efbab77-f3ee-4e11-87d4-d3fe4c33daf9", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgr:25WOSACZSV6eKRH5EPiamb4DsDwwcb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747415675, "uuid": "307d7ce4-3514-4d30-84dc-3d67a24b5ad3", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747415675, "uuid": "f241e288-07a9-48f5-921b-d188230123b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747415675, "uuid": "b0e32a39-8bb8-4b86-861d-e46928178e6f", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc8a0bdc-322b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747382441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382441, "uuid": "1a379cf2-a694-4282-bed1-358d442a43cb", "comment": "Malware payload (Mirai)", "value": "d1b18f23042d2c8dbaef9912245ac39c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382441, "uuid": "b4367883-7430-4f4e-923e-3d15f65db51d", "comment": "Malware payload (Mirai)", "value": "9aae0c538da67ecc950efe1bc287f022ae0b9c189cf5a330f80cf643fe9ee126", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382441, "uuid": "fef1e19f-13f7-423b-bb8b-4dca8ee056d7", "comment": "Malware payload (Mirai)", "value": "525f735529e14ad7aa64af732c0886adb2ac0dae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382441, "uuid": "afb7ba78-451d-414e-be25-eb881b3fda75", "comment": "Malware payload (Mirai)", "value": "2ef11e612ab8aeb43cacfd9361c1f6129e6673fe8667eabe5a416c90bb07c1d3aa0d5a8f70044fe8e3fd49dbf1711f9f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382441, "uuid": "9ccf0234-af7a-4d20-ad7b-a798523ac4cc", "value": "T15263B50ABF610FB7D8ABDD3745A92B0528DC550A25B97B75BA30D818F60F20F19E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382441, "uuid": "bfddebc0-5d95-4f88-bc96-ddaec97a9f6d", "value": "768:b0A5RDt+oUvklw3AfMmDociUwLX3XXKcW6PNcCLf548eDeLoepBNPgjaUXiiw0Uq:gA5RDtDUaoUw76ctPDfd+KoUBNPhiU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747382441, "uuid": "e3e7d48a-4f54-4e26-aa48-7f49f1ed60b9", "value": 72956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747382441, "uuid": "ea343341-50fb-4aa1-a403-dfc0ac5da49b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382441, "uuid": "16045f2f-d11e-4459-ad77-bc23ec7861c0", "value": "phantom.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b00de4e4-31fe-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747363039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747363039, "uuid": "3838dbe5-8347-4f8c-af6b-a490b71aefea", "comment": "Malware payload (Mirai)", "value": "4f599eb39ca9ecd608b9c6e4b1bf3dbe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747363039, "uuid": "b13d56be-34c6-44f5-8104-312dc0326cf4", "comment": "Malware payload (Mirai)", "value": "9b195576bc633ca6a17efa7f8918064af3f689c48b940e7b7b7aaa4b2b3f87c7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747363039, "uuid": "daefb3cb-0889-47c0-8be2-0b6237b903fb", "comment": "Malware payload (Mirai)", "value": "7d49209a57563456e78d8ace26279d135bf62f10", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747363039, "uuid": "6b023596-f85c-45af-afab-66b57fe66f8a", "comment": "Malware payload (Mirai)", "value": "b0a4aa2ab03ddbcaa1f38ec62c1470358c5b2ada8fafa3204298ae1f7fb0b168b0ad23f56de44684b892334d895f33d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747363039, "uuid": "c9f99d58-c2e9-406b-a7b3-ab44b49d52c7", "value": "T1B293EA05FF521EB7C8AFCC3705AD1B4228DD599B22A53B357674C428B24B64F2AE3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747363039, "uuid": "ffb78a27-60b8-49b8-a632-e8f76e5697d0", "value": "1536:TX+dL9dZBcZg6YK25JRHmvzohInZyZRVNH0hZ+IEfoXgz8cZ:TX+RZXLGvkh4ZyngB/gz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747363039, "uuid": "785e4ce4-cdca-4842-a1bf-a41df503fb86", "value": 88864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747363039, "uuid": "d694a830-8ecf-4813-8830-2146feaf342b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747363039, "uuid": "503728f1-d4a0-4b02-bc3c-ea8f4c39defa", "value": "neon.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f494f3c4-3287-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1747421995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747421995, "uuid": "64742334-1248-4556-87d8-be2b3956accf", "comment": "Malware payload (Gafgyt)", "value": "94c2b8c51025aea196bcc084fa59b47f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747421995, "uuid": "dc860878-c716-440c-bcf4-7356a423326c", "comment": "Malware payload (Gafgyt)", "value": "9b4227ff665e9b4eea39c7caf78e4794088d6c169e16e1f94c28ac2ec31e8c9f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747421995, "uuid": "c512476e-6875-4a53-8baf-f9f7a708d242", "comment": "Malware payload (Gafgyt)", "value": "3dc4e1b1ef84d3003b847e91b831c81f3ff7744b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747421995, "uuid": "2f9f15ea-a738-4627-b333-b0abf607f532", "comment": "Malware payload (Gafgyt)", "value": "9daf264f7d9a19f70aee1d076a8448b54724d3043a965db8cd2607787611e87522d8467df4c772822754598d4319486d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747421995, "uuid": "1efb2234-b184-49c5-8d30-f109f55f0af4", "value": "T1EBD32A1748614E72C005ADB225A722200717BE774ADF26D9F92D79E08B7B9CF612EFD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747421995, "uuid": "19f9563d-346e-4a53-bc36-95ddc83657c0", "value": "3072:vcj8+Ox5nx3cjiHetJ8add9QzhsNLQxxEFyzKQ5CGBgBFU:vcxOx/KiHetJ8addQULQxxEFyzKQ5BBB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747421995, "uuid": "bc6822fc-cfda-4174-aadc-74fa68fcf86a", "value": 133893, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747421995, "uuid": "5e2316f9-08f5-496a-935a-d87c8cea096b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747421995, "uuid": "8a8b71f3-c43e-4a4e-9d38-57860bb267c2", "value": "openssh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "925d5d33-322b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747382316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382316, "uuid": "fa443726-cded-4566-ad19-04a2fc79c0ba", "comment": "Malware payload (Mirai)", "value": "d15e31264adc615ee3295c4e8b44fbf8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382316, "uuid": "2bc80ec1-39f6-40fa-a0f3-75bca7d3950a", "comment": "Malware payload (Mirai)", "value": "9c48f1a3b9651da2f5df24a5264cf029df859714f9e0e7cc4b6539fb54fa9cee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382316, "uuid": "533d3ba8-7673-40ba-a44e-a92021c2269d", "comment": "Malware payload (Mirai)", "value": "734bf6f9082e00f3786d160d8618942066d57d75", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382316, "uuid": "d60cb5bd-82c0-4199-9c0e-5a9a735f5f62", "comment": "Malware payload (Mirai)", "value": "50dd47221b62d215e3e5accd6cf9a7b68fe5080802a4da034c56c50837101d0aedd0964f3ccbc823a1bc0a572b5a52b1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382316, "uuid": "6c6f05ae-a2e4-4489-ae76-d1d6861ddfa9", "value": "T1D7B2C0D9D197DAFBDF9F7DB408CA91C13BE84FC83A638E122190AF8143564271645ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382316, "uuid": "85fe36ca-a73b-445e-b8ff-a4904e1afb4f", "value": "384:MN+EYgpIs0QiReRy77S2O68RlH74L796xn1BmSki6E4xikanj02M4uVcqgw05Vxd:MsY8QRUS2O68I6hiSkREBhAF4uVcqgwA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747382316, "uuid": "ea7b0250-5072-490f-bbfb-e9b699113a44", "value": 23944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747382316, "uuid": "9866c8e7-902e-48ab-9343-8171efd1207d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382316, "uuid": "e871c067-6e40-4ef0-9818-9a89d290a6d9", "value": "phantom.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a15311c-322e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747383564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747383564, "uuid": "54c74d14-0b34-489f-b4e4-7208bb720839", "comment": "Malware payload (Mirai)", "value": "b4fbf39a3482ff878e009d200ba60536", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747383564, "uuid": "125e9531-3ef0-4861-9d19-14327574f3b9", "comment": "Malware payload (Mirai)", "value": "9c58b740e77c7683c2b08aba40c363c261d0ebba37fa652787a5e06865b41428", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747383564, "uuid": "3938acbb-c13e-404c-ba32-5e5bf438457d", "comment": "Malware payload (Mirai)", "value": "42f660357be52f56f706ee141a8e51ed0c6e3f23", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747383564, "uuid": "2d89c951-6e30-480c-9227-4c03e11784be", "comment": "Malware payload (Mirai)", "value": "da5d125667ad600c2ea9824b809b397d29c23afa190867e434b059cda7164aaf9e03dae4b5e96414981ccc0363a4db00", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747383564, "uuid": "561dd249-a759-44b9-86c4-4f4fca9587a6", "value": "T1CB43F13E9C57F1B69B600C7BBC1CAAA733D652B1E5D8398316180548CC6C2A99FFD046", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747383564, "uuid": "d1de5e6c-00a9-4d83-b6c1-940c2ffc2b99", "value": "1536:4CTmXdaJWE/J8vVnfkRxr1xHLlfIPXFw+DIW:36XdrBVkRHxHLlfIPqaR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747383564, "uuid": "95a7db48-a1e8-4544-b85f-6c80467dd701", "value": 59112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747383564, "uuid": "df116cb8-0539-41ea-bd82-5d4e09581bc0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747383564, "uuid": "50508af9-5c94-476c-8137-51d797a37b6c", "value": "neon.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "607bc141-3241-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AmosStealer)", "timestamp": 1747391682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747391682, "uuid": "41d5bccc-3ec5-45ef-aee1-c0050ff9a406", "comment": "Malware payload (AmosStealer)", "value": "615fe44e87550c1e50d607c240a65b4c", "object_relation": "md5", "Tag": [ { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "security-check-u8a6--com", "colour": "#68A0E7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747391682, "uuid": "b152f372-23ad-4b4f-9d24-298c4ce405a5", "comment": "Malware payload (AmosStealer)", "value": "9c9d12e81687166004547f63fc80f920ce204f2e0fcc8750b54273429dbaabc3", "object_relation": "sha256", "Tag": [ { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "security-check-u8a6--com", "colour": "#68A0E7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747391682, "uuid": "5744e035-f5b1-4f23-9728-f642b6e98e3d", "comment": "Malware payload (AmosStealer)", "value": "f6b8f53c4c6068c283953186236d0dff6ca02b93", "object_relation": "sha1", "Tag": [ { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "security-check-u8a6--com", "colour": "#68A0E7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747391682, "uuid": "24e7bb56-d5cc-45ae-9270-29ba4b85214e", "comment": "Malware payload (AmosStealer)", "value": "3bb7dbc25c83017f1d0b2b648a0af7b5a2c296bf13a88c1649933a0cc655f34e15f56d22d9721d15c4017eef3979c549", "object_relation": "sha3-384", "Tag": [ { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "security-check-u8a6--com", "colour": "#68A0E7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747391682, "uuid": "bc5fbaa7-9111-4057-ab06-f449fee29120", "value": "T19765018CF2D87F1BDCA705B72419079264ECED5113A0C38BEA529B3B7A947BC2C1B156", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747391682, "uuid": "e209f50a-f689-4d07-854c-d252bd1d9f31", "value": "12288:iqJHn59XHpFCbtXiVjJPqJHn59XHpFCbtXi8:iqJLCbIqJLCb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747391682, "uuid": "7b7c3fe5-c440-4681-a8a3-ca3c434e4ecc", "value": 1486096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747391682, "uuid": "b41f85d1-69f0-411a-99c6-16be968bc20c", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747391682, "uuid": "4943a8aa-52f5-4005-84df-e3a872fb901d", "value": "9c9d12e81687166004547f63fc80f920ce204f2e0fcc8750b54273429dbaabc3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "082bec87-325e-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747403989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403989, "uuid": "99db4590-8972-4fea-b5a5-b9ebb6d4a514", "comment": "Malware payload", "value": "e7b3988894483d0f1003eb4d427e5c07", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403989, "uuid": "d68cc222-b4a5-4837-9774-efd76b434935", "comment": "Malware payload", "value": "9cedf1d4d9305015329b0180fbde02184494f99e70a078c9786040656e5e91b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403989, "uuid": "29b120ad-1b5d-4b19-bc80-9ee981423ce2", "comment": "Malware payload", "value": "733a466da2e3ced5f284bf242df23160105d4869", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403989, "uuid": "6bc9ba69-c995-457a-8c94-63c84521f85c", "comment": "Malware payload", "value": "7b7ff51ae5818652a12d6401a852e2b92b641ade670ae7c7e2bd036ec586e40b8d26b86e53bd1d2c115e901079c6fc8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403989, "uuid": "c50bbd0b-42ed-44c2-a768-bd7ca86e0d66", "value": "T142E29E71E4C0C955C2940070A95E7EB7E9BFDA6503263A865FE80C4D7EB0DD1B23C29B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403989, "uuid": "2da2bb48-c2c9-4b23-9b04-06b282cf7885", "value": "768:tuN/DvXlBxuaF8bKLSBVIFA/ZA6A+3jL/sXNumG3buQF:t4TXlBkaF9SoSZs+zIX435", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747403989, "uuid": "1dae2615-b456-44c0-a69d-2a1d69683689", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747403989, "uuid": "bbfde6dd-2652-4525-90d8-5f9bc7ce0477", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403989, "uuid": "72ff276c-9178-4582-8934-3f35e42e8da3", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e7851a6-31fb-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747361533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747361533, "uuid": "6f1741c0-44af-4900-8ee5-1c2e48856158", "comment": "Malware payload (Mirai)", "value": "235061564a16f84b8812ebfca98f3ad1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747361533, "uuid": "0e010946-e6df-4308-961b-5a5139ee60ad", "comment": "Malware payload (Mirai)", "value": "9d12e20e0c9a9990b36fa7d02428f348a450747bedb2d9012c3183cda0ee7b12", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747361533, "uuid": "a725234f-507b-4aa6-9118-790564fc311d", "comment": "Malware payload (Mirai)", "value": "ef03c20c322c50a5033e983c3be9a1eb18c3854b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747361533, "uuid": "7be7bf2b-d9e7-4c20-afa2-009ecc6445ab", "comment": "Malware payload (Mirai)", "value": "430083b33002e3c66ab5811cabe6741fb16877af6516fd7583f13bc1bde0fee8725829cf253efeb8ed2f4c75653d4232", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747361533, "uuid": "a8de013d-5f87-4902-87c5-7935a0e944ec", "value": "T184B39CAFF24746A1C45246F017CB8F8E3E232281AF5794E33D1E267A19751DB5E06F82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747361533, "uuid": "e56f1e28-5c4c-4684-8766-14804a6f89ed", "value": "1536:HyPMHenMcFbisAheJltwkGUxx4sPgw/LWg:SPM+nMcFbXGeJAkGOPgwq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747361533, "uuid": "24d9f400-3a6a-4153-a7e0-bc93fbaf9dd4", "value": 107836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747361533, "uuid": "03cd6b55-4cb8-4aa3-b2ed-d5496f8ef95a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747361533, "uuid": "494d85f9-358c-4ea7-b5a1-0b65e1e02f10", "value": "neon.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56441b35-322c-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747382645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382645, "uuid": "a6c2e3b1-eeaa-4c68-834c-84c785a0872a", "comment": "Malware payload (Mirai)", "value": "c931716d78880ced1b688c35778cafde", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382645, "uuid": "3db98994-3cdc-4d1f-b820-0b9a556f061c", "comment": "Malware payload (Mirai)", "value": "9d3e553e2cab274ff8d10d471241778b3a9758a6a4f990d9ff912286ff4d8a42", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382645, "uuid": "b2059087-876c-4974-8920-9d8431191d65", "comment": "Malware payload (Mirai)", "value": "9f6104b79edc088017410d4dc62969e1c94a996c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382645, "uuid": "eea6c035-0e1e-4d37-8bc2-134aff30a8c8", "comment": "Malware payload (Mirai)", "value": "8f4d7d1a6636ca079c0533c1b019a8c6d68f2607d1dc6b49a4ae84ebfc99211ba4772db096a3a99b96450198e9ef72fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382645, "uuid": "523177ad-22fb-4c3d-97a3-821de04f2bc6", "value": "T19FE2F10AE1E70994C0DD40F129EBBDDD4D53A22C675C8F257DC82977A922F5C7E38A81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382645, "uuid": "7eeb9a40-44e5-4417-bedc-2ea4992561a6", "value": "768:qpLdlaImm59e1y5P7I1nWe16WfnbcuyD7UHQRjD:qtJmkjEnyWfnouy8Hy3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747382645, "uuid": "a54b876b-86fb-40f7-9227-d116242ad6c9", "value": 33812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747382645, "uuid": "60655288-27c5-434a-9ff9-dc0afb9a27b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382645, "uuid": "348351d8-5948-4ed3-89f5-9e2e3199eaf3", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fce4ab77-3272-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1747412989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412989, "uuid": "741d5b6d-76f2-4834-bb76-caa4c5a9dcd5", "comment": "Malware payload (Gafgyt)", "value": "33005d568ca1d7c14701a55481005561", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412989, "uuid": "cbae55b0-af87-4e2c-9901-a6e305eaa42b", "comment": "Malware payload (Gafgyt)", "value": "9eca6c6d9d8864c1f5ade24697397dc1f6a3a334ee00a4e88a92756475a08f42", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412989, "uuid": "d6f210a0-0d05-4042-93f1-2cda6058a8ad", "comment": "Malware payload (Gafgyt)", "value": "31accdeb53e675ea85709f098ce4de5de737f9e3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412989, "uuid": "c2016025-2169-4f55-b30c-24eee7e931e0", "comment": "Malware payload (Gafgyt)", "value": "c9beb2222384b20849f08ea9c4217f958d2232dccaf4232fb1fdbf58da4151847abb9f2ab13d70d546b5f4e7c188c005", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747412989, "uuid": "94f8a11b-1733-4af4-842f-695bba253b2d", "value": "T14304F8257669C5F7C2620BB501536EDD0B2EEC351AFAE981F3287CB049F40A5BD2DB18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747412989, "uuid": "e3361c45-8bbc-4e0b-87bb-72c04c46f092", "value": "3072:lTYLA2t/9aS3UgnkXpe7edPjHVdhQ7iBrZS1mAeL4Z/yYSygPBsBsC:ox9CZo4j1dl8mAeL4Z/yYSygPBsBsC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747412989, "uuid": "da3b9420-01d5-45f5-9082-84271ada40f2", "value": 184312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747412989, "uuid": "897e66c7-362b-4850-90a7-1c944bf20d71", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747412989, "uuid": "49b98113-f07a-4746-9e74-b7978883b27e", "value": "jackmyi586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfdc5f96-3286-11f0-8bd0-42010a9c0005", "comment": "Malware payload (ResolverRAT)", "timestamp": 1747421477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747421477, "uuid": "1c9d636a-30fd-4f67-87e0-ab7926fefd77", "comment": "Malware payload (ResolverRAT)", "value": "0017f18960948b746109973076f00520", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ResolverRAT", "colour": "#ACEDC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747421477, "uuid": "98a20775-e093-410c-8d44-76910cefd9d5", "comment": "Malware payload (ResolverRAT)", "value": "9ef929cb19bdcb4355d34e51d9e014223079fee809bdd7c47facea5cec8324e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ResolverRAT", "colour": "#ACEDC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747421477, "uuid": "c90ccc86-93b7-4c42-8971-8da314e9f886", "comment": "Malware payload (ResolverRAT)", "value": "93376d4971ce1616bf3820abcf2b4b2b422c233c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ResolverRAT", "colour": "#ACEDC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747421477, "uuid": "943b1a67-176e-41b9-873c-a4cd461c83bb", "comment": "Malware payload (ResolverRAT)", "value": "6467f90c577d409f42a90e804390e775810fce31d9379e12df726e03f87603411c284f0ebd3e38fca254f33bf9f0622e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ResolverRAT", "colour": "#ACEDC7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747421477, "uuid": "6c085a2e-29af-42ab-b2a5-6a6ae02ad6ce", "value": "T195652383B5418573E2E143B00E37A3398B75BD5308B86929F5AEBD4CFB365E994013E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747421477, "uuid": "c0892e3b-280a-40af-93ae-f237340ead64", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747421477, "uuid": "76324b65-95c4-407e-85bb-e9351511120f", "value": "24576:invRwZJkJYKpccAZ2lOvB7xxVXOmP7FHezS1fRwtGcux6A5CQMHn6G3ySnHN:ivykJYuccevBAmP7ZezS1fRYYMMCQMH/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747421477, "uuid": "50fc9e99-19ac-4498-9cce-36e4af7dfc59", "value": 1438023, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747421477, "uuid": "aa053053-cdfd-4b7c-9146-6c6a5c5d9fc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747421477, "uuid": "ae5dec6c-32ef-4016-9ed0-3230351c537c", "value": "0017f18960948b746109973076f00520.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38d9e8c3-329c-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747430699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747430699, "uuid": "1806cca5-3075-4bad-bb6e-126f0b2f97fe", "comment": "Malware payload", "value": "8c16989808247525f145f1da6f8ffcc1", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747430699, "uuid": "27c55230-c8ce-4964-b84c-a522570faf50", "comment": "Malware payload", "value": "9efb08a07a6881d74109426572f81b756f16e3b5a72fc50d3e9ba13bcac34ef1", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747430699, "uuid": "0b3cef01-d536-48d5-a7df-480c0bd83b69", "comment": "Malware payload", "value": "72e92c5bf1b703cc4388bc600cf0fed9a6b05075", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747430699, "uuid": "5306f51a-ae93-4902-98ea-3861f186a531", "comment": "Malware payload", "value": "ae613ded54cfa3d03dfc951fba6b07f69f9e2d4e956f5669998ff8765226485ff51e2808cc69b2885a3ce06f607e96cd", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747430699, "uuid": "8c964bcf-d320-4cfc-9323-41f73e656b40", "value": "T17CC02BEB8DB924EA8F5681280C305218440131101CF145021767DC01BF242F8C65E400", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747430699, "uuid": "3dca901d-8bec-4f31-a921-d4c87188b118", "value": "3:VSJJFIf9oM3KuIFsVwQAR03NMneNS+8H2MZs2fF:s81R3KuzL3enF+8LZse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747430699, "uuid": "ffd891fc-0853-46f4-a2b6-5d46d12b2417", "value": 130, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747430699, "uuid": "fce0d86c-7bc9-443e-843d-52bfc2f4b282", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747430699, "uuid": "2ffda039-9a82-42d5-95e3-1d9e3545d8d8", "value": "install.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22d94fc9-3262-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747405752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747405752, "uuid": "91858268-6ab6-4d8c-b518-974ebc5592c3", "comment": "Malware payload (Mirai)", "value": "3991f61be077e45b1a4d7997fff7d967", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747405752, "uuid": "d619dc4d-1f79-4203-82a0-5225f8670c7f", "comment": "Malware payload (Mirai)", "value": "9f84978d16d849caf1fc7497b53a9e6d8eca32314e9ad70801a72ba988c2ddd5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747405752, "uuid": "91d5495c-8280-4add-81da-4d8e8333e1bf", "comment": "Malware payload (Mirai)", "value": "eda2f8267e4d2fa70cc6186b80b22f6759764c62", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747405752, "uuid": "7a234d6e-5758-42df-9bab-6f4bec357678", "comment": "Malware payload (Mirai)", "value": "3707baeb3ec6597df2c4d9839db1626c0e32ed2712e87d2bc386c6db9b10536dc408419589a4db8165fd63309f6a4ff7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747405752, "uuid": "04b505fc-d94c-4700-9f48-d7bb89786a63", "value": "T11AF2E1B3C02887B6D89B587A45E2ABC4FA3B299601066A9A1E8570FD5E7BD1C5F301D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747405752, "uuid": "3155e1fd-1088-4620-acc9-312dc9f2cc15", "value": "768:5yLjKBGK0ZjMEVx5NEzcNcfWzaLCUJjdPLXhrIMZPx0KlL:0Lsii85NEzyzabLxrIMRPlL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747405752, "uuid": "2f7163c8-0474-4c43-be74-d3b2485d2a2f", "value": 34508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747405752, "uuid": "12107b89-ed56-4f91-a46b-0e4e04e78d76", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747405752, "uuid": "5a436089-ac29-4e28-8301-b4f9e75a66b6", "value": "neon.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3947dfab-3264-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747406648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747406648, "uuid": "8edbad89-0401-46a2-bcb0-0fa2a8559414", "comment": "Malware payload (Mirai)", "value": "8c3eb81855db47cfa412e0125b5b6942", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747406648, "uuid": "50e8fe9f-e5a4-4adb-b0b7-ee31e32c4e8c", "comment": "Malware payload (Mirai)", "value": "9facc389d6aa51c5bb600391e8b2ceafba2af7c262e99e0d233a056e670c167d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747406648, "uuid": "3b428787-ee6c-4b2c-8bb5-7ddbdb60de0c", "comment": "Malware payload (Mirai)", "value": "c5a2d0f91114d3934029b5040225bd32b4186866", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747406648, "uuid": "184bf2c9-9f48-41d5-9a32-b0eb3e5eeb92", "comment": "Malware payload (Mirai)", "value": "f014fed4728d765cea8e61451d48b4c17f40d9a8e124adf081490e0d0b1ea4b9c1c7c0dd54f92176cf80e68474f6d15c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747406648, "uuid": "c41f1af3-e97b-4b25-be83-4866fd4e6df9", "value": "T1B0E2F253E2B68747D54F31B12AFF2A0E58A1E329782894324BC1715B9152F7C2026F5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747406648, "uuid": "6ca971b1-ebe4-4120-ad88-4998b886bf10", "value": "768:oDnO4DfAt8oDCND2BGHg+CIRXoo3TDuP7HKYxHPrPnbcuyD7UHQRjC:on0mogD2BGH7CeXZfY9xHPjnouy8Hym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747406648, "uuid": "60655b8a-3a32-4010-a215-2097bf170912", "value": 33912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747406648, "uuid": "5bff0c7f-a03a-430f-a482-f8f584c68cdd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747406648, "uuid": "81d95bdc-f9a3-483d-9369-65a72e855e7a", "value": "neon.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6cab703-322b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747382378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382378, "uuid": "f5aee866-0969-4091-a049-ea1121e3e61b", "comment": "Malware payload (Mirai)", "value": "9672d89f129f8ffe9d8be70c2b77de0e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382378, "uuid": "7cb583af-9c27-484b-ab18-7bce660a23a0", "comment": "Malware payload (Mirai)", "value": "9fd1151f6e0b48b58fc48b95fa9c09b9d20fd89c0ed97e93f22e87e0787b6ffd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382378, "uuid": "187c7aae-df49-40b5-83f0-2535e2644e98", "comment": "Malware payload (Mirai)", "value": "0a95f8516478622952e3b8a095285553cb4c8720", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382378, "uuid": "cc8983fb-c8a2-4a22-912e-2c6ff615d4c1", "comment": "Malware payload (Mirai)", "value": "487ea69d3947f1a7c6e0e7e71a2f74d598e34c939807afbf2c795b651a8b67edbb84a3af3e21f3925f1e306f38c0a4b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382378, "uuid": "1cd6c2b5-b2cc-449e-ab87-aa7cb5afc5e0", "value": "T1D334011EA7619DBBD81ECE3B02DA4542409D865A07DF5F2F77E0CA68E38650F61E3C48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382378, "uuid": "a77af641-1415-4ab4-86d8-3429bc6c61f2", "value": "3072:n14ZkyaoWs1R29Frvqm8qR/49qHEkuOSX:n14D1j1Y9UhqR/49qHEkuOSX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747382378, "uuid": "83f613ba-f748-4f48-b8e1-6cddafe249ee", "value": 240420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747382378, "uuid": "4b8297c3-962a-40e4-b479-86a016dce3e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382378, "uuid": "a73b48ac-c441-4430-875e-9e8a86dbb1e0", "value": "cemtop", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff120ce4-32a1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (BlankGrabber)", "timestamp": 1747433179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747433179, "uuid": "ea1fd2dd-c292-4c13-b325-9e1aa5137720", "comment": "Malware payload (BlankGrabber)", "value": "337ee3f038ea8645ed0c9bb3d0350776", "object_relation": "md5", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vgszf", "colour": "#2A4731", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747433179, "uuid": "c388086d-1af7-4137-8a21-7381e05f0c2a", "comment": "Malware payload (BlankGrabber)", "value": "9fdf9e7540e981ffda3d6a60e9a44557fb5e1866d830187fd5415a6d0def7f92", "object_relation": "sha256", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vgszf", "colour": "#2A4731", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747433179, "uuid": "316811bf-eef2-4700-af78-d6f43daed620", "comment": "Malware payload (BlankGrabber)", "value": "050b87087ebcf482f50225e9d4e756e960e8d690", "object_relation": "sha1", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vgszf", "colour": "#2A4731", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747433179, "uuid": "d84d1c28-61b3-4324-a772-80e163d78718", "comment": "Malware payload (BlankGrabber)", "value": "411515d1016a3208ad4539ade348770f535c62e2ebfbc5109ef64d9093da0b08234fa1099eb11dd34b525012be4841ca", "object_relation": "sha3-384", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vgszf", "colour": "#2A4731", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747433179, "uuid": "f15933d7-c37c-4e4f-882c-3b28bfbb9893", "value": "T10A96334577894CD4D8FB943D88834113DBB3BC51AB20DAEB239802655F7B6B06D3EBA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747433179, "uuid": "fa95f73f-14fd-4da3-ba71-0130a45587d1", "value": "72c4e339b7af8ab1ed2eb3821c98713a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747433179, "uuid": "8eafb25e-3ac8-40d1-9259-cb45af3adff2", "value": "196608:HigQHVEcwfI9jUC2gYBYv3vbWQ4+iITx1U6n6q:bQHVEDIH2gYBgDWQfTnz1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747433179, "uuid": "80d7d69a-6c81-4d97-963e-e7adc478d08c", "value": 8662911, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747433179, "uuid": "2869fd74-bd1d-45ad-b270-d56b50e9fe70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747433179, "uuid": "4e034f83-0587-4994-b78f-374c4b12c4d5", "value": "rapaz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45e8e7c7-324a-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747395503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747395503, "uuid": "06c9a253-b78e-4d5c-8dd8-d579b397d877", "comment": "Malware payload", "value": "6481686cb5ff3787f0641bdd5d0d3522", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747395503, "uuid": "e392b408-2c7f-484b-9592-77d05f0c0d70", "comment": "Malware payload", "value": "9ff2ee7a457371de0fc71aad2d581616cdea30763caee65d24d96f741d1fc9f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747395503, "uuid": "c3f6c81b-b795-426c-babb-24c6f79bbc97", "comment": "Malware payload", "value": "24baef72ae91c6ab9d6aff9adbcd203286afddb1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747395503, "uuid": "ca95c54b-18af-4749-b0fd-17757b556035", "comment": "Malware payload", "value": "4b3634ce29ca804fceaedbd68cd03794c07d071b515715e89bd287f25b1bff572913ca81cf58293440359cb8ca4905b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747395503, "uuid": "0cd1b8fb-c721-40af-83c0-72b2bea1d972", "value": "T19493E829472A7586FE5948BB056AF0426C947A2BC0FC2DF3E344F7226912E8017BF7D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747395503, "uuid": "d249540d-428c-4e5d-af14-24f18147cc15", "value": "1536:FzbP0z2w+CqXITZs9TEJVwCjpf7MYkOOEZkRTa8:F3c2bCD7/OEZ2Ta8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747395503, "uuid": "6eddc183-4ccb-4977-9be8-a64f55845499", "value": 92603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747395503, "uuid": "2515ef38-a91c-4dd0-8bbd-fe9d2c0bcd3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747395503, "uuid": "c38620c0-bcb9-476a-8064-2b8d8fe6ebb9", "value": "6481686cb5ff3787f0641bdd5d0d3522.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e353aaa7-3281-11f0-8bd0-42010a9c0005", "comment": "Malware payload (XWorm)", "timestamp": 1747419389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747419389, "uuid": "5e60f25c-d044-43f1-bae0-325baf657ff2", "comment": "Malware payload (XWorm)", "value": "f25eec33d99697fb1bd3d8252eb51f52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747419389, "uuid": "9dce1cc6-5c63-42f6-a4cc-22d1d7f5c51a", "comment": "Malware payload (XWorm)", "value": "a066757dfe3345e1e1fa00ff7257c5ee91251f725e3aa460eac92c17f7daed1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747419389, "uuid": "0d0c2d6e-7616-4407-a1c4-ae42fccda56e", "comment": "Malware payload (XWorm)", "value": "e5745808093271c8ae2ff00b492f9d9375f56598", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747419389, "uuid": "388a1404-9c60-487c-a4b4-16ad12b5c23a", "comment": "Malware payload (XWorm)", "value": "2da5cd022aea765ba57d2587d4da67c2634d879b74efe03ac81785fdbb7cf8a79dcdd41d9027a2ccc7b5505c7c0d54f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747419389, "uuid": "53dfee1e-efe5-4b16-93ba-144015a458a3", "value": "T1B476EE52AFB5290BD7438AF62CB8C2B77D590A74F3DB97D06CD8906544F09036BF90A8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747419389, "uuid": "06a2c32a-bcb1-4849-b32d-6d9f4ea40f67", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747419389, "uuid": "9a71dde7-e001-4c65-8d86-5139a37f2ad9", "value": "196608:30lg+8bHpwY+QiSYKnqmKHc5dUe0XF4YV6XwLuK47ZPiopbt1/Nj5W9IYHi:q8bIdOBqR49lpbPZ5qIY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747419389, "uuid": "d1a2002e-e633-4a8a-acf1-224a895d84f9", "value": 7678976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747419389, "uuid": "6443302b-1153-420e-a95e-3d2403cbf454", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747419389, "uuid": "5a886083-5b00-423c-b92d-26440440d51b", "value": "_!PLAY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72f5f593-3276-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747414476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747414476, "uuid": "e5210fbb-6bec-4abc-a703-3a05dfece119", "comment": "Malware payload (Mirai)", "value": "432868cff491ae8d29d48f4053d4f643", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747414476, "uuid": "2c4ebe52-470d-44ea-825f-9a1fbfbb18d6", "comment": "Malware payload (Mirai)", "value": "a0bd6414792ff26846ee83a37bfcc112aee5a8bdf7b2ecf2d96e4f5c25975ae6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747414476, "uuid": "7196291a-0ccd-477e-ae72-101a5c2c52f7", "comment": "Malware payload (Mirai)", "value": "db23c3dc233af0dc4575e427c57f408f4eebdf05", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747414476, "uuid": "7d7fd065-46b7-4f98-9c92-8118ac8daa9f", "comment": "Malware payload (Mirai)", "value": "147074f1a32e82abc9e2a2e898a6c8ed3954b78d0a8f3ff0044a15bd987b3e748354d2ee77bb93c70fd1db980ab24ab2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747414476, "uuid": "aad81a8b-352b-4eca-851d-6a931548f635", "value": "T1C16302FA0A94879DDF5688314BBE27402E503622EDC3BC29969EECDA2CC4115BC42CD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747414476, "uuid": "1eb37620-ada2-45bd-8df1-bbf131f2018e", "value": "1536:Nrx2yMSNRwGXirc+usylne9IMRl0S8K1sdWTgIUIcVJu5:NMjSIGXYJylneeM2IQVQ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747414476, "uuid": "2b663ebc-61f6-4e42-ab02-442d240f725b", "value": 69896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747414476, "uuid": "d0f918b6-c485-42ce-a5b1-5ece6de23b2b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747414476, "uuid": "11bcbb06-f3fd-4789-90cf-44452dbcba0e", "value": "neon.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7957071-322a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747381976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381976, "uuid": "0f7cdfb8-a560-4a81-b552-d95846dffe43", "comment": "Malware payload (Mirai)", "value": "24cade874c0a85ef870ee0c5741ae809", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381976, "uuid": "38667ef2-0a5c-4ca7-852a-a963e0ff8e07", "comment": "Malware payload (Mirai)", "value": "a109cfdf02893799896d5514d9c1af48a0156549ebff3b07c3975df03abb4c87", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381976, "uuid": "fd7790d2-a835-4b11-83db-cd4b1b03aa34", "comment": "Malware payload (Mirai)", "value": "ebbf10ef76c6ed252dcd12ff4068be41f4b5486f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381976, "uuid": "1d64563c-bf90-44a1-aa2a-1f7e2d0260b8", "comment": "Malware payload (Mirai)", "value": "d4290d0f3d81e1c30968cc70bc3d7b5d6bb0b036173f4bc3ee7d551981135ed44cfc5da7a636cfefb9b13b7dfd9597e1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381976, "uuid": "4ae3e24b-9afb-40f0-81c5-fa31a43918a7", "value": "T1F7E2E102DBEE9369ECDA16361CE7368E5080FE49570485E15BD83A7F8D1163D123B3AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381976, "uuid": "bdf0dd76-ee40-4016-8c8e-6f4606736ac1", "value": "768:AlCJrS1Ppmw/NKnMMPPcN3d0tAeHUuICKwnbcuyD7UHQRjq:0iedIMicNCtAeu6nouy8Hy+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747381976, "uuid": "f746b5a6-c0e0-4621-8be2-22918a1dc511", "value": 32268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747381976, "uuid": "b21c6d0a-9a23-4451-acc8-4a6b6cb45953", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381976, "uuid": "21186e18-849f-42ab-8f73-536a62c9590a", "value": "neon.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65bd6605-325d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Amadey)", "timestamp": 1747403716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403716, "uuid": "d84e8595-8672-4af2-b35e-97a476de7971", "comment": "Malware payload (Amadey)", "value": "9a20e97103ec046586673a7c5069a988", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403716, "uuid": "c680d704-de04-4daa-ba4a-1c410593af90", "comment": "Malware payload (Amadey)", "value": "a14e3571d8bb0634ba4eddfab693cc7e83ccd552b8c93d7b1d49faf964e805cf", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403716, "uuid": "a0d6f101-c3ac-4426-a1f4-0b88eb8df101", "comment": "Malware payload (Amadey)", "value": "bcc9699cff337edab5bbccf9921870c33c1afcc4", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403716, "uuid": "9a654180-452e-4221-9472-d4967e3d1164", "comment": "Malware payload (Amadey)", "value": "8fd5e9d0d097d642ab3e84dac3ec74ac9fb0083ef645dda91f0be3cbb73f0ca35abc2a50849c91dd276a61e53bb8e0ce", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403716, "uuid": "e137ac63-5d65-43fd-b978-6400a5e95b51", "value": "T16D159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403716, "uuid": "c75a8548-96bb-433d-85f3-777dee91a7d7", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403716, "uuid": "4cc67d21-ee3e-4210-85ee-79974ad78feb", "value": "24576:wqDEvCTbMWu7rQYlBQcBiT6rprG8aM+b:wTvC/MTQYxsWR7aM+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747403716, "uuid": "e18b54d2-1105-41ae-8e4c-c4b11717c201", "value": 961024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747403716, "uuid": "0fd35a3f-3ad5-4dd5-9655-4749f6381390", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403716, "uuid": "3626f6d0-b6c8-4af4-9db2-dfddb720500c", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5e2d804-3264-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747406965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747406965, "uuid": "14f7e8cd-2c80-4736-b3c5-ad41213e64e0", "comment": "Malware payload (Mirai)", "value": "833c2011f7bfb193441cc819a971bd04", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747406965, "uuid": "e762d41e-55ff-4037-8cf4-b633ec0027c1", "comment": "Malware payload (Mirai)", "value": "a1ba2d42bf8cd19a13c47b97aad3a67bad34ddfd32aa47baa6bf37ed5e9565b4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747406965, "uuid": "69844089-1fd2-4402-83ad-a3d32bb4f42a", "comment": "Malware payload (Mirai)", "value": "35927a6e23433e5fd978e4f311e41715ce203a9d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747406965, "uuid": "0546fc36-193b-491d-b751-06d46da84817", "comment": "Malware payload (Mirai)", "value": "ade77df8aaa92bd95fdf8b540d0acd5f13e708e222bedb942a708e1e5c87e47edb3ec482670d094e7c59826e84595b50", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747406965, "uuid": "d4a775b8-0e9d-453f-a859-eda249236ee1", "value": "T157E2D169C21927DAFDB3BD443EC4C301B7E40E2F789A8931707197609BAB052E91A7CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747406965, "uuid": "cf897e15-00d4-4324-b429-9a5e4664e6da", "value": "768:Rj01MtM/pY5+ddpdaEbfwKliT7QDPVmx40LxR2LZUOaAkXaYNI4uVcqgw09G:y2MOCdzbfwac7QDPV440n2FUOaA7T4ub", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747406965, "uuid": "c8cf38e1-a10e-4ec6-ade4-5b3bb4d73ccb", "value": 33320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747406965, "uuid": "cb586417-95f1-493d-8d81-6e5900efb0b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747406965, "uuid": "92970050-c425-44c6-9b61-e3958b964823", "value": "neon.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2116db36-3257-11f0-8bd0-42010a9c0005", "comment": "Malware payload (XWorm)", "timestamp": 1747401024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747401024, "uuid": "62e022b0-f0c9-4130-b591-03921f41cc4c", "comment": "Malware payload (XWorm)", "value": "130e74073f34b0b0180ef9285c96bfb8", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747401024, "uuid": "b53978ee-734d-4556-bc60-73288b522dc2", "comment": "Malware payload (XWorm)", "value": "a1d9fda2a10ae47152be318ad8968b9c5c615141ad3d04fe6b3396a4dc3f9773", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747401024, "uuid": "6563adcb-84bf-4690-a550-734f2ac8501a", "comment": "Malware payload (XWorm)", "value": "c0dc32e27397992a279ebf95066e61ca86f1d90d", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747401024, "uuid": "7179d5d1-aad5-4383-8542-512fd925b770", "comment": "Malware payload (XWorm)", "value": "3d29ebde799fe6e4bfcf6aebd747fb9e3204cff5656945e83bd3eab37c2434437853d6fa95aa4796204f8df9a0aab5b8", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747401024, "uuid": "aaa58eed-8704-422e-83dc-2f0efde9e69d", "value": "T12441981BF62AC5B019B135AC5BDF31646FB181A3AB576750C0FE86B7436A4B4E3700E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747401024, "uuid": "ac33b732-8ef5-4d19-a911-1394c2866c96", "value": "24:RAgcW3aTraIlAJnB4GaIUwBkzkzwishashawP5kzrerrshaMshaw8/wnfMWshady:RABWKKy1X+K+WtIn4HWScJ4y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747401024, "uuid": "b15547af-1eda-45c9-8e8a-a5cdda353bb5", "value": 2419, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747401024, "uuid": "4a75bc97-3129-4861-9fc8-2da678ab55f4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747401024, "uuid": "a9b96316-8ac2-4f27-b1e9-fe5887a34906", "value": "spedizione 000-05-734277.VBS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84992876-326a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747409352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747409352, "uuid": "c81676f1-e4d9-4644-8b87-78ecc0655435", "comment": "Malware payload (Mirai)", "value": "061cbd0b48e7393e0a75cd83b7593100", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747409352, "uuid": "6dd8ba67-abc0-42a6-a6a1-4d5a04c2d0c4", "comment": "Malware payload (Mirai)", "value": "a201d91ba3d9513882ee7dfe196d660bbacd23cea39155dd43debaa19d3189a6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747409352, "uuid": "c1614df5-2abe-45d9-aad4-fc6eda5dbc89", "comment": "Malware payload (Mirai)", "value": "9396d1147297abbe5751e253f72e386a5e63f586", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747409352, "uuid": "9c2ab309-9624-4f5c-994e-0bf7156d1f64", "comment": "Malware payload (Mirai)", "value": "b42ef0b956aa4c67b530a21d19d62fad28620c98fc5964f111c7245632f8a0c0757c79915d6491a0df5663da987fdd5e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747409352, "uuid": "b8c09dcf-3386-4741-bfdf-43f3db3d0441", "value": "T1EF433CD5F801AD3DF957EAFE44624A0DBA21721150A30B2BA36BFDC37C332A44E16D91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747409352, "uuid": "37f97bad-8fd4-40c2-bdec-47c5088909c0", "value": "1536:bFyTOn7IOlZFH2x+qEbYbKup7X6Y3fG8ce:bFw02xJEM/gYPt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747409352, "uuid": "c06e0e38-9efb-4356-8066-0517e8037a99", "value": 57244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747409352, "uuid": "bf8931c6-6c44-497b-be8b-2b89c35518c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747409352, "uuid": "6442a9ce-ed3e-4ae3-ad12-913b5a100ee6", "value": "kwari.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "713dbadb-3241-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AmosStealer)", "timestamp": 1747391710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747391710, "uuid": "0760a764-422d-4e17-bae6-25dda6f853d4", "comment": "Malware payload (AmosStealer)", "value": "88a352776985c1198eb0facdd9549710", "object_relation": "md5", "Tag": [ { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "security-check-u8a6--com", "colour": "#68A0E7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747391710, "uuid": "dd3b1461-f629-484c-b521-c853616bda8f", "comment": "Malware payload (AmosStealer)", "value": "a2058f4a76d2db437332fa8b2b5032eaca1f96906fe08e7a712347b7d551309e", "object_relation": "sha256", "Tag": [ { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "security-check-u8a6--com", "colour": "#68A0E7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747391710, "uuid": "5b277c7c-0721-466c-8f0c-0f2fdd8fe396", "comment": "Malware payload (AmosStealer)", "value": "08cd5fef32812707b3a2d399b9e999f2c81449d1", "object_relation": "sha1", "Tag": [ { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "security-check-u8a6--com", "colour": "#68A0E7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747391710, "uuid": "7c6487e2-5602-4b8b-a2bd-7bc2d39bb89e", "comment": "Malware payload (AmosStealer)", "value": "e5d89f66bfe37ed9959147fe23801da6084cd920cfbacdf7450a9849f54168ce1807a803a40a4e0080f3ed1586451ae1", "object_relation": "sha3-384", "Tag": [ { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "security-check-u8a6--com", "colour": "#68A0E7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747391710, "uuid": "379ed655-5736-4c80-a82d-924142c795e4", "value": "T12DE4019CF6C0BF1BCD6705BB201A169505DCEC9123A1C787E6519B3B3D60BBC1C2B99A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747391710, "uuid": "0af2576f-424b-4bb8-914e-dcb7f8d44290", "value": "6144:IRkuaT7A6M1/UbFTcWnq8YFUY/IN2sySadNtsDIEurgIaBxEKJYmh7YJ4DZnp7H+:/T7S+2WniUHpFCbtMpVU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747391710, "uuid": "6072724f-919e-4090-bd0c-188474ee9322", "value": 719984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747391710, "uuid": "fe9c082e-322a-4202-b075-96a0027ab34a", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747391710, "uuid": "e834bf6c-384a-4215-894b-1a7e39078695", "value": "a2058f4a76d2db437332fa8b2b5032eaca1f96906fe08e7a712347b7d551309e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abe9580f-322b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747382359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382359, "uuid": "3fe6409a-2aae-4f19-944f-a0814d8a3e08", "comment": "Malware payload (Mirai)", "value": "fc4bd4b5eb7e26dd69812d7867e11a17", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382359, "uuid": "24f86be1-2e1b-4d8d-86c9-6b66ba46e53e", "comment": "Malware payload (Mirai)", "value": "a2423d243d48bf6bc7de48bd3749dd3aab91afcd146e5c3e12142340e1cdb8dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382359, "uuid": "b821eadd-1bc4-4b2f-9a5a-f3580925537f", "comment": "Malware payload (Mirai)", "value": "5068d5fff25445fb85828443d3c6f9846c2d5c9b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382359, "uuid": "a648abba-a6d0-4c48-877e-0123ed8b5ec6", "comment": "Malware payload (Mirai)", "value": "948497e83d07802801055e0e8578d70863fad92d309076b213880ef93014432c60882bcd9497da3ad1a89a705f816035", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382359, "uuid": "550b6c1f-53c4-4781-8d08-d75fe1954d02", "value": "T199E2D0A5C5BB9AD8E41962B40C7777024120934CF402D7DDAECA244FEE63F792AC984D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382359, "uuid": "1b7d0575-8154-4316-8ed7-0d80989274d1", "value": "768:/ll+UryRKiYM2hv5D8lmxLRQ5Ho8iVXMAOnbcuyD7U9UcA:9l+0LztKmxLRQ5HoZJonouy8S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747382359, "uuid": "79d91310-5973-475e-9443-62a1743652f8", "value": 32424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747382359, "uuid": "01e87383-ec57-4dfa-be35-8f06b60d3a81", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382359, "uuid": "71a199af-d9db-43b5-856e-b9394d69134d", "value": "rift.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "528c9862-3297-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1747428595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747428595, "uuid": "5fcabbab-4c6a-446a-a274-eba29efb9b7c", "comment": "Malware payload (Prometei)", "value": "5359f16c49c10caa82e5451a93b561aa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747428595, "uuid": "4651080f-ef0e-4675-b717-9b827b543f3c", "comment": "Malware payload (Prometei)", "value": "a2b3aa78deb855a6d67e8e7c0dfbe9376222a8f533ebf686484f2b6bc5c4dda2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747428595, "uuid": "ad174087-12e4-42a0-9584-99e2941fc30a", "comment": "Malware payload (Prometei)", "value": "1a2dfaf18e0d51e60771ea7e77bc944ac72fe86a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747428595, "uuid": "d741a4fc-dbd2-44be-8d6e-5d37e4765222", "comment": "Malware payload (Prometei)", "value": "1c62f975d1c812bb41751198cd277d2e32aebd51dd82a3db93e445cebc7960b43fbd8f57333586bbb77b34ac4f1b444c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747428595, "uuid": "b1af725e-4674-43c5-b39b-b6bb0fa76f5b", "value": "T1F69423F8C87D2E3098169B3CBB1A826CF0E15772D9562F6AB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747428595, "uuid": "ca0c77d9-fa0e-4310-81e9-aacd2d2d14e4", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgu:25WOSACZSV6eKRH5EPiamb4DsDwwce", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747428595, "uuid": "3e9b9003-1aab-4703-ad85-f4b1cf928305", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747428595, "uuid": "8487765a-4cb2-4b03-8823-9ae1bef836d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747428595, "uuid": "9f6bcd6f-b897-4de4-8a5b-8724fc2ce27d", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d87cddf9-3270-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1747412069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412069, "uuid": "a8682f04-731f-4e91-b936-890b6474fb42", "comment": "Malware payload (Prometei)", "value": "c9a7f5571b73f43dfe9e905ee005b12c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412069, "uuid": "fc755496-ed7d-4a59-91f6-b97cf581ac4c", "comment": "Malware payload (Prometei)", "value": "a2fb1a77b8f30059c1d90112e9343fc35d01b9b598fc191f979129e9e09428a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412069, "uuid": "c63daf84-02e6-462f-b687-1d447faa3b37", "comment": "Malware payload (Prometei)", "value": "f8bd6a050245ef89550695391103563b34b66c6f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747412069, "uuid": "a61e4b9f-2bb3-4ee3-8f6d-d99f9e3f24e7", "comment": "Malware payload (Prometei)", "value": "4eccc3aaff9056781d7d9772f2f28c778f78fb5c23039b41bace817d5030fde37de0632682d8af9c1b2e4eb67ed38b29", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747412069, "uuid": "9d991880-ee55-4369-9f6e-a54b849d8760", "value": "T1339423F8C83D2E3098169B3CBB5A826CF0E15772D9562F6AB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747412069, "uuid": "020a61d7-8f9d-44f2-8bd0-579a97534cc0", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgi:25WOSACZSV6eKRH5EPiamb4DsDwwcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747412069, "uuid": "c54126a6-89f7-4096-accb-7b65d1246852", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747412069, "uuid": "b51bc496-1e10-4d72-850c-4b65651fd3d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747412069, "uuid": "c5535b08-2514-4965-a414-3ee782c779d1", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acf130a0-3228-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747381073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381073, "uuid": "cf6a7f4d-610d-4244-92c2-6a6dd824ad87", "comment": "Malware payload (Mirai)", "value": "debf9385629fbce1c2e4f0af7415631d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381073, "uuid": "fc79a436-33fd-490e-8cad-e36a4133d187", "comment": "Malware payload (Mirai)", "value": "a31a2b7354cc9303bd709a27f912a9a59b71c8ea6d3cac63c39d8c543dfeb0f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381073, "uuid": "42080565-759a-4d00-90d5-3fa45e3dac35", "comment": "Malware payload (Mirai)", "value": "401663fb40ef4ec18b1864ae70ca371843f7be7e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381073, "uuid": "a419bc8e-9a70-4ffd-ad5d-717365f9b744", "comment": "Malware payload (Mirai)", "value": "99265180a7f864f71211af48c94f8051ab0ad9d084d7e267fbeea14d290701d9a58cab2e3a867867c0b098abe148e126", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381073, "uuid": "aa362897-057b-41e6-bf68-468528180299", "value": "T1E53302958679ECF3C05E1A35E638180EBDF70496F099947B2F9800389E95B0543EEBC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381073, "uuid": "88d49b08-d3fa-477d-9701-87cc437afc2a", "value": "768:yEMLyhIvCezTQRlkvdycM35AlhsEj5WWhFoF5P3DnZ3UfZZidbTQA5UvtD0F:RqlmXJohZjwWhmHPzCZcFT+Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747381073, "uuid": "261cb9fc-3d70-4ab5-b7d3-9f44a2b3a3ae", "value": 53924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747381073, "uuid": "e9a6531d-5ade-4280-a4f5-d7fd5d371d66", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381073, "uuid": "bca2c590-764c-41b7-8d1d-88650525ec9b", "value": "rift.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6de9b361-328b-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747423487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747423487, "uuid": "07528380-0a6e-4bb8-8098-b8536a90acb8", "comment": "Malware payload", "value": "724b92aa269520b337412147de21ede6", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747423487, "uuid": "8934a5b2-3ee3-4835-aaec-c31b704ad1b7", "comment": "Malware payload", "value": "a39d871178b3d3e7edea2c16c27685b00cc202baae95f8a5f20c748dabe2b47a", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747423487, "uuid": "4a64df62-326e-48dc-a90a-31d0f54af857", "comment": "Malware payload", "value": "98c9c024e56c98a413b3308cfdf14eeedb262923", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747423487, "uuid": "22405f84-7fb6-44ae-91ec-937da5ea3682", "comment": "Malware payload", "value": "ad6c87238d34946fb239b41ca77b1aeb58dabd8e6759b375f9f96cc4cdff201d2b6f25d870bb4de8525c1798a5e0e412", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747423487, "uuid": "4da1e7a0-9953-44c9-ba68-6ca207894ccc", "value": "T160F054EB0D43C84DFA50B102EFD4B3A49885C05F246C882691ECA9B8B8367AD8D06974", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747423487, "uuid": "40c98c67-d0d1-47df-b687-3177c2b19486", "value": "12:kxvsCk9cE3MotZjo/XUb0FJHQFnSo/5OFBYI:kbxw8/kbkQ8oUOI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747423487, "uuid": "644b7313-0d39-4e40-84e5-0788672bfe2e", "value": 496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747423487, "uuid": "f499e5c1-e09a-401e-b612-05270245d716", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747423487, "uuid": "dbd6709c-1a2b-4b93-a4ee-f8db92554ac5", "value": "fuck_niggers_10.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9867c444-328a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1747423129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747423129, "uuid": "b3e6373a-4faf-4f9c-aa93-94303f846c1e", "comment": "Malware payload (LummaStealer)", "value": "7991da32dd4e19427fef96554c00f4bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747423129, "uuid": "71375c60-8caf-473d-a551-6bfc1f8fe0f3", "comment": "Malware payload (LummaStealer)", "value": "a41450093961f95d046caf4ed1e1160b268404bc980c7b411df8f36b8545ae49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747423129, "uuid": "de0b4eed-769e-4391-af8c-5a6b762672a3", "comment": "Malware payload (LummaStealer)", "value": "9a4b7a47b39501679cf11c6cfa216abf982dca05", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747423129, "uuid": "78b4f773-a8a2-485c-aa75-a4ba2a03517d", "comment": "Malware payload (LummaStealer)", "value": "f0f861ca438d42aa1786a862ad42b92deec0f687a6191537b945ae3a67453cf7c4177345ac7a207f5c83bf426e4ca3a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747423129, "uuid": "408e8b2c-584c-4121-8dd8-ca2e241fa80b", "value": "T16985330A1B3FC5E7D4A0A9B1C21B836A97385F1B4BF4D9EC05B81435CC9687617F2B98", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747423129, "uuid": "6ad5941c-ee54-4959-bbbf-49a92d98e373", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747423129, "uuid": "30abecfc-5a88-4aa0-ac27-15e09953d529", "value": "49152:OPSN1hhnmjMZoD46Q0PS/nhzqAlVdsTWitPmlJ:oernzjw6vhzffd4WitPm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747423129, "uuid": "7d54a773-5a7f-491e-8abe-62cfec7a2bf7", "value": 1866240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747423129, "uuid": "45a541e5-6d79-4b87-8f52-0f7bd8ac41f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747423129, "uuid": "f44d6c18-e8e8-44ab-aea6-bdb0831ff511", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a06237ea-323f-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747390930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747390930, "uuid": "b5b89004-6849-4d54-ac7e-f24b591ab4b7", "comment": "Malware payload", "value": "16d882d793071a9966c6442d0ea8ecf2", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "workers-dev", "colour": "#85F7BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747390930, "uuid": "391ba1b9-50e5-44a9-865e-6b1e64a43026", "comment": "Malware payload", "value": "a423d27a9ddcfa81ead8df1d56cd675f41176dfc89c39f6445cd8c9a9c7c9714", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "workers-dev", "colour": "#85F7BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747390930, "uuid": "325a1c0d-2878-4405-aa84-39fa7a53e6fc", "comment": "Malware payload", "value": "475d2753d5ad301a45158c170537778fea7f1d07", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "workers-dev", "colour": "#85F7BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747390930, "uuid": "33d15c76-d5e0-472b-b384-d0674ba0dc91", "comment": "Malware payload", "value": "c1576d53ea4b1c7225aa11f0dd4b3ed141834c35e5521c26f0bd8e5343d11ecc9a6699ab8ab1436391eb831eef032330", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "workers-dev", "colour": "#85F7BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747390930, "uuid": "c0629f03-45b3-4c12-8621-a36db1caced6", "value": "T156D273C79F4BA23986362340B31B5C8D529212A4F1F8B0937897BDE557B7D98824B0FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747390930, "uuid": "2d150db6-9391-4189-8177-c90d6737329f", "value": "768:XNu0NKC++jAARlVZHvKPZJ2cRmmsRTkE2Y86hThYCThkTgz6I2NPM4:XfgC++jbj3R2Tgz6I2pM4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747390930, "uuid": "e2e30a41-259f-4139-81c6-e6299582c520", "value": 30713, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747390930, "uuid": "9fc246b2-56e0-4594-be52-2561f7c84b55", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747390930, "uuid": "589efc2f-3877-4cfa-95f9-e50ad10df7ea", "value": "tmpECC4..vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b502c83-327c-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747417067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747417067, "uuid": "0801c607-97cf-4bc6-9a9e-c5a26a66602f", "comment": "Malware payload", "value": "3c4be75ae068bf63f61d58c7f33e5f12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747417067, "uuid": "5a34dcf9-bb4c-4976-9356-05d2b09173dd", "comment": "Malware payload", "value": "a432d2febf24c254134f6e22764c4b7651df20cca6b243458376b7a6f364a766", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747417067, "uuid": "da1db1f7-fe1b-4e54-9926-d227bdb99c9f", "comment": "Malware payload", "value": "14199ce2901425d9d7b8f5911de003ba7188cc9d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747417067, "uuid": "933b1956-e984-4c4c-b48f-56c4b4661e0e", "comment": "Malware payload", "value": "bbf76a5dec0cc2df7fd35299fe30ab81b86880f561e65e90d0f516f7efea463e71e25f08cc8afe741bbf248bf18ad388", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747417067, "uuid": "0f31941a-9ec1-4106-940e-6da93218bf70", "value": "T10CC60266C7E48226D2A2123FC567D53F94EE0D942B3723ABC1C52D6B39233F46E315A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747417067, "uuid": "0a0fa8f6-34da-41ef-a2ca-db7717d6fdde", "value": "f67c2d48a0d9fae633478c7ae08a5655", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747417067, "uuid": "0b0533b3-536f-4540-a355-ad8e78194d6a", "value": "196608:yihuX4EwNL3RgJR1m2ybTAxvVCpEZapsLPDYhUj9tyE9+V6BMR:rhz52y/4CuZ2U7yEgca", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747417067, "uuid": "dfedf904-1f58-4e90-aaa7-b4c53f2177fd", "value": 12161087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747417067, "uuid": "9bee3010-ed53-4ccb-8b57-40d483a71966", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747417067, "uuid": "b41ca985-ad98-47a1-b1b5-2c616104b4d4", "value": "speedrun.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd9b940c-3234-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747386281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386281, "uuid": "f3bb7e3a-a3f4-4ad9-b91d-e45209b955d7", "comment": "Malware payload", "value": "e620487f02c11a4c3406ec83179e7b36", "object_relation": "md5", "Tag": [ { "name": "196-251-90-185", "colour": "#01F3BE", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386281, "uuid": "f6b293a5-a9cc-4c10-b910-406086429785", "comment": "Malware payload", "value": "a4d939918d8b85026e06d1afa3da0f9d389182948176b83419631a522718494f", "object_relation": "sha256", "Tag": [ { "name": "196-251-90-185", "colour": "#01F3BE", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386281, "uuid": "64959f28-0bff-49ce-966a-cb0e8ca8c6ec", "comment": "Malware payload", "value": "db2daeaf5130999c9a16673918e7cebdf6e40059", "object_relation": "sha1", "Tag": [ { "name": "196-251-90-185", "colour": "#01F3BE", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386281, "uuid": "7e69cf86-2282-4e55-a82b-87bd8a645555", "comment": "Malware payload", "value": "fcfcd97740d165eb4de69957acd3603835d77cde63ab3280833650c377dd23d465ce52f968d257ccd1632a51ccb20a49", "object_relation": "sha3-384", "Tag": [ { "name": "196-251-90-185", "colour": "#01F3BE", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386281, "uuid": "3c4d55b8-c79c-4a1b-bbba-411fd5061313", "value": "T11092EF8576C07491038B99FF763BA0D5F27A2CD835C51C47E214EC84F5A162AEEA3A73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386281, "uuid": "1f9081b8-5c68-450f-98d1-e63cf53af714", "value": "384:HpN0J6aZXunIHhpwwmKSbIGMVYqJc1oMo10FjP7L+grTj0ZvFhTLcLiyc7r7d7le:HD0J6aZXunIHhpwwmKSbIGMVYqJc1oMl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747386281, "uuid": "bd41eed2-c314-4657-bae3-edd4fc2ee522", "value": 20017, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747386281, "uuid": "60c6f25e-7336-4633-90bf-c26804c4fd85", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386281, "uuid": "86749d50-9567-4ae2-be8e-2228f81f4d45", "value": "Husqvarna-DOKUMENTS.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad4b5f8a-31f0-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1747357021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747357021, "uuid": "11200d0e-5dae-49a9-b87d-0f50e53a6344", "comment": "Malware payload (Prometei)", "value": "408bf49006c039275212eedc7b51193e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747357021, "uuid": "7e3c7ed5-08a7-49b1-80f8-7b95055cba88", "comment": "Malware payload (Prometei)", "value": "a52020d1b8d75f7abe5ed380f884d2cf374739601976e4111cf08939e08f54dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747357021, "uuid": "cb626ec8-4407-4661-8a6e-e5970d8f4ef9", "comment": "Malware payload (Prometei)", "value": "1981cf7df3a10bf2d06fbdc5d16b613d483d3502", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747357021, "uuid": "8bc6e4e8-5b71-4254-bcf5-863f2db17f10", "comment": "Malware payload (Prometei)", "value": "66ff1e7c38f4ff7c33cf0cd4f5f607c5def331eb8853f7d93fe7edf86128b3f64b899ec811a6b9b8c35ea24d405d04b1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747357021, "uuid": "ec80d52e-74f9-47dc-95bf-177de67b9007", "value": "T1859423F8C83D2E30D8169B3CBB5A826CF0A15772D9562F6AB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747357021, "uuid": "6f2ebea5-e88e-47ef-bcb4-4c259d882ebe", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgE:25WOSACZSV6eKRH5EPiamb4DsDwwcU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747357021, "uuid": "c6c9d1ad-de59-43bf-b574-b8abb3d97a5e", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747357021, "uuid": "419f6baa-a3be-4fca-b967-b78e3816f4fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747357021, "uuid": "49dadf28-7edc-4a3b-98ce-6ee7026b3102", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6a9c3b2-322b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747382377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382377, "uuid": "b5776e7d-98ec-4818-acb2-5f98b27ea58c", "comment": "Malware payload (Mirai)", "value": "2e635b546e9256edf084e841b1534e0b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382377, "uuid": "2b1f0dce-93a9-47e9-9453-061bc26b5639", "comment": "Malware payload (Mirai)", "value": "a60b10464643d4591bc21d9054247a46c158caac37d13df84e1bd55a444bb18c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382377, "uuid": "6f758a28-6dd5-4597-87ee-2c47ac673914", "comment": "Malware payload (Mirai)", "value": "302279b257e8af0b76f960878e6df489a8a99307", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382377, "uuid": "42e83360-4ebd-49ef-849d-c8aa5d8e36d7", "comment": "Malware payload (Mirai)", "value": "70ee4510b09a74167666553e28b5f8548e32f1e8d7326458fa9dd67e38830430215a3c09e4def79076db5fde8136c597", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382377, "uuid": "da035735-d6d7-4427-9126-00cfc8c6ffd9", "value": "T168D34A46EE818F03C0D5177ABAAF424933229765D3DB73079D285FB43F86A9E0E63605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382377, "uuid": "9e5b034d-320e-4f99-9c83-63632d7ffdb0", "value": "3072:b2N8tJS98/uHv8BFVlX0CTgb7SzM/9Lqfe:yNgSGuHv8BF7X0rb7GM/9Wfe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747382377, "uuid": "38dd6a95-7cbb-44c5-9cf7-3e23a8d08f11", "value": 131489, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747382377, "uuid": "63bafe11-009f-4bf1-9d12-1b46bd0c12f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382377, "uuid": "c5910fa8-0387-47bb-99e4-0d2b33629d53", "value": "kwari.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09298d7e-3236-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747386811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386811, "uuid": "cc4826a3-2171-4d5c-9785-7c540c7e1ad1", "comment": "Malware payload (Mirai)", "value": "c18eb02f1507a553e48fbef7868e6211", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386811, "uuid": "74405c9e-f515-4693-916a-7d638750c67d", "comment": "Malware payload (Mirai)", "value": "a663777b8cf4c36125f7a8b2e941e7a60b1048a80f9774d90e50d5d109ed5e80", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386811, "uuid": "a26c4317-4dab-4d24-b370-fa3ade7b97e6", "comment": "Malware payload (Mirai)", "value": "b38c11d461e9680bc30ea8314d329675223210cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386811, "uuid": "c85c73e6-56a4-4e14-9e14-aaab55441343", "comment": "Malware payload (Mirai)", "value": "9838649f21ba1126c183b825a0db17a3064da23e3c44a09b6b04ac929e1d14c488d71b8f904fb6bd59e884835c4ef778", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386811, "uuid": "5cd94f78-0edd-4848-a52f-3292a7b30356", "value": "T17A82CF64B10DB9E2ED2014359C5CC7CA32EB117DA4F9B53772044BA36EC554621BDF8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386811, "uuid": "0364ea3c-8a9c-4aab-a0d6-f8c02c365af0", "value": "384:m3pm/IhYgnyBludCN6JaINpCoRIIJihKYug7HIeN295FPGUhymdGUop5h2g:SmQ+gnuMCNka6pRi9BIB95FPGUs3UozZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747386811, "uuid": "7c7a19db-2c41-4284-8e8b-1d47297d1dee", "value": 18360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747386811, "uuid": "c1768aab-2a16-41a3-9531-96aa42b36ed1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386811, "uuid": "976b28bd-10f5-4d6e-b5e9-f57a6e376a68", "value": "neon.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f8e505a-322b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747382285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382285, "uuid": "b4b2b926-4e09-430a-8762-5d2bd8dc6f4b", "comment": "Malware payload (Mirai)", "value": "0af1a8f2f1127ac1443a08f2d43620f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382285, "uuid": "b4a6c31a-6e33-4b3c-a653-01f61bf4837c", "comment": "Malware payload (Mirai)", "value": "a67aa377be1269b098ce6a0d2d3322028693e98d6d4f522ddcb62e026380864e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382285, "uuid": "1797a118-d211-43b5-bb96-0357d12d13c4", "comment": "Malware payload (Mirai)", "value": "6e84835f7c80ceadf548755bfdfd4568fdf7c3ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382285, "uuid": "b4120c8b-1dfe-4adc-a74a-ac24b57de868", "comment": "Malware payload (Mirai)", "value": "896acfdb196d7524a1805657da1fc2d8f809b7ef60857a1eaf2e785e242deaa0f47df379123ee49322b54ef3112dcf62", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382285, "uuid": "b604673f-16d6-4f28-a474-8cad08306151", "value": "T1A2331951B8C26667C2D013BAF6AE968E373073E8D2CF3227DD611B113A8512F1DA7E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382285, "uuid": "12e00725-1575-421e-be27-9abdebe8bdfc", "value": "768:Mtn+Pi2RhlZoIip1jIs44nHsX7+qP06Fz20AVOstYvSF4Xgt2FgNJwJZY10U6:MX2R3ZNiwaAFz20eOaYvSFGJa10X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747382285, "uuid": "fbface5b-5d77-4114-b949-9a385f52319a", "value": 51716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747382285, "uuid": "5214c7cc-bdb5-4f27-a671-eea0873baa53", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382285, "uuid": "0169a1db-470f-4b95-a7c7-28c963782150", "value": "RpcSecurity.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37718ef5-325b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (MassLogger)", "timestamp": 1747402780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747402780, "uuid": "3a531b98-86dc-49ea-88e3-2ad4152ee5d0", "comment": "Malware payload (MassLogger)", "value": "49873856d4e04dc0f914f0e12669962c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747402780, "uuid": "7d187cfc-69c3-4c00-9f18-0214ca68e2a6", "comment": "Malware payload (MassLogger)", "value": "a69be32fb635f7404ca85fb8799148c3d96fbf305888e336da83f57e4928ff6b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747402780, "uuid": "f80dd9a3-a22d-4dca-8cbe-eee8579175da", "comment": "Malware payload (MassLogger)", "value": "8d72fac2975e00f82075f9dc43e230960690225b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747402780, "uuid": "2e5be414-33e8-4ed4-aa12-05c4d58c240e", "comment": "Malware payload (MassLogger)", "value": "b6f93eda776eac0e2d1018c515a43a61600279b651a28a7d2322f0e2d022347e63975c9c4aad0c30292ef47cf11222d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747402780, "uuid": "66e41554-2311-4022-923b-bd37412f0c49", "value": "T15BB40128321ACC17D4930A710D72E3F847BA6E8CA811CB8BAFE93DDB7DB97456541342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747402780, "uuid": "7550e471-343a-41ec-b86a-130dd3b47f17", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747402780, "uuid": "544c66b4-b547-4345-8f6e-d454260ddbf1", "value": "12288:YpMJEZJNe7kmZNTFvLskCY3O/qMrqDp2/IGILCLl:IbQZNTFvo3+O/fuDpUILgl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747402780, "uuid": "2a7823ff-d572-4e88-97f7-d2bd20b227a4", "value": 540160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747402780, "uuid": "316245ad-0f0f-40f2-a436-0b1f409122fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747402780, "uuid": "a9c4c40b-d6de-4625-afe2-bc7d7d89a3be", "value": "FedEx Receipt AWB# 79771047.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34932689-3202-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1747364550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747364550, "uuid": "804b98a2-c91a-4508-b68b-11cf9789afb0", "comment": "Malware payload (Prometei)", "value": "c6c82715dcb45607f68dcc0ab96c6334", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747364550, "uuid": "d70b2420-fce1-4127-9106-2c6f36fd87e0", "comment": "Malware payload (Prometei)", "value": "a69d71ad3a8374e29d201ae0da42fd3ca918334433f488cf5ca73c4f0d6cda17", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747364550, "uuid": "9d8a056c-9f4a-43cc-94e6-eb780aca9656", "comment": "Malware payload (Prometei)", "value": "23a31343c5562a25450fe94cf966a32a36e082da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747364550, "uuid": "4d1be843-686d-42a7-b417-22de42d20e6f", "comment": "Malware payload (Prometei)", "value": "affd635cfe490eee6eafde94f353382ceead2c23e264b006b462593474f26214ead6146b2198f0e7d956518f1cacf7fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747364550, "uuid": "4dbf9a28-c96f-4632-b5ad-2df35ae12239", "value": "T136155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747364550, "uuid": "99e6e863-700e-4c9c-87d1-e9c1105d631d", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8MplI:qmShf4OTjMgXSJhBXEsVrmz9MOup1Kh/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747364550, "uuid": "5d4e8552-f15b-45e3-8c2f-99dad25e5f50", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747364550, "uuid": "0f65bdb4-d60b-461f-a91e-478d2c6193d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747364550, "uuid": "0a2a91ee-2ee5-4078-a139-911594d3e1ce", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b04b17ac-323b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1747389239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747389239, "uuid": "aaaf293e-14b6-4715-b663-1b9e623f6ef5", "comment": "Malware payload (Prometei)", "value": "67a9f67aa1fb10e5763cf9945aefbed4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747389239, "uuid": "059aae33-3a27-4264-8f92-4fdd885d9e73", "comment": "Malware payload (Prometei)", "value": "a6ed7b5910642bc38ab3fd0f048d228634d2884fdce7ed6b86d9fac485f5ef5b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747389239, "uuid": "db6c562e-02a9-48cc-a0e1-aa5bf71ec3b0", "comment": "Malware payload (Prometei)", "value": "9c8dee4f5753ac7a4978f5380e483a0dbacacbea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747389239, "uuid": "3dd8ab3e-be8e-4fa7-8bf2-9faa1ca618f9", "comment": "Malware payload (Prometei)", "value": "4f5a1f21ee8dd43babf951199fd8f68db0042aa5615f917d8e16fa3e7c18b5c173df31e34ab16bf9ac0f1f4b26e4c23c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747389239, "uuid": "d894d7c9-dc05-437b-bcd4-60a4c74818e4", "value": "T13C9423F8C87D2E3098169F3CBB1A826CF0A15772D9562B7EB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747389239, "uuid": "bd217489-be6f-498d-a5ae-92f4e827a623", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgi:25WOSACZSV6eKRH5EPiamb4DsDwwcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747389239, "uuid": "b09b18cc-450b-4955-b41d-466fc950f061", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747389239, "uuid": "3601225b-8578-4899-a3af-520cc4d67588", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747389239, "uuid": "182fc51f-4c91-4102-9c67-76f14a5f9766", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdb74a8d-3222-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747378631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747378631, "uuid": "a1384d1e-2887-47a5-8a1c-17c1e18c7241", "comment": "Malware payload (Mirai)", "value": "847dd9f553654108a6335842c05bd94f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747378631, "uuid": "7ef00313-e713-497f-9c3a-1e3b7713a96d", "comment": "Malware payload (Mirai)", "value": "a7b1a0ddf614c74c574e689a89e9d656226019351d87950fc2b62e9734c36f4c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747378631, "uuid": "00c59f27-9555-4f7b-bac7-dbf443597be7", "comment": "Malware payload (Mirai)", "value": "aa853b40af8bd8bc839a6f604d07cadb8b7cffde", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747378631, "uuid": "50aa0c7c-9cdb-4ab7-a3bf-c641e1c9d1f1", "comment": "Malware payload (Mirai)", "value": "3f53dc96d4058611fce06a4534cffb2022e805c5bc28c4b8ac4af52891b93e3cfa288c513c1264153bcda775570c00ff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747378631, "uuid": "fcd24622-f27d-4ab3-9873-144bfe30a3fa", "value": "T178230B95A8012E3CFD6BE5DD41211B1DED22363074B30F1B99EBFDA31D721AAAD0AD41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747378631, "uuid": "b711412e-2720-4a64-824b-439df2104dff", "value": "768:sPBaz0tMQaaZ261DmbgiqJNS5LhZFGG7kdbPLzty/+9uQ8yhhf:s/vi5Lh7GG7mbHA/+MQ8yhd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747378631, "uuid": "191a59f9-f843-4e15-b8ee-3122ccf3b1fd", "value": 47521, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747378631, "uuid": "9d8f76a8-3d3e-4427-85e3-bbbf71052578", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747378631, "uuid": "ed6d87d3-72be-4644-ac24-e7fde53b9024", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a137dca5-3228-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747381053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381053, "uuid": "9073e3d6-480d-45dd-ab7e-0d1b977120b8", "comment": "Malware payload (Mirai)", "value": "dbcd606d40cd888e13225407d06d2ba7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381053, "uuid": "a0b958ae-c5c2-4fd7-8216-5920a81b91ed", "comment": "Malware payload (Mirai)", "value": "a7c25002b7de4f6538321d73f843cd82ed15553d14ec4d8d7c035d73cd2cc92d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381053, "uuid": "64bb209a-1671-4260-8707-88f1f4863df9", "comment": "Malware payload (Mirai)", "value": "9c1c670446c894b1ad88bdd9dd3963231e6c5191", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381053, "uuid": "48f64049-520c-45a5-bb45-b6bb176b8c15", "comment": "Malware payload (Mirai)", "value": "d468c4d8005b5fa8b5a3ed63a49128827b4877acbef153e438659e088d302e2888a07a0995f16df2d101f70becb03846", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381053, "uuid": "e2bb4f1e-2633-4c94-907a-c4fa23a6f6a0", "value": "T1D1937CC0F683C4F2E84305B1507BE7379B32F1B9101AFA43D3699A72DC91951EA1AB9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381053, "uuid": "ad703671-18c4-4c8a-9dc4-309f5d472989", "value": "1536:W/QCZaxGdvts3i5JPhoeIxPu++ALtgUIKqI4FrS4LSy:WYCZa8dvm3oJPhTIxP5htSKfUmDy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747381053, "uuid": "dafa4066-dde8-4c54-942e-eb0d4b6d12dc", "value": 89992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747381053, "uuid": "f65a39f0-8a44-40d8-bfa4-df17809d7283", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381053, "uuid": "ddd3a173-5538-46c6-b68b-e974802b6c13", "value": "main_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c64434ac-3228-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747381115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381115, "uuid": "23bb604e-6304-4f92-831f-65287981a8ba", "comment": "Malware payload (Mirai)", "value": "0cd3ef9fde6e29a18442aee48da7968b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381115, "uuid": "47950611-9f54-4092-b631-80c8c2584541", "comment": "Malware payload (Mirai)", "value": "a7edf4c1692c6ff1ed21e59c6a4a3d9ba2a16379d9ce5808119811f1aa4a02ea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381115, "uuid": "5b20d8da-06a0-47f5-9afe-9225b465308a", "comment": "Malware payload (Mirai)", "value": "e9ae3b98ec1a12e5a7ed09c304224f2d6aff660b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381115, "uuid": "31e3fb16-ad64-4798-a09b-0720a9c23371", "comment": "Malware payload (Mirai)", "value": "9623bec775c4d3f1d05de3dec47449fa5d97fd46c0a30abf993d447a8f8e5e3bab41ecdeb71eab111d795626cfa4250d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381115, "uuid": "b9020d75-58dc-4548-a829-f5575dbda249", "value": "T183531B89B4019E3CF84BE6BE84320E09FB35735525A30B2776A7FDD35D721684E86B42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381115, "uuid": "f2149b37-3941-4e09-81b6-cda8d6293a36", "value": "1536:ShyW98iXe9Y2MY+VkkTLUOQZe48vv0Pw28uwhaNqHi8OCf3:Sh5ToOSj8EY1xiBU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747381115, "uuid": "a97b0047-4290-4dff-9cc8-3bbe784bc341", "value": 60892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747381115, "uuid": "bea02a87-eb67-454a-9e82-fbd6297c8a50", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381115, "uuid": "d9a59840-2361-4f6a-abca-c520dd2b8d9e", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c757dfc7-3236-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1747387130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747387130, "uuid": "583b9056-64f9-455e-8663-f1976c31d3d0", "comment": "Malware payload (Prometei)", "value": "17b3b0c2d4db1b971b4ea1d285889978", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747387130, "uuid": "2e7b36ec-ac4e-4126-89b5-265e31eab356", "comment": "Malware payload (Prometei)", "value": "a8091dfe4e7dcf022451b972214641b280ce3d20128c7005ab03fa9c7177903c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747387130, "uuid": "a07793b8-a9ea-43b8-b725-3d8c961d1696", "comment": "Malware payload (Prometei)", "value": "b8a40289969ca4c4c50c889384ebb2fcf19d139b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747387130, "uuid": "0005de5b-d894-4016-9bd3-8e5547d5404e", "comment": "Malware payload (Prometei)", "value": "3eb3480f25c88b50f97b576282e328e64f2fb9c69656192e0695e183af3f30a1fbd06e8f0c6d6d6e3ef2f030431dc1ab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747387130, "uuid": "c3ff77ec-3eb0-40eb-b0f1-ae25221f0fd2", "value": "T1B0155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747387130, "uuid": "775b17c2-9c7b-4ac7-9118-779c58b1c06b", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mply:qmShf4OTjMgXSJhBXEsVrmz9MOup1Khh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747387130, "uuid": "bb1821d3-3713-43c0-9605-19252e6a8bd9", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747387130, "uuid": "52358541-79f0-4672-b68e-326e6f2b4c34", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747387130, "uuid": "b59dafd0-9b81-4d28-bed6-cdb49feb3715", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edd0d170-31f9-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747360995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747360995, "uuid": "04280183-7f8f-42ba-bf7c-1d2c37a0d6f3", "comment": "Malware payload (Mirai)", "value": "0d39702f156685968886ec6ee52e074c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747360995, "uuid": "c3be86f7-d5ef-4e3c-b716-8747aad34299", "comment": "Malware payload (Mirai)", "value": "a82c3fff96383402fe29fabda9a346b073716c633c1febd2a6eee5f759ea1612", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747360995, "uuid": "3d894fde-3ab0-43ba-910c-ee0ee9385ecd", "comment": "Malware payload (Mirai)", "value": "5ba0ca27fbcb088f039ddd099eb967fec807dded", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747360995, "uuid": "663224a0-c180-42b4-9d90-19f11a2193b5", "comment": "Malware payload (Mirai)", "value": "547d15b7b1eede12e10095590aa9e6ff9da2fd1dfcaefbc6f6231f50860a9d47d24b024659e9fb6e7c9cbffc4d6685d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747360995, "uuid": "91fb2999-05b0-4a22-8467-36e9b34b13eb", "value": "T173F21985F8C2562BC5E42336B39E6A1E3730E3D4E3CF7607EE154B6136A650B5C56E80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747360995, "uuid": "be4ad85f-4ed7-45f7-bb95-44e65faed3ca", "value": "768:K/Tt+9flN5znn9YzsCgR9zAW0HofnzygQdK:/lznnsgrzAW0azygQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747360995, "uuid": "cf691034-f66d-4c23-a68a-77aad00fa5ea", "value": 34548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747360995, "uuid": "3d0f95a9-9375-4212-8acf-32f4ccff94e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747360995, "uuid": "d546caae-3b28-439b-9cc1-9b1fa1c44d02", "value": "neon.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "482bf841-31f6-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747359429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747359429, "uuid": "5bcde5fe-e16e-45c2-8e16-3ca367c73eac", "comment": "Malware payload (Mirai)", "value": "49214faec79d0c2b1266267edbf419a2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747359429, "uuid": "3134b933-33f4-4ff2-887e-ad095338d359", "comment": "Malware payload (Mirai)", "value": "a82f4fe6b12710756ea647a45962fce98b4441d8faa46d4d7e1e1ddcf9ec96f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747359429, "uuid": "b03df459-7053-4660-91df-be4b6b3351e6", "comment": "Malware payload (Mirai)", "value": "3d64f62b1bcbba3a3c099db28e0cb81814b68aa0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747359429, "uuid": "061895db-5922-4eb8-a48a-52b723fb661b", "comment": "Malware payload (Mirai)", "value": "6fafdaae2bb4b174aebed4023b4e78d8381809d940869def1d3241092a153bf06137957d3d1d604b6265ce66208c7b48", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747359429, "uuid": "21b3d575-1dff-4039-87bc-7f503a72a8c5", "value": "T134E2F10416B37862BA74DD3B7DB7C4C66703467E8B9B2437629C876450BF05E123AAB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747359429, "uuid": "51aa72db-9a9b-4541-bdb3-3b768f64630e", "value": "768:vVWr24WfzKTuwpV8JdlBi1nkp8SjjKrB+AErbRs3UozC:vVWr9WrBk+J/BUnSjKr4AEEzC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747359429, "uuid": "4005331e-499f-4bf4-9a26-37436bf67aea", "value": 33964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747359429, "uuid": "fdb68cc2-31a3-48da-a4d6-27bcfe087463", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747359429, "uuid": "9a9a3486-322f-4f2a-a1a5-59f65947a6f8", "value": "neon.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "326c4402-3227-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747380437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747380437, "uuid": "73294dd6-f75b-4153-b769-62ed27afd081", "comment": "Malware payload (Mirai)", "value": "4f9bfebef1d322b0f64818b99211cff0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747380437, "uuid": "84814197-a8ba-417a-a4fa-c5fe49143888", "comment": "Malware payload (Mirai)", "value": "a83b70f294fb4515f44bc25403956691a6850dd9978c39862ff7bc442c773b50", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747380437, "uuid": "29c8ddf2-c303-45b5-8483-5458c2d0b36f", "comment": "Malware payload (Mirai)", "value": "47666f9725082ad9c88ddac7990b5c4c368ec401", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747380437, "uuid": "bd3d1003-92a2-4c82-bb1e-62ce4314f8ce", "comment": "Malware payload (Mirai)", "value": "6b3e2543111eb9e9edb45ac6a47130bee3821e66e112bf9ffcc0f5a2d9497475ee431a105a170bf8b6ef09bd91bbb12d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747380437, "uuid": "5dba38fd-cf9c-4162-873c-a6c5c25afabd", "value": "T1D7144AD7F800DDBDF80FE77744230909B530B79210925A377267B96BAC3A0A55A27EC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747380437, "uuid": "5e0b0041-658e-4b31-ba25-1fc403925419", "value": "3072:KQTOuAuRLye9NS1//Vj7DWI8KohTbRrKp2H525VOjbioLPFEH6yAXb1x:/dLn9Nc2I8KWTb2i52ALPpyAL1x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747380437, "uuid": "92d35686-f560-4f83-88f6-90a0ccca3b02", "value": 199328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747380437, "uuid": "26867f81-b635-4ae5-88f1-d0e3a95f8836", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747380437, "uuid": "8465ab27-807a-434a-ae24-1db91e7f72d1", "value": "neon.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a616c80a-325e-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747404254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747404254, "uuid": "27f1eedb-5449-4640-8aa2-c308719f4b7a", "comment": "Malware payload", "value": "977fc180f8e86a5e989f6a1c74e0d5fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747404254, "uuid": "3ab2fe33-bc2b-4ab4-843e-03ded22cf179", "comment": "Malware payload", "value": "a84b3414e3117d306affe01aabee35829333f1f1d1cd94aa158a3950be8957ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747404254, "uuid": "efb28711-a4e6-4006-8fe7-100d5c396083", "comment": "Malware payload", "value": "27a19eb1e1430f7d67fd2528a1ec762d15183368", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747404254, "uuid": "526afa42-edeb-4e04-984d-2dfb606894db", "comment": "Malware payload", "value": "05798f429c7d02f289181b3c622ce44c35633f7f9419d1cea53fbac758a674e0c9c6965829182831b367a0f9b9d8d5aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747404254, "uuid": "34fed38f-2275-4875-a07f-d151dba4e5be", "value": "T1F6A52342B6C648B1E17228326B7867216A7CBD305F75CEDF67D03A1DE9605C0EB20B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747404254, "uuid": "e22eacf8-465c-40fe-b196-51f58b14fe77", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747404254, "uuid": "22f02c75-2b86-4966-a372-13b6ff2ff1f2", "value": "49152:IBJ0Tpc8iYMljoCIrtufFEUPtPSfdjh/SXjl5:yeTFMlFIQDP4fdj4D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747404254, "uuid": "b311b14e-d534-4a5d-9505-d334a48efec8", "value": 2230224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747404254, "uuid": "46abf766-44f6-4f60-bc43-7aad217d312f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747404254, "uuid": "af527cba-257a-41af-aafb-f2e5a8be4bfe", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b12c6df3-322b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747382368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382368, "uuid": "121f44c2-6c57-492b-bf7c-6ea5fdffda74", "comment": "Malware payload (Mirai)", "value": "5dbbbc1a5f28b0b84aa58ae2f2e2b217", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382368, "uuid": "ef39ff31-e98d-4a71-a853-aed8bee987f4", "comment": "Malware payload (Mirai)", "value": "a866c29fcfb6b5b157793b2b079a78273ba7c5f228c438d0842f4af1af68bbd4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382368, "uuid": "b4975c85-3bdb-429e-b633-b347e9b51ca6", "comment": "Malware payload (Mirai)", "value": "fdec72cdd2f09a09b1902ece68a56ba4d68eae9b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382368, "uuid": "a8602182-58f4-4e7e-b9fe-2b5c940f4024", "comment": "Malware payload (Mirai)", "value": "186f46a23d3edcc6434cc24994116edbd60a516971260dbf0009f0443fcc14f208b3f6699d040e681cebcb9e77e4984a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382368, "uuid": "37afd20f-ba5f-464d-9f04-305c14628cfe", "value": "T13833F785BCD29A1AC6E0537AF96E809E331073E9C2DF7623CC140B1176C655F4EA3B96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382368, "uuid": "bf527f28-a28a-46fa-a62b-35e661bf0e5d", "value": "1536:RfinNXlMJZdy9imMnjkYm7JSWOCrDO+1gAD2yKCQ5KkzoEOSSSSSSSSSSSSSSSSc:RqnNXiJU9j2yBezohSSSSSSSSSSSSSSs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747382368, "uuid": "aeeaddf7-55f0-42d6-a1aa-1e892c38d4b6", "value": 51392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747382368, "uuid": "fe60002c-3731-45d1-95dc-c7e23265d5f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382368, "uuid": "d58ddc39-3e57-4812-8e6c-d711dd199a94", "value": "kwari.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba3adaf3-322b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747382383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382383, "uuid": "42eaff1d-9845-4f04-9e4e-c28d7837f321", "comment": "Malware payload (Mirai)", "value": "05ab7e30c67fed360a469ea33da8ae93", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382383, "uuid": "423474d2-1ede-4094-9a07-d07da11750d7", "comment": "Malware payload (Mirai)", "value": "a8e3d9142d86ef6d18ecb1a5424d14d3e46e43062961829c87e4266a85b295b3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382383, "uuid": "1989f4a0-46d6-4fea-837b-8660c3f4569a", "comment": "Malware payload (Mirai)", "value": "91c15f7ee3a336bdcd39c053853969ac999a2e34", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382383, "uuid": "a9b9c8d9-1865-409b-aab3-6aa04955522f", "comment": "Malware payload (Mirai)", "value": "fbd4511d9c228e42c16e630d5a8f53f7e720fc1a7393b38b1ef052c8a5751c384dce0c0da5c5776612b13d6b022de235", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382383, "uuid": "35ac5fe7-59d6-403b-baae-08c6d2bfc420", "value": "T1C0732807B54181FDC09AC174177BBA3AEA3371FD0328B2AA27E4FF223D89D615E19945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382383, "uuid": "a07756d8-0698-43a2-8fab-ffacb5b0461e", "value": "1536:l4wEk9616uaAV0RlKXVxcz8KcpCZnmcCQXi+LLAfs:HEkvdAWlKXM8KfZNCQXi+fA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747382383, "uuid": "b2799864-fe0f-4bbe-b692-ded9c9f0b02a", "value": 74096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747382383, "uuid": "6a8be0e0-ee60-41fe-886c-69318962e2b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382383, "uuid": "5bbc8192-8804-4311-a2c0-2c3cefd1fba7", "value": "debug.dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21d54cbb-3262-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747405750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747405750, "uuid": "613bd9c9-34bf-49a9-b50d-6cd73934e57c", "comment": "Malware payload (Mirai)", "value": "0d688c5a77d6c179f28459ef26bb316f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747405750, "uuid": "04f90fcb-eff9-44ee-9d17-2458e368a628", "comment": "Malware payload (Mirai)", "value": "a8ef796eda72cb090fd56e2e97d78885e8123897558fad6b1e732e8c5fe453d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747405750, "uuid": "b0d90206-9259-4f29-93ca-f4391b21f745", "comment": "Malware payload (Mirai)", "value": "c70ee32ab1d0595c8348d50d842dc1ac1d6ee8fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747405750, "uuid": "282b3188-7607-49cf-94ff-06679d551f05", "comment": "Malware payload (Mirai)", "value": "12ff26a87e459d21b696782533c38f4d447ac2d19828c3faa776982b4a249e9a553e5e92f6ad2fd3f85650fa199cd01e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747405750, "uuid": "d646510b-3354-43e3-99ed-fbd3215868aa", "value": "T19F732A9AF801DC7DF80FD3BB4467490AB930A3D116831B277767B9A7AC720E54826EC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747405750, "uuid": "1353093c-d43d-481b-9a0a-edec646a999f", "value": "1536:Gb8+P806W0tOToFOe383I9DG806KV4QXiSHIJFvDrlUTG7NImE5k:Gb8+PD5s8Y9DsBpi+IfUG7NK5k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747405750, "uuid": "b004b899-f763-4c35-97df-d75f38114b38", "value": 79108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747405750, "uuid": "e9a4220f-8b33-4b0b-aac0-0d18c52c7f5a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747405750, "uuid": "ef83d7f6-0ab8-4155-9360-d652ca2db7e8", "value": "neon.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "270e463e-3264-11f0-8bd0-42010a9c0005", "comment": "Malware payload (CoinMiner)", "timestamp": 1747406618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747406618, "uuid": "375dbca9-c001-4dfc-a726-0264e58fd32b", "comment": "Malware payload (CoinMiner)", "value": "4edfa1364a6e703a3de2f73da22841c3", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747406618, "uuid": "ade2ab9f-dce6-407f-ac6f-1473e0a462f6", "comment": "Malware payload (CoinMiner)", "value": "a94c30191ea73419ebf08919e8a1c8ea0ace0e5d05da21e3692ed8a91f96c659", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747406618, "uuid": "76a35b6e-93a2-40fd-8117-cd394a6bf110", "comment": "Malware payload (CoinMiner)", "value": "63502b60153f75f812e47ba5bf810eccbbabe31d", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747406618, "uuid": "74793f01-6409-4c71-bf53-40246caf404e", "comment": "Malware payload (CoinMiner)", "value": "8e3ae0a2d4c980afd7e8ef76f5f69057e4e2ecf5f54183e5e4c6ff048bd16033bf8515d532e6041c1a0d45ff492b891c", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747406618, "uuid": "2bd74004-deca-4cb3-9e6e-7b67d8bff973", "value": "T1FF847D15EA6501FCE1A7A278C9634902E7757C8E07A1DBCF17E449A22F276D09F3EB10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747406618, "uuid": "d5b2456c-c55b-488e-973d-363af54a0cbc", "value": "156d402649f0c4e2eaf196703f7ec770", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747406618, "uuid": "26783ce0-637c-430d-bffb-5e4f1035ef0b", "value": "6144:Pp2sFNeOr0NhbzPqo5P2jSOjnB75h/gsI6cyekMVu3d7:P0BD5P25jnBP/gr6/Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747406618, "uuid": "eb8bb4c0-8b1a-4556-b32d-89ef84a68bed", "value": 407552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747406618, "uuid": "0b7727cf-8915-453e-a9aa-dbd5e9960702", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747406618, "uuid": "08a85468-b03c-44d5-b45d-7ca0032dcfea", "value": "SecuriteInfo.com.Win64.MalwareX-gen.9756.19322", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7dbdaed-328a-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747423181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747423181, "uuid": "a74aa3a2-dffc-4bb5-86a6-beec90ca8bbf", "comment": "Malware payload", "value": "687440e1e1bc1db60aea9153102c0b41", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747423181, "uuid": "dd088a07-2782-4e9b-b4a5-62f23ee1dd4e", "comment": "Malware payload", "value": "a99dcf9a006a8bba7ff7a934fdd7d1d4232ee5ead022dcdc36a2bb9f8e3242d6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747423181, "uuid": "bd5bb234-2ac4-4713-bca8-42e843b2bb72", "comment": "Malware payload", "value": "00a6cb85b60a498a8d3a7e68e183a4422f3745e1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747423181, "uuid": "07bfd421-f332-4245-9057-399fef7b6897", "comment": "Malware payload", "value": "73cd183775941161b87bcffaeb6044c103d6c21ddcbd15bf1c34709b078ce8492f8ebf0d289541f8f284d42c0dc8f02e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747423181, "uuid": "e07044ca-5b5e-465d-81a7-eb926b68bb74", "value": "T14884600A7F1160A154F7A35ABE2A8204E5313317945286373AFED6446F72CC4D7BAFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747423181, "uuid": "e5361ecf-1b3e-45f4-8f72-c21699e8faed", "value": "768:CLHTwoBxcqBBY7yjL42lpauLHTwoBxcqBBY7yjL42lpb:e7XbbjNaS7XbbjNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747423181, "uuid": "92875fe4-6d90-49ae-9985-937a26fbac8e", "value": 400090, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747423181, "uuid": "40bc17bc-d26c-490a-9307-525946255101", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747423181, "uuid": "4a7295d5-565a-4c16-97f0-171b776b34b6", "value": "Consulta de producto.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e009bd1-328a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (DarkCloud)", "timestamp": 1747423138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747423138, "uuid": "2d4dfe80-7705-49ff-b8c0-8f27c062cba5", "comment": "Malware payload (DarkCloud)", "value": "6597668d61de582a555608470409f424", "object_relation": "md5", "Tag": [ { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747423138, "uuid": "37f41294-79d6-4eb2-8ede-b28c0be035ac", "comment": "Malware payload (DarkCloud)", "value": "aa5422f677a5edd3939d9652209e15fe56f26998a293bd23b521f48a3b3ca318", "object_relation": "sha256", "Tag": [ { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747423138, "uuid": "7f7cdd90-c66e-4d09-8362-5ff21ff4d61d", "comment": "Malware payload (DarkCloud)", "value": "f4296b3bf76e9959b2b9e6ac448e8f2defafca03", "object_relation": "sha1", "Tag": [ { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747423138, "uuid": "e725f0c1-5da9-4255-989a-a791b076048f", "comment": "Malware payload (DarkCloud)", "value": "cdecf4ca24eef0ff8c812205ecb59959635510d10cf7430edb2657d5984fc3ed9c241c4625eaa0cc53f5cad947a27ea5", "object_relation": "sha3-384", "Tag": [ { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747423138, "uuid": "ca500b9b-8e0f-4b59-a4cf-5a3403cb3daa", "value": "T1C8442B5C13CA7E26C77E4FF3A8D76B044378C272E79AD34628C848EE1C45BDA9A41563", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747423138, "uuid": "9b5dacd6-b91b-4d17-aa23-ff228f50d167", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747423138, "uuid": "39e6e677-c45b-485f-a60e-25a37bf28896", "value": "3072:+MzSIcjDES0mqYGQHm0O9pkcOO+OBthT6830YqeQXAByznQyubfZT4UaAe:+FJGQGJdO83hlkQVZmUaA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747423138, "uuid": "dfffd944-c8f7-45e3-a7d2-ccb1552992a2", "value": 267776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747423138, "uuid": "bf872b15-7587-457a-9e25-5f8f3c11612c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747423138, "uuid": "67be97d6-f89e-4659-a054-08ed2c29c9e6", "value": "BBVA PAGO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfa574ce-31f4-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747358824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747358824, "uuid": "ed2c93d9-f4ac-425b-835a-86df519fa6b2", "comment": "Malware payload (Mirai)", "value": "daa6a5d6b97af4c6693691b5fcccf64b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747358824, "uuid": "9306533e-96b6-43d3-b38d-ed4ad04dc365", "comment": "Malware payload (Mirai)", "value": "aa59401bec6382570276fce4cfb697f120979c9349b342b6d6082cdc4e8d806e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747358824, "uuid": "14145de1-ecb8-48f9-99d2-9e68e3a366be", "comment": "Malware payload (Mirai)", "value": "babd3221a901a480e14d093ff13f08a45f6be9aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747358824, "uuid": "1d1f94af-505b-44ea-956b-05236cc3ae97", "comment": "Malware payload (Mirai)", "value": "05c0392173d4498e2b765cc32c461eb3f58b830b38111b3a713b470c67cdeee58e1de05432db1da656b4c0b9212b2d68", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747358824, "uuid": "bb087017-afa4-44f7-b74e-b1e15cefc1f5", "value": "T1B2E2E1F2B978C95DCDC2F13581AE4D5EDAA72C15074FA1D37385A8C24C7B08586398F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747358824, "uuid": "9c3e9293-08ec-4698-bfe9-7cfab005a6ba", "value": "768:xF9fhlH+ec4PPSN+thqlaxG8oKp6r9x2SBuZOSLh2iABy6k:xFVh0WPayqsxGHK4BHu392Xk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747358824, "uuid": "a2e49a52-6374-4fde-bdcd-6316a59f49d2", "value": 32836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747358824, "uuid": "e34b0b1b-4f1b-4b0f-b926-1f2cbb0188bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747358824, "uuid": "240f5569-acc1-41d3-9b48-6bfcba488fe8", "value": "neon.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee85f74a-3227-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747380753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747380753, "uuid": "26d58deb-6e28-4fbf-b858-c066f2542b77", "comment": "Malware payload (Mirai)", "value": "adade06709ba0abbdf9f2adad67d0feb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747380753, "uuid": "c4d8f079-2b7f-4504-8fed-71157eb2cf3e", "comment": "Malware payload (Mirai)", "value": "aa83d64c92decfb4ef8ad8aa9f8d7a6f30c9b6128ddaea3d7d20acf451acc3f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747380753, "uuid": "6d1980bb-03de-4da0-969e-24233ff95fb8", "comment": "Malware payload (Mirai)", "value": "c5c62b5addf83d27583f59f18152a946d6ac0ec4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747380753, "uuid": "eaf0aae6-6bc7-470f-8c86-94ed8a65ecca", "comment": "Malware payload (Mirai)", "value": "2546e30573c829bad9e5e41c06d384484e9702d533d85e1a45e7ecfaddeb4a0f1dfa8a8b760657d79634e3ec092990b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747380753, "uuid": "c6993f2d-2742-4116-a653-a5bbaeb0ea29", "value": "T126538C77C87A6D08C15A83F0B4718E785BA3E64095471FFE1955C67A8083EACFA063F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747380753, "uuid": "a9507c96-f96a-4873-bbc2-17bca8db4945", "value": "1536:/IN/v9fTLW9E83RKjBlkv7erTeKLC5b2lgliDfM:/I1FaB4jCITeKLZY4k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747380753, "uuid": "212cb78f-3ea0-4e87-a1a5-6019ff9f77e5", "value": 65520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747380753, "uuid": "6538f306-6113-434a-b19c-9f4e422d98c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747380753, "uuid": "203ffb75-6008-4ee5-ac93-88f119e5963e", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99ede750-322b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747382329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382329, "uuid": "95f4b0b8-ad9f-4507-888d-8e14c4ead8f4", "comment": "Malware payload (Mirai)", "value": "7cee5ec39ae2cc11b5b09417e18f2ce2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382329, "uuid": "13fb8f22-4f52-4807-8115-c56318885c2c", "comment": "Malware payload (Mirai)", "value": "aa89070f8e4cb32e47c622a2ed1b16d2d113c5f7e52706d5f6ed73353defdd9b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382329, "uuid": "e867cd47-0a96-461e-95c8-22c22b395b0d", "comment": "Malware payload (Mirai)", "value": "169d2acc41ad3b2bfc6405f7342d902b8bc76971", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382329, "uuid": "0c2ab5df-4697-4fe1-85db-0c321a328c6d", "comment": "Malware payload (Mirai)", "value": "dbccb7ff47326c9f88508ff6542e91d292952e28e5ba77c56d3bf4b4ec39559908c4d749ba126a7d680d5147c337ba2a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382329, "uuid": "b9c61f2a-68fa-4055-842a-94b08725fea6", "value": "T1B9734CD6A801DDBDFC9AE7B681170609F43162444FA20F27F2B7EC6B6D72098E907D46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382329, "uuid": "dbc87193-5982-443e-af36-cf67e20598b0", "value": "1536:Bj6Z8vl0YvT7ewpvzSLHb594BcLWahplI8S0vjnvJpT8Xptx:BXpzkb5C3ahHR1zv/i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747382329, "uuid": "096aa1e1-3d49-4f84-bf52-3f0536fa5400", "value": 76864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747382329, "uuid": "d84c14cb-f151-4a82-8aea-692918d7b60d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382329, "uuid": "a33b6cee-b1c1-403f-9c7d-5d902afe84a4", "value": "rift.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b86445c0-3223-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747378944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747378944, "uuid": "8b4a4cd1-0112-480b-8f4e-524f6f2c8edb", "comment": "Malware payload (Mirai)", "value": "51b17d32bcefb2a9caeb5087ec7d25cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747378944, "uuid": "433aee29-7403-4c8e-b7ac-04f66fd4eb3a", "comment": "Malware payload (Mirai)", "value": "aa976888b5755c458ef5b42fb3a1a1c37f09dd523f64063656dc83a1087fdd3d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747378944, "uuid": "ffb3ee3c-c2ef-4c22-8f50-50b74f8b15d5", "comment": "Malware payload (Mirai)", "value": "8fc9bb88a1b7bfedcfcde35548078b18700ecaf6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747378944, "uuid": "fd34b823-c1e3-47fa-85ad-d0f86c4d1092", "comment": "Malware payload (Mirai)", "value": "064517e84abcab7e630f897d1879a6f071914cd48a277f68f527c470a3b113623a869304d83cdc8fa05755820491f2e4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747378944, "uuid": "6b563f46-6276-4757-af7f-6e06159d05d4", "value": "T1D8635B35F9350D2BC4D5547A21F74B26F5B243DA20A88A2F3DB10E9DBF616403A53EB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747378944, "uuid": "295ce129-04e3-41bc-b1ca-c04cfe365be0", "value": "768:I1o36daDusWNIGAaDafcDMeDwZTqtGHaJO+YHG5V127d2v7/00gR/FFSVt9vvdYu:I1A6wCx5eVZTqt+8Ym5ub0gVFytxd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747378944, "uuid": "0b53de72-b90c-49d6-9066-227160fbf59f", "value": 71824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747378944, "uuid": "b1ef2a4f-7957-45bf-a2ae-4987a7efd285", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747378944, "uuid": "442d7d20-2498-4a40-a8a8-65f82b121d65", "value": "neon.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b42fb138-329f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1747432195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747432195, "uuid": "70a23724-e33e-4ce8-af65-3208bdd2f27d", "comment": "Malware payload (Prometei)", "value": "8561ea93eb4547af19f5446161fb25c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747432195, "uuid": "0c257356-9aaa-41aa-a00b-28a4845ace26", "comment": "Malware payload (Prometei)", "value": "aabd0153373017da286333d0fc6da0af9b43a1785bac5c8c0e1bf939f3f7a87d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747432195, "uuid": "6da93973-86d6-4ec5-85b1-7374e6d2b78f", "comment": "Malware payload (Prometei)", "value": "5505b99c6f883707b387a9931f80393a8b2360bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747432195, "uuid": "1a762670-dbd8-4df8-8bd5-41f5f641cb78", "comment": "Malware payload (Prometei)", "value": "4c718935915ce0ff2bdb2c6555cf86218b9b0d13de19ca76d8cfcda5847286139bc394bef0eae7cd135e739b6e2aefeb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747432195, "uuid": "8fdd71f3-1cfb-45bc-85f0-9e636da8c3fe", "value": "T1FD9423F8C83D2E3098169B3CBB5A826CF0E15772D9562B6EB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747432195, "uuid": "6277f918-6c9f-49a7-b460-a0b05a0a236b", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgE:25WOSACZSV6eKRH5EPiamb4DsDwwc0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747432195, "uuid": "af9031b0-1f2e-4f6c-8e33-92ae7f4edc38", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747432195, "uuid": "7a14e256-ebaa-4bcd-95ad-07b674dfbeed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747432195, "uuid": "88b10a63-a5f4-41a8-81bd-8cc34c12226d", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed632c93-3227-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747380751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747380751, "uuid": "abd28643-8bd9-4e18-b7c1-b655a878c5b5", "comment": "Malware payload (Mirai)", "value": "3c549727e9c4eb4c28890e82c414722c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747380751, "uuid": "e6dd4519-9784-45bb-b749-950f399f3468", "comment": "Malware payload (Mirai)", "value": "aae23a37c83e862afee29e19e4a2aa52d5ae963c69a1bcbe707b9fe38a91b935", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747380751, "uuid": "8b257240-0e5a-4b5d-b53d-197715f9dff6", "comment": "Malware payload (Mirai)", "value": "83b5c7d1fa0e8752495285d507aebcf14cb3f59c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747380751, "uuid": "aacf88f0-e633-45cd-af4a-458542210e6a", "comment": "Malware payload (Mirai)", "value": "a8a42afa854017dc9ee0e9be4c0e14db5843ac425fc44555dbdf2a901e94d6cefcd54855b73497fe8c5b12eb49be1655", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747380751, "uuid": "9a7f17a8-4659-4c0e-9c6a-7471ab464273", "value": "T148833A56B8818B11C5D512BAFE1E128E33131B7CE3DE73129D246F24778B96B0E7B906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747380751, "uuid": "83318bbb-f0fc-454d-a106-4208739901af", "value": "1536:gNngYGX+N4gTAwxTDUSXKjNag9/nJQQGMuiLBBNDNT7Fb5pYci:qGX24+AwxTDUkKjNagVBBNDNTpb7Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747380751, "uuid": "5e72c297-013c-4f8c-add4-17cd032622e6", "value": 83248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747380751, "uuid": "0618fb3d-8c49-44cc-bb66-d91d498f6ad6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747380751, "uuid": "feb97e9a-4c03-4ba4-83f1-ba829bff4918", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdb71ae3-3291-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747426198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747426198, "uuid": "3643e134-1747-420f-92ed-519f897b9379", "comment": "Malware payload", "value": "090a58f2a228da5cc8aa9d6a0d95af05", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747426198, "uuid": "70f8c567-b50a-4e3e-80a6-eb1a42265bed", "comment": "Malware payload", "value": "ab0011985683acf0d70792184b9a770add683bd1c2350f157fe83b0a26bcb278", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747426198, "uuid": "20da5195-a277-4ada-bc15-111284ffecc0", "comment": "Malware payload", "value": "9417145b2e2e24ec21bfb67837f62528123736d5", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747426198, "uuid": "bc875fdd-39fa-4061-a450-2d3723bc9279", "comment": "Malware payload", "value": "f76866af0e1af70a2cd52b30e95f1235805df58e0f48793573a967f8f5338dcbdd338765504d9db68dc4d7b7a2c8242f", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747426198, "uuid": "a3de486e-3a2e-4ba6-a98b-7c76e69900c2", "value": "T15B13F02B5B898DFED35260F6137443D6FA19C3D51D5AF92632C06FDF39A8A02209359C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747426198, "uuid": "04772271-afc5-4d20-b06a-6536d7b44ef2", "value": "768:ejx0T7UNqiovompy5DIaOSFi2PeZeOcXzOjLDqgZWwt8oCeyA0qGihiWt2:edwAQiovqTOSFi2P0cDKBZWwmbeyAF12", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747426198, "uuid": "d3c10fe8-ec13-48ac-b62d-f085c2da005f", "value": 44650, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747426198, "uuid": "3eb75d5b-596f-462d-b9c9-cf7643884964", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747426198, "uuid": "09279d9c-11c3-4180-9bdb-ba311a59d4ba", "value": "PacketStorm-main.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93d2e824-325d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Amadey)", "timestamp": 1747403794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403794, "uuid": "f77fff47-9e60-4c1c-b40f-b8a41df85783", "comment": "Malware payload (Amadey)", "value": "a405964beb1cfaca126d6e509845fd67", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403794, "uuid": "06e75b1c-0936-4468-b869-f3a94b181995", "comment": "Malware payload (Amadey)", "value": "ab0acdb0c45ccafcc0ec594d30dc8153936574dde9ebe4e0b22504770361c666", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403794, "uuid": "385f0a14-87eb-4d2d-bb4a-09764302b046", "comment": "Malware payload (Amadey)", "value": "aad1647589c6352da2fcadd74736557eb3235450", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403794, "uuid": "de6c2488-ce44-4ecb-943b-ba5ebe847a1b", "comment": "Malware payload (Amadey)", "value": "e9cc72b0863f68c2187fc108a9aed63a135d4c5228fa746727161d77dcd6951ea575e3aa3d611a6df063ab12b14f363a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403794, "uuid": "7f290591-fb91-4827-8616-cd9c45cd8da1", "value": "T189159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13A81DB9BD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403794, "uuid": "0b292028-3101-4a30-8b40-f8c5084fdbb7", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403794, "uuid": "2bdfbe26-3653-499e-83db-0f2bbdfeb7d1", "value": "24576:SqDEvCTbMWu7rQYlBQcBiT6rprG8aMTb:STvC/MTQYxsWR7aMT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747403794, "uuid": "41ffa8a6-f832-4a30-aa53-82d55f072590", "value": 961024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747403794, "uuid": "9ed2d478-e450-4ad1-a259-7399360912fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403794, "uuid": "f04066aa-295d-4b30-88dd-9aae1883a9f2", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a697198-324e-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747397362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747397362, "uuid": "dca16561-ea95-485e-88cb-ecff2f140569", "comment": "Malware payload", "value": "7c4ae2f68234c9f074e6977d1015313c", "object_relation": "md5", "Tag": [ { "name": "InvoiceXpress-zip", "colour": "#B98988", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747397362, "uuid": "1bc0fa33-4b51-4f2d-8cf0-0b065f50facb", "comment": "Malware payload", "value": "ab12e5d60138af7912940742f05a240ba0243f782757d601a112759def87d803", "object_relation": "sha256", "Tag": [ { "name": "InvoiceXpress-zip", "colour": "#B98988", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747397362, "uuid": "d53c395c-a8cf-444a-812e-529c38f88394", "comment": "Malware payload", "value": "2e1993ee54570bf1b8549f7a3a9f953d06dac1d3", "object_relation": "sha1", "Tag": [ { "name": "InvoiceXpress-zip", "colour": "#B98988", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747397362, "uuid": "65160645-33d7-4e24-ab65-2e24b0600783", "comment": "Malware payload", "value": "d4828d12f364d4c117c68e230e05947c05aadb73e923f00e43ec9fb7bf626a4ee327688f2b47d269f15ef1e59398c3ad", "object_relation": "sha3-384", "Tag": [ { "name": "InvoiceXpress-zip", "colour": "#B98988", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747397362, "uuid": "59769b06-010a-4cf2-82fe-36b70fb15963", "value": "T1DD1833ADDCB55D8BE833C23AEE7AE69B839451C22B415D37FA00836746C67D3A93140D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747397362, "uuid": "9de52578-b121-43a0-ad93-b05636397cf0", "value": "1572864:n+grGWKoUHXNjgDtLcLX7Bud9yxqM6YEXC3XZ000F7waRlbXffUYJiQ:n+F5HXmhQLX7BWyxxEXmG5VloI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747397362, "uuid": "7b2adb03-ec8b-4b3f-8444-b52fb48dff46", "value": 91553039, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747397362, "uuid": "2f3f0ea4-9ede-40b0-95bf-b7c470bcc9b5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747397362, "uuid": "a949e0ea-5e56-4d88-9e3c-c3948df221f1", "value": "ab12e5d60138af7912940742f05a240ba0243f782757d601a112759def87d803.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f37f8676-3287-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1747421993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747421993, "uuid": "abc10419-4572-4d1a-923d-efc776d94c09", "comment": "Malware payload (Gafgyt)", "value": "8fd5dbfb9a200dfb648c4f96e8442db3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747421993, "uuid": "49144519-790a-426d-816b-a402d5f55770", "comment": "Malware payload (Gafgyt)", "value": "ab29b43c16b25111de8df6370313d889953f3e4980012fd619eaa7cf451c287f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747421993, "uuid": "da8825cb-1905-4d9e-960f-72b12f0e9c7c", "comment": "Malware payload (Gafgyt)", "value": "54f18821b52c94e7c390c1f007b5f98d56300bbe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747421993, "uuid": "0291a6a4-b801-4416-9fbd-d6091ddcccf1", "comment": "Malware payload (Gafgyt)", "value": "f68864eb0265d43c79d2e00e6a953544ddcd20d0a13d83cb7773553e65608dee04f92bf58c4ef9fb0dec507775ae09d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747421993, "uuid": "7037037f-614b-46ed-ad57-c4b38e703eca", "value": "T100C33BC79A40C5B3D00209F222AB67454522FF7F199BA9E6F7193CB09F3058A6236FD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747421993, "uuid": "eeceb84a-79c6-4df8-9be4-6c1c3f223871", "value": "3072:J4wrnlNniq0vd8HB6XetJ8add9QzTsVzgit4NKcXeGcgqGK:J3Cih6XetJ8addQGht4NKcXdcgqGK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747421993, "uuid": "db05dcf3-db37-4ea2-a116-1a204dc8f3e2", "value": 125342, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747421993, "uuid": "9f0c133e-15ca-49b4-851f-3e649bf189c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747421993, "uuid": "77cd1fb5-9af9-44e4-aa85-22997099d81d", "value": "ftp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e42bfc4-3228-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747381048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381048, "uuid": "ab0bb1fa-9883-4a50-9236-39259a49502e", "comment": "Malware payload (Mirai)", "value": "b4ee1d55baff10351ddeb56bad3c8f12", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381048, "uuid": "b66cacb2-947e-4f80-8ed6-5dd73b0e1b49", "comment": "Malware payload (Mirai)", "value": "ab5f84dfa186b8a71b33bf5509471c91c1f2953ff3bf4a6bc5ec0c927c4eb63b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381048, "uuid": "6516dad8-d6b2-40f8-942d-1c1d7041fa33", "comment": "Malware payload (Mirai)", "value": "5ace6f14587f5f5bc4f56036821325c9827e7ceb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381048, "uuid": "3173d216-fc91-4b97-af66-1c9a64b081e6", "comment": "Malware payload (Mirai)", "value": "1e13c068500ab7c96c05469f81bb5c739162ecf661b33cb3e74bf8c68511143c60892c81e762edd21efb235c17007f3f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381048, "uuid": "1e018500-f918-400b-9ecd-86282c2737da", "value": "T16F534B99B4028E3DF88FE97984160E05BA2023D112931F2767AFFDE37D331659D16E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381048, "uuid": "4281e7e7-dbe3-4555-9d79-0601b61b1855", "value": "768:2eY49YE204qEkRf/36fmODeiuQlJZvTgFHq1euk8B8vpG97ErlfXySJ1oXTo7PJ:2Y7EkRfPh3iDx8Fq1Xk8B2aErlfiSJFd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747381048, "uuid": "561d052c-7e60-4840-827d-9c3d0c4294a0", "value": 65096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747381048, "uuid": "7ba88ca7-eb35-4549-b8bc-0f14cffe3825", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381048, "uuid": "1d84b029-46fd-43be-8d94-91f8a03bbf9d", "value": "sora.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d853da13-32b1-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747439986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747439986, "uuid": "d74e16ae-f4fe-4813-a0e8-86f573a56aab", "comment": "Malware payload", "value": "7c8e325ca80feff7de811157f0bb0645", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747439986, "uuid": "09a0cf33-f8a4-4e2f-8a60-a4c8b0b5426e", "comment": "Malware payload", "value": "ac27c556cd455c52fabf5ca8011517e67061d247d08ed97d2ebe156468d341b0", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747439986, "uuid": "5b8c802c-02d3-4f5d-aec4-bf370a73984a", "comment": "Malware payload", "value": "75c6994e75374c0685a7a26dd12d3f2a99a2e0b1", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747439986, "uuid": "077842c2-7876-46af-aa4b-bc5235ed5d36", "comment": "Malware payload", "value": "836c7c21f1373271383e9c79c26bc258459819770c1dbd702822035e29aea8d53644f860825fccfb0a6fc80bdd480182", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747439986, "uuid": "53e7211e-df05-41ae-948a-4f938f1d0307", "value": "T1DEF00EEF0866C84CB29069828FA4B258AAC10065186EDC1991F898D074B03CFEE18670", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747439986, "uuid": "88c896b8-23fc-44ec-9c3c-ae15ba66432c", "value": "12:kxvsCk9cE3MotZjo/XUS2JZJ/9ctwlo4HKtSnYI:kbxw8/kTppqhI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747439986, "uuid": "50917099-2c31-4356-a05b-351c3bcf9c20", "value": 496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747439986, "uuid": "fe25f157-a7da-41ae-8541-5e980cb68f4a", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747439986, "uuid": "633c1ce9-9a43-4ef4-a1cf-e1aec497f0d9", "value": "fuck_niggers_10.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48b0dac1-3244-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1747392930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747392930, "uuid": "a3ff4eae-61b2-4d25-b8ca-b73f26ce636b", "comment": "Malware payload (Gafgyt)", "value": "e29eb1022ccbc49bd41f2d12b56cf3c4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747392930, "uuid": "d6175f00-0f37-4c8e-a866-1b6acf51f4bd", "comment": "Malware payload (Gafgyt)", "value": "ac482e4867bc703168645f74da13d9e670ec6867b63e852e82acb8e9ebeeb144", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747392930, "uuid": "548c3ed6-0e45-46ae-9b28-24e823148729", "comment": "Malware payload (Gafgyt)", "value": "3d8c696c06dd25cac428b7610ad0c00acb05821b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747392930, "uuid": "54e49f33-ab2d-4d54-82d2-a846c376957f", "comment": "Malware payload (Gafgyt)", "value": "2d57aa89e7088c571517107e53f4b136b07fe93f56bf0141de9ef798b07ae5943155d4e18278455e5ac1df5daccc602a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747392930, "uuid": "6b131e8c-c97d-4e80-8e1e-6d9225251c35", "value": "T1C9E34905D7408B57C1E2277AFADB424933339B54A3DB33099A38ABF43FC27995E26116", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747392930, "uuid": "f04dcecb-42cb-44d0-a6fd-22a493e7323f", "value": "3072:it8iFDKEfFN+Fa+1sWoh7rz0JH/WbUMbmQwfCMQiGW:g8iFDLf/+FaNBh7rz0JH/Wb5mQwfCDi9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747392930, "uuid": "e7ee3cd5-7bca-4a54-b2a4-e93f6dfa0012", "value": 150077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747392930, "uuid": "494a58ec-657a-4278-8536-2f19ac9ac86f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747392930, "uuid": "06d24b81-de50-4e9e-a091-6846fa6d0575", "value": "rebirth.arm4t", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40cbce7d-3244-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1747392917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747392917, "uuid": "87a31e14-2d67-43a2-9ed3-0ac0c7ddd202", "comment": "Malware payload (Gafgyt)", "value": "4dd19a8f67d046e57db6ba9f4b401006", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747392917, "uuid": "784e885a-5cb4-420a-9e4d-72b91ea73f39", "comment": "Malware payload (Gafgyt)", "value": "ac5be273de5e1662a7c39bf904e5056a5c96793873710e81ec40d7e3ff80ad7f", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747392917, "uuid": "8495081f-824d-4e1d-ac1e-71cdca3faa77", "comment": "Malware payload (Gafgyt)", "value": "be9527bea85d93991168271dfd2149cb825c859c", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747392917, "uuid": "e7e9a6e7-f787-4b6e-817f-f708f7135cf1", "comment": "Malware payload (Gafgyt)", "value": "55fce4cf5b37e02c171ffdd19854c471bd570db4cd6ba9a350430d0262e16950b1027d7fb7e042dc0772ce420616a343", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747392917, "uuid": "858c56d8-3708-482b-8e36-8bad1165cf00", "value": "T1A84113CD196106B0EC679D2F7169C42071D2E5DA9CCA6F05E9DC78FA41CCE08A8416B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747392917, "uuid": "24636bf1-cd0d-4439-9304-720031a77286", "value": "48:v8SyFEG8S0/H+c8S/ytpL8SIDCqJ8F81L8d8DaHtAL8N8N8p8SI8SV7Mrc:vdyFEGd0f+cd/ytpLdIDCQywLaeitALd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747392917, "uuid": "d852f55b-3409-471c-a55a-ecdc9c62fcd1", "value": 2063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747392917, "uuid": "eb093572-3ac5-41e5-8609-cc93361f6a28", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747392917, "uuid": "ed68e77c-d2a4-414c-b397-0c1b14cd3314", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62e51fd7-32a0-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1747432488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747432488, "uuid": "ea5d6830-38b9-45b0-9ce1-a1398845be71", "comment": "Malware payload (Prometei)", "value": "6d58764a760ab9e699877c30d2384d07", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747432488, "uuid": "49f7b6cd-0202-421c-a809-d1c88e087189", "comment": "Malware payload (Prometei)", "value": "ac6ddde657896eace41dd7cad70b8268463a5d76d91d7003732d336ed2d44579", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747432488, "uuid": "bfc4a276-d07e-48ce-81f6-6c9bffcb4d2a", "comment": "Malware payload (Prometei)", "value": "1b652d42d0ea0deb55a74d2b587fbce71de935ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747432488, "uuid": "460723d4-c885-4570-86f3-31a99c5c6f1e", "comment": "Malware payload (Prometei)", "value": "4062b832c8fba9f3d322625800cf859ab281b62fb7da2ba9cc0fd445c1848f311aecadae171909b084ee8e8523c7e653", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747432488, "uuid": "4e138b35-9363-4505-a52a-5164abac781d", "value": "T1D1155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747432488, "uuid": "f7e38f98-2cd2-4972-aad8-9b7e8e8b8562", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8MplQ:qmShf4OTjMgXSJhBXEsVrmz9MOup1KhX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747432488, "uuid": "b01708fa-35f1-4514-a7cc-9ed8448f0efa", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747432488, "uuid": "6658daf1-7fb0-4e32-8b6a-577e8d160a8d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747432488, "uuid": "2b96bfb2-fdc8-4646-9c67-e48d83020681", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc9ff9ac-3234-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747386253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386253, "uuid": "33d23f14-f89e-45b7-8295-2f6550b04b4a", "comment": "Malware payload (Mirai)", "value": "3d8e5c1b01315f2e64b1dd0106564576", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386253, "uuid": "89da8b62-540c-43bf-a0a0-b0a576eeea2b", "comment": "Malware payload (Mirai)", "value": "ac757cab03afe0f23196b5a2fc92b5c82e399e2f98bfd69d4b2db489c55bd62a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386253, "uuid": "3c625fdb-c3b9-43bc-85ce-31f2b9a3b0aa", "comment": "Malware payload (Mirai)", "value": "6f87ee4194de6f38bc5e126967921d76452ab071", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747386253, "uuid": "c1533733-722e-41e7-9089-dc4b5ad5c209", "comment": "Malware payload (Mirai)", "value": "745fd41e69ea6fab0fcf736620279a2d1db7b7fb9e32cb0f547dcc0004570b5c857a42f6e9a26701178a239ca4931bee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386253, "uuid": "e4749d7d-4944-4aba-a821-a0de7760d2a4", "value": "T120732A9AF8819B22D5C1027EFA1E124E331307E8E3DE73129E246F71778656B0D7B916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386253, "uuid": "05639eee-330e-4e43-ad66-baa058281594", "value": "1536:62ntxDfylnAuJWMRLlkji5aY7yH0Q1MLiFexlpgT7Rt5JYw:/faAa4ji5aYAexlpgTNtLf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747386253, "uuid": "af62bfc4-b0a0-401f-ae57-2eed251a3d34", "value": 79596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747386253, "uuid": "5fc9fd5b-84e0-44ad-a52c-79b29cfd1530", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747386253, "uuid": "23fca0a4-56ba-4373-8197-b1713806a25c", "value": "neon.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5762bc6a-322c-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747382647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382647, "uuid": "69690202-c6b5-4643-854b-dbc073c3c3f8", "comment": "Malware payload (Mirai)", "value": "d26587e93d178df282717914e63f28a6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382647, "uuid": "25a57633-8fd2-41e7-a256-3cb7e9fda2ca", "comment": "Malware payload (Mirai)", "value": "ac75e324b6f26b2629d51d72732c97275cbb0b7d1082adaa3172ce279ef86a42", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382647, "uuid": "42962bdd-419d-4615-9990-af6678ea5c33", "comment": "Malware payload (Mirai)", "value": "4fd1e2d108ae8a976543df58fc6bb66f16b5ea42", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382647, "uuid": "339b94f5-1ede-4892-9890-80883d44802c", "comment": "Malware payload (Mirai)", "value": "255f700b640a3ce4ebe2367105dcb619a9370446dbd8199a7d8375c41fa4294deec817e5f3054f88341cac91ae2b60b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382647, "uuid": "0f4b926d-1725-4f94-9a0f-113068997c64", "value": "T1CA734B42B31C0E43D1635EF03A3F27E1D3EEA99121E4F685650FEA469272E325586ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382647, "uuid": "a5e892d9-84da-49b6-8302-38297cfdac86", "value": "1536:T1krUaVFbDwmoZF/jgYVmDuc16HFIJtg6DURRDP9wKb5v:T1OtPMj1oAFIJVD2lj5v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747382647, "uuid": "c6325857-3f81-407b-9f72-7e8639c79fba", "value": 74032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747382647, "uuid": "ad4d8bba-27c6-419c-ad84-33dec25a7c67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382647, "uuid": "4acb6b1e-0e69-45b6-8ed8-d1cd23a8cb55", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cfe0f32-320b-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747368429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747368429, "uuid": "e9296b00-cc31-4ab2-8ec5-df7e2f444894", "comment": "Malware payload", "value": "9c2cf15661e5334ccefcc2cd5cea3acf", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747368429, "uuid": "95b14159-32ce-409f-a0bb-144c6271e483", "comment": "Malware payload", "value": "ac7c7d19fb8edd95188236f1ca985243f42c3eedd7967fd728d0f0c1d368f89b", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747368429, "uuid": "ff8e3679-8a0d-410f-a401-2cd8c568a748", "comment": "Malware payload", "value": "f21b0c63a7b44fade7b5cbdb8e13154555fcd41c", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747368429, "uuid": "9599e3c7-7c8b-4f17-bbf0-d6f106338d91", "comment": "Malware payload", "value": "09a18cc37eca694d69f2285d82bdc3255e76689b4beb84a4d86636ed073b82c9ae18af3478bd178aab4263c38750bcc8", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747368429, "uuid": "b5560c56-bcd3-4734-9b53-3d5a7295e0a0", "value": "T152F054F7084FC94EB54031818EABA3D4788C10D72898840C50F0EC767D3620F4D0E174", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747368429, "uuid": "6582041c-9873-4175-b3ed-dbc812fcb5b6", "value": "12:kxvsCk9cE3MotZjo/XUlwltJbQrRRuiLtT/dEfYI:kbxw8/kWVQrRR5VI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747368429, "uuid": "0c566260-c6bf-4a06-8640-2280b52af8b0", "value": 496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747368429, "uuid": "8fb1180d-3df5-4c24-a013-9e6203e36cb9", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747368429, "uuid": "83e201cd-ba42-4e2e-85f6-ab449b5b80ba", "value": "fuck_niggers_10.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92c83cec-328d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AsyncRAT)", "timestamp": 1747424408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747424408, "uuid": "9f9f0d07-07bc-4153-9685-5d630d67efce", "comment": "Malware payload (AsyncRAT)", "value": "7d3e5bf34015f5bfd5c926495580a312", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747424408, "uuid": "3be89fe8-4edb-403a-85d4-0dc1b7263016", "comment": "Malware payload (AsyncRAT)", "value": "ace5562cb154f79a019c1fc331a7dd39e2857b6d22dffe0986d6353cd5d2c5d3", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747424408, "uuid": "305e9edb-127d-4422-8d94-4e453f5df327", "comment": "Malware payload (AsyncRAT)", "value": "9bdbe1c945016205d36222ff633bd899d1a8314a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747424408, "uuid": "d5ca9f19-216f-4be3-b387-e9c5c9bc86c4", "comment": "Malware payload (AsyncRAT)", "value": "a896663491a75de269ed59627107740b5b9ac5a1690a2342adb347249635100f2f739f5e0b1ac02e4170ff68382ad77e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747424408, "uuid": "41a767be-8d4c-4dd0-bda1-1f4779af8e0a", "value": "T1E4F24C08BBA44216C9ED6BF4697371020274EA13DE13EB5D48E459DB6F23B80CD517EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747424408, "uuid": "d64aec4e-7c32-448c-8323-32991e2c8217", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747424408, "uuid": "80bacc56-683c-46a1-8c3a-1541bcc3aef5", "value": "768:aGLtt3QRH9ucNCQISkHIpHHbFa9YwOMhLBQs:aAb3QRH9uczTko57Fa9YwOMNBb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747424408, "uuid": "705e99b4-61bb-41a6-9a4a-93e7ef41f224", "value": 36864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747424408, "uuid": "ff08fdf3-911b-47ea-9d60-05aa0e90a40d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747424408, "uuid": "8f0bbf19-6259-41a9-ac6d-3e9b976d212c", "value": "1747424406a49316d0121cecdc6f29ec7182f3233b01ce9ecd816f509dc3604103c2335271362.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d430e74-3297-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747428667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747428667, "uuid": "6ccf56f7-c5fe-46f2-bbd9-01e4c0616faa", "comment": "Malware payload", "value": "7d64a7011f5ca82c8d85da8a98d73227", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747428667, "uuid": "ce6b0b83-da25-4857-89d3-c07071da36fb", "comment": "Malware payload", "value": "ad1a12cc39daba500b992a9275baa07dbc42ff9b5aaf12ff1205e8b4a9a5e034", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747428667, "uuid": "b704d5b3-9c5f-4729-90b2-a533237b15f9", "comment": "Malware payload", "value": "cc410dae8cb2ed86d74f74065439b8c2607e2803", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747428667, "uuid": "97569d63-8ce8-4c87-b0f2-08ca95cfcfc1", "comment": "Malware payload", "value": "7f007c2998eb841f7d5fdcd5f3c4ac315cec0ffbda11016241674934a83e725bc6c2a5e955843ba35dca323ea058f38a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747428667, "uuid": "07a7ca8a-f8de-433d-97ba-0fa3a9676316", "value": "T183D5D010D3FB0A58F6E72B36887599056A72787B5B65C30C11AD975E78F2682CE3033B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747428667, "uuid": "23bb4479-7315-4648-8e42-d527cf2ed038", "value": "49152:Gxra64HuBC+AKvzSXU+yr3ILkqXfd+/9ArnEH1t:Gxra6lAKvzSX5yIkqXf0FGA1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747428667, "uuid": "73bb88f3-2b8f-4c76-a6ce-aebd388f3ebb", "value": 3014656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747428667, "uuid": "6e7b2b8e-3cc2-4678-a326-e5aad257e357", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747428667, "uuid": "43c617cf-b248-4854-b5c4-16ed5a98c2aa", "value": "GTweak.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b86c1c4-3241-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AmosStealer)", "timestamp": 1747391673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747391673, "uuid": "8ceda6fb-5604-417a-90b1-c8d59d573a49", "comment": "Malware payload (AmosStealer)", "value": "1df5c2f3b1ae256e15324becc8c7cfe0", "object_relation": "md5", "Tag": [ { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "security-check-u8a6--com", "colour": "#68A0E7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747391673, "uuid": "3255cbc1-a999-457b-8b2b-44547e815bc4", "comment": "Malware payload (AmosStealer)", "value": "adb30f7ba534207834d9ab8d2c197bf78382be23d28bb17db7c52a3b956c0bb5", "object_relation": "sha256", "Tag": [ { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "security-check-u8a6--com", "colour": "#68A0E7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747391673, "uuid": "e466b6ab-c6ea-4980-9703-5053f2c24ffb", "comment": "Malware payload (AmosStealer)", "value": "e2db99319d9dfca57f550529efa21a19e3d73e3f", "object_relation": "sha1", "Tag": [ { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "security-check-u8a6--com", "colour": "#68A0E7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747391673, "uuid": "60d58c6f-6eaa-499f-adc0-06df03a9c26f", "comment": "Malware payload (AmosStealer)", "value": "0f5ecab7912514df877991c1e3b56a69c3f90f4109928da61643838a0ba5ccac54f4bbd9cad979242eaa48fc6d2f0efb", "object_relation": "sha3-384", "Tag": [ { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "security-check-u8a6--com", "colour": "#68A0E7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747391673, "uuid": "e908992a-0008-4ef3-bdca-620645ac0ea9", "value": "T16765019CF2C47F07CDAB01BB200A069554ECED9123A1C797EA509B3B7E647BC1C2B596", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747391673, "uuid": "c72a497b-f50f-4ebe-9d4e-8e930a048ec4", "value": "12288:4T7S+2WniUHpFCbtMpVUSvIT7S+2WniUHpFCbtMp8:4C+2WniACbRXC+2WniACb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747391673, "uuid": "e38f0eb3-98d6-4604-8845-2f4551e03c1d", "value": 1486096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747391673, "uuid": "71607a6f-b207-495d-a3dd-60007184adcd", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747391673, "uuid": "b43eb38c-8c84-4074-b36d-af62482a0a43", "value": "adb30f7ba534207834d9ab8d2c197bf78382be23d28bb17db7c52a3b956c0bb5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf6b247a-327d-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747417638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747417638, "uuid": "1677facd-ece3-465d-b9c1-813bbc01dc69", "comment": "Malware payload", "value": "b19caff7fd286ca580899f23a439deb0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747417638, "uuid": "ce04d999-b9b2-4753-b583-2f4c44296155", "comment": "Malware payload", "value": "adeefbec7b74dcbaf7334e3d1c12adffcc781659888b4cc417ee290654847c3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747417638, "uuid": "1bfc0638-3b72-4481-be80-1f1965dc0a91", "comment": "Malware payload", "value": "985e981ac56ac9032c675309314fd193647f0ff5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747417638, "uuid": "5aa0ffd7-1003-4860-951f-5a58edcb9157", "comment": "Malware payload", "value": "bcb503f31a147b621942419cf3e5baeacd5b26515aa43033ebbd0e0e6f390052c32ad44ee821ee8e3c631d71aa9b0f24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747417638, "uuid": "a1a579a5-7707-4cf0-8491-c8314953aa5c", "value": "T1F414E55662E10085D7A182B6D992D332E7317C350711A3DB1BF47EB73B7A9869F383A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747417638, "uuid": "39e67be0-9777-4d35-9da6-3bac9a850a7c", "value": "7182b1ea6f92adbf459a2c65d8d4dd9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747417638, "uuid": "5fdbe104-b656-4b6d-9bf1-29422bcd52cc", "value": "3072:PV3J6kkt5h1X+HqTi0BW69hd1MMdxPe9N9uA0/+hL9TBfnPbDIPt:Ct5hBPi0BW69hd1MMdxPe9N9uA069TBS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747417638, "uuid": "910ae4ff-2e52-4905-8831-513d5ed79504", "value": 191488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747417638, "uuid": "f4ec3365-37d5-4b24-9948-9974c40312f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747417638, "uuid": "388e1cdd-abfb-4a45-ae97-830827f3c2f3", "value": "FunnyVirus1.0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb7b8021-3242-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747392264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747392264, "uuid": "17bd662e-f3c3-4d64-adbb-a16e01816e80", "comment": "Malware payload", "value": "f8894ed9040284c058ae3ec0deaaecc9", "object_relation": "md5", "Tag": [ { "name": "security-check-l2j4--com", "colour": "#3C6813", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747392264, "uuid": "83affade-15a3-4790-8aa8-6903672c261c", "comment": "Malware payload", "value": "ae271a2eec286fe8467ea99e9e527f5d4f55bbf9a5eaa966c656041cefd7d1a6", "object_relation": "sha256", "Tag": [ { "name": "security-check-l2j4--com", "colour": "#3C6813", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747392264, "uuid": "582dc7eb-0f7b-4756-a06e-8596bcaec7d2", "comment": "Malware payload", "value": "39b6fcc5e98a81f58da7e481a0f09c104ed7f918", "object_relation": "sha1", "Tag": [ { "name": "security-check-l2j4--com", "colour": "#3C6813", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747392264, "uuid": "538934e8-2123-43af-b35f-fa75b640bb65", "comment": "Malware payload", "value": "5e8f0571037468d6f83bb0be9127000d34a73cf40f0e1238e8d09807c91be812a7b90fab2f737bfb0e939d74c28209cd", "object_relation": "sha3-384", "Tag": [ { "name": "security-check-l2j4--com", "colour": "#3C6813", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747392264, "uuid": "05f9ba1b-10d2-42af-9d70-9fdd55ae0759", "value": "T1C0E07DC30556F264D15BF2FB55630E427043C3B72390460EAA12C37D2DC30B54A77388", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747392264, "uuid": "7ad71ed8-0261-410c-9f88-93e63f23ba5b", "value": "6:5juVUmaDOSJAu3uY3ASwMEq7lgitdNeb0Niy2Qpp1tGVUTZDOSJAu3uY3ASwMEHb:5jtmwOeAu33RvtDnNiyjpvZOeAu33R03", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747392264, "uuid": "dbb28f0e-cd4a-45af-a6da-c40258602f95", "value": 352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747392264, "uuid": "2c7ab187-faf9-4cb7-946d-993ee54b5363", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747392264, "uuid": "bdb72b65-8701-4704-88b5-f085e369a95a", "value": "c5cb9b94c127167e0a447243444a6e6a19253d9dde9428ed0c3ccb82b038a564.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b54b47d9-3267-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1747408145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747408145, "uuid": "0dcc17ef-4be7-4f1e-a8cf-9b8aa54cdf19", "comment": "Malware payload (Prometei)", "value": "29e1eff43bd04d3d9bbbf10a18621327", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747408145, "uuid": "e264e327-945f-448a-b1c4-42264be3547b", "comment": "Malware payload (Prometei)", "value": "aeaf62ffbc8ba9088d09ea603be85339ebdadabb807156a3b727166c6fc20e1c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747408145, "uuid": "5c3c5efe-2699-41dc-a7e9-0d11d8cc9160", "comment": "Malware payload (Prometei)", "value": "28499fa6fc74f7efec3b88c537e6e5217473c1a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747408145, "uuid": "669fe149-0859-41b4-ba09-7423bf8391fc", "comment": "Malware payload (Prometei)", "value": "1b6b3393bd7a4fd1037206f98f9ebfbb902aedaab05e4822189e96e5c82fcfa5e1c64a0b316a0e0b3a9449dc381e5e8f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747408145, "uuid": "28ee9a24-6a25-4438-82c7-3aa7735a6ad1", "value": "T1EA9423F8C87D2E3098169B3CBB1A8268F0E15772D9562F6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747408145, "uuid": "11fef050-9696-4fd1-9bcf-327a5d4463a1", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgi:25WOSACZSV6eKRH5EPiamb4DsDwwcS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747408145, "uuid": "23fdf6aa-052c-47ff-9503-b469d51e19f5", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747408145, "uuid": "8341334c-ce32-4ca3-8a23-f57af24d9a85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747408145, "uuid": "32196492-b618-44cf-a96e-ece5f1f5b438", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e8dd1b6-325c-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747403167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403167, "uuid": "55bfbf88-645b-4926-a179-87791eb6d643", "comment": "Malware payload", "value": "dda5bd50f828ba4b93fd683e2a1ec5e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403167, "uuid": "cbacb907-b8d7-45d8-9881-ac1fa4cd9ef3", "comment": "Malware payload", "value": "aecac513e50a07e746ddddad6ec2abc5205122c554db4cf41c2c3792da9dd8e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403167, "uuid": "fb66cbb4-65d9-4daf-b521-6519860729cf", "comment": "Malware payload", "value": "f165e33121d7f6f1142c15400ad2531472fd791a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403167, "uuid": "652197e9-70dc-40ef-a7e9-9a71202d2634", "comment": "Malware payload", "value": "f2486918f27012f88b659bdb3af60f4c47ea96eeae9bf85d88483e445b097999939cd114ad75bccff741dcae14031543", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403167, "uuid": "474acffc-58e3-4148-ac14-6c454c850c21", "value": "T152A52342F6C648B1E17228326B7867216A7CBD305F758EDF67D03A1DE9605C0EB20B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403167, "uuid": "9e3e9651-87d6-4352-bffa-f30c8ceb2bff", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403167, "uuid": "0c140d15-e98c-44b3-9a2d-50c503aa2c74", "value": "49152:IBJUTpc8iYMljoCIrtufFEUPtPSfdjh/SXjlb:yaTFMlFIQDP4fdj4V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747403167, "uuid": "841b2707-b952-4000-bee2-af3e4ad9ea34", "value": 2230224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747403167, "uuid": "182a3a56-195a-4980-8e5d-b6e61c84498e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403167, "uuid": "c10563e5-5d05-4a98-86c6-a9f290763bb3", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f20555d-328b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1747423489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747423489, "uuid": "773fd629-e4d0-40de-ae4d-644c5fc2b5b6", "comment": "Malware payload (Prometei)", "value": "e41c16757387b8851b67fb0950345fbf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747423489, "uuid": "5967f09a-6068-48ff-aeb6-bcebb8bad1a1", "comment": "Malware payload (Prometei)", "value": "af22de162daf4818cbed913efb3f3f4075e8aa1d6c18175fdeb7db3ee13f94df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747423489, "uuid": "4b757ebc-e03f-411e-a5a8-365b76243e91", "comment": "Malware payload (Prometei)", "value": "a55a91c92c363efcdc3f195abe04c88f0c921426", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747423489, "uuid": "99f74c38-9a01-40e9-8cfc-84e9efec068f", "comment": "Malware payload (Prometei)", "value": "a91cd41e3d87f9602582e2743d00f4c10484b757a9b6df732fecbe4a5c917352db8e7d0c432f71b92ed8c13356c59e0e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747423489, "uuid": "9f670a13-0fd9-4bc0-9d0e-033f0272ad7d", "value": "T1119423F8C87D2E30D8169B3CBB1A8268F0A15772D9562F6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747423489, "uuid": "d7855c99-7981-4891-a049-36e43e5bd87b", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitg60:25WOSACZSV6eKRH5EPiamb4DsDwwcp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747423489, "uuid": "a927ecf6-d195-4193-8d70-8003b9e2c124", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747423489, "uuid": "fa5d13d9-3928-4ea6-841f-ee91a2dfd0a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747423489, "uuid": "5346eb04-d59b-4517-9314-a95ef70d9ce3", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "863ec0f2-325e-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747404200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747404200, "uuid": "f3a80cfd-1663-4e06-8406-ffc591ee16cb", "comment": "Malware payload", "value": "d85f91649a6dbc33efe717e2ecbfa65b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747404200, "uuid": "3f05b34d-e253-4e95-9498-f76da74c5e18", "comment": "Malware payload", "value": "afb9ab9463d81d690452914926a91ec2b3948e37383280634fe239ebeb2bc44c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747404200, "uuid": "9b6d1430-7b8a-40ef-a99e-2756ad50b068", "comment": "Malware payload", "value": "54627520064672e6892a4cabca557c5e16ea8dc9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747404200, "uuid": "dc609e41-9835-4c16-af97-0eda075c4072", "comment": "Malware payload", "value": "b02df33d03599344810845c8d16a3afb624b007e05ba74b1865da2ebf35eb76c8634463da1180d2684c26b8391b7c6c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747404200, "uuid": "23d338ab-3187-460b-8195-75d9b85c9327", "value": "T18AA52342B6C648B1E17228326B7867216A7CBD305F758EDF67D03A1DE9605C0EB20B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747404200, "uuid": "dae7017a-0a7a-412a-95af-885b57b91c65", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747404200, "uuid": "ac60e952-9e66-4e6d-a63b-705f5d30a36b", "value": "49152:IBJbTpc8iYMljoCIrtufFEUPtPSfdjh/SXjlA:yRTFMlFIQDP4fdj4+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747404200, "uuid": "2ee3d9ba-c4e0-40b4-80b4-1b4a1bbccf0f", "value": 2230224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747404200, "uuid": "84065988-7d00-4cc0-8079-feeaacfeca72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747404200, "uuid": "969a56bb-7e00-4534-876e-22adf06f3b93", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23fdf144-3262-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747405754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747405754, "uuid": "ac2a6a14-73d6-4ea6-b99c-ff5980825c98", "comment": "Malware payload (Mirai)", "value": "6dc7879f5cd75e61c770a9cc48591f1c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747405754, "uuid": "4402d0f7-c7f4-4fd4-9dc6-47791ec29a85", "comment": "Malware payload (Mirai)", "value": "b0009f2972b0191ee5e50761623d83ef8d9bed1aebee2a39a166bc28efb25d36", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747405754, "uuid": "4f5e5b22-6dfc-4263-8673-fa1165e5a93f", "comment": "Malware payload (Mirai)", "value": "16961ff847767b54b21f266aa59afdc2d5c84315", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747405754, "uuid": "9b0943fc-86fd-466f-8326-7509f948dc50", "comment": "Malware payload (Mirai)", "value": "1e3692edafa586c609533fdc5a3c4829125633e6386ce3522453c3af395c49b5ee170498c840ef4623ef07ccb6efe4a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747405754, "uuid": "0e279440-b8f5-409e-a47b-30e631ea6c19", "value": "T152F2E174E26928DEE41991B8F9B14BE02E744C539583D91ABC0AF34F4D068F1F496FE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747405754, "uuid": "6ba7fb37-7a9a-454d-8af6-b29fb13fdccf", "value": "768:r7W4qrpsi8/vLDaUPECnksvZdMqd29x5XzfEVMpoAERUwJgGlzDpbuR1JD:r7xkpsr8AvbmL5DfEVMpoz2wVJu5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747405754, "uuid": "f263f4fc-ea97-434a-a074-255c89d6c512", "value": 35768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747405754, "uuid": "b787a477-c7a2-46cd-b89e-6029d5905ad3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747405754, "uuid": "b93fbbc7-6c85-4825-8d68-4a3aef881d52", "value": "neon.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f81a9cd0-3250-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1747398378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747398378, "uuid": "c00b0c93-d8d8-43d1-912c-85dfaecd953a", "comment": "Malware payload (Prometei)", "value": "1a8a46ca09e2e6e31d670ee78f1d686e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747398378, "uuid": "468987b3-2046-40d7-944a-1b9dba7ca8aa", "comment": "Malware payload (Prometei)", "value": "b04678ea8ca06969f8c1f37b3506368657daa1e0ba2a3afce72c06c3061f78e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747398378, "uuid": "e8ebe664-6a90-4ce0-a978-6e09fab10f74", "comment": "Malware payload (Prometei)", "value": "962e53aebdeb64028fc7f7a761495beb69d57745", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747398378, "uuid": "3f99a6e6-5b17-47f5-875a-37c79efde372", "comment": "Malware payload (Prometei)", "value": "bc3b242743080f960721cced7d92024df8698fb0cf5393cc3c947affcd58f5b182fc83377b713f458610ebfe8f1bc9f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747398378, "uuid": "47784fa5-39a0-4bdd-85ec-d8c8deb7e95d", "value": "T1459423F8C87D2E3098169B3CBB1A826CF0A15772D9562F6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747398378, "uuid": "1a6fccb5-1857-4c32-ae16-07461661cbbc", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitg+:25WOSACZSV6eKRH5EPiamb4DsDwwcu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747398378, "uuid": "cc20c81a-b0e5-44f1-9150-a69abb7ad5e0", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747398378, "uuid": "c4c73d52-1be1-4f93-a557-17ed351095f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747398378, "uuid": "32ddb1c1-3c54-4388-a608-70368310db75", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8b82f72-3287-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747422002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747422002, "uuid": "5c116769-6877-4d75-972f-c51ac8810a6d", "comment": "Malware payload (Mirai)", "value": "7137679d8b60c86a584cf0d11130e4d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747422002, "uuid": "59b3110b-b0f1-4f3f-aab3-02e9bc3582f4", "comment": "Malware payload (Mirai)", "value": "b060f75c1d3df51e2b9f78a999e808fe7a83d030a1b7d1696de332f6b684e2c8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747422002, "uuid": "3e971827-fe35-47f6-81cf-d2beb5d9dfaa", "comment": "Malware payload (Mirai)", "value": "dca678cc78e3ae90c1a4f71f5aa7c390080be23d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747422002, "uuid": "f74e699f-558e-460e-90ed-fbf9405edaed", "comment": "Malware payload (Mirai)", "value": "7bdcc74625ea74c84433208f321cd8d537042ae3ad2ca3bf6555531abb938dffabdc9e19266cc834d1ce4e36e376d2e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747422002, "uuid": "576af7bc-f256-48b9-a029-8f759be4d19a", "value": "T110F2D05C834981F9CF2BC4FB3FAE179049B04A554E46581F37986ED5ED411F6A08BDC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747422002, "uuid": "54fee44d-1ad2-44c4-b02e-c336dfc9cafc", "value": "768:1h9nb3r3+IGXMwNDusSx1SR/WcQDCtlSJgGlzDpUYsl:L9nbyTMwyARQDCtoVqY+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747422002, "uuid": "de967881-f6b5-4d3c-9219-da3e8cf6884b", "value": 34996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747422002, "uuid": "d98576e3-7382-4f94-87e0-692968690277", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747422002, "uuid": "5389aff1-7e32-4865-b1a4-fcfc77f19e4e", "value": "db0fa4b8db0333367e9bda3ab68b8042.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95948388-322b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747382322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382322, "uuid": "d379b7b5-4fb3-4a8a-86d7-345e82acd07a", "comment": "Malware payload (Mirai)", "value": "c7b67772235ff5f70be835f317939ac6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382322, "uuid": "074ab1f8-1658-4bb0-8a6f-2d5511180096", "comment": "Malware payload (Mirai)", "value": "b0ff1df1396d3baeeb0e5e336ed9854f2fdde16c70d3015c8e30340d2e453582", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382322, "uuid": "740ee6c0-43d9-40f9-9bbc-d43db9974143", "comment": "Malware payload (Mirai)", "value": "29fbbbcf46dd13c8fa326c4d55134c8ab2eca192", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382322, "uuid": "ef1c848e-8309-4d77-aad7-49a509465317", "comment": "Malware payload (Mirai)", "value": "27055117c41b86c2d9efa5b63b16eff08fc154d81178fca42eadbf9854adc68744b10e3a72cae306be820a4763bee679", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382322, "uuid": "489acb78-bbb0-49b1-8866-5fc081dc4067", "value": "T186E2E12592C8A4A1DF706E70D8DD9B80976B0738C2B578A2231D06787BE315F7979CC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382322, "uuid": "201d5c47-5171-4b04-8629-0a08d5391f31", "value": "768:1gQyOmQgo4BHIT2yo3ovtfHFoYySGyk3ucUYj1W3Ufmx:1ryM8I6B3ov3o3+c/Vw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747382322, "uuid": "b424d0a7-fe80-4d70-9fa6-19f7e619b741", "value": 34004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747382322, "uuid": "51d65fa2-e32c-432f-b8d9-cfe845df902c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382322, "uuid": "aa3e6f89-258c-41aa-b813-01e77bb95abe", "value": "rift.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb21eaa6-3275-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747414194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747414194, "uuid": "21f25f60-aba4-41f4-82b4-008e343836bc", "comment": "Malware payload (Mirai)", "value": "6ead1f274ce10ef2faa470a7fafa7218", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747414194, "uuid": "10d7abb1-1a8a-4637-bb42-3a7a2b6af53f", "comment": "Malware payload (Mirai)", "value": "b131a6e0e9eb7b3b460fc7d1e45b5dc9982a92d2383806579920ce3f4e113f69", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747414194, "uuid": "a553189d-dc85-4378-a6a2-c069c1c27075", "comment": "Malware payload (Mirai)", "value": "243c3d13197d9d522ba914f58ac504a49c3fc3e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747414194, "uuid": "526af6d6-7866-43c5-b077-2f7ae15ac5af", "comment": "Malware payload (Mirai)", "value": "124e8dd5f8c4c352e11ef28a69179f95d724e18345343204c011ef98facec3711cef98f036dfd56b99849adfca8f5d88", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747414194, "uuid": "dd5332cd-2ef0-4b2f-96e3-7dd3082cb6bb", "value": "T1F943013FE69DED24CA6DC63888EF7D0D29589E84D657CCBEF6D4801B489472C0F10692", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747414194, "uuid": "7cea7843-c1bc-4b55-bafa-d268dcb5c291", "value": "1536:ujWbW6gx6ZT31M6Gml5ZbJLYE54+RXnouy8HyN:ujWbuOLW1KX93outm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747414194, "uuid": "864d5461-840f-4fbf-bf39-47336b914d4a", "value": 56480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747414194, "uuid": "c8a28955-4aac-4a92-a2e0-d4043ab8ae69", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747414194, "uuid": "01e0cd54-c2c2-4ae8-89ef-d4a30e9690b1", "value": "neon.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c05f867c-3228-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747381105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381105, "uuid": "fedd1382-03bd-4820-9d00-720ecd2ff21c", "comment": "Malware payload (Mirai)", "value": "96d94afdbabcfbf0ec1628139caa2454", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381105, "uuid": "309ff67d-9a30-4ec3-986a-3e614b8fd64c", "comment": "Malware payload (Mirai)", "value": "b2017636d2cf7db5bfb1cc07f640682cefd0f936e98476f6abcc82e5ec69381f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381105, "uuid": "4970b23a-f6bd-43d3-90db-4a786952f934", "comment": "Malware payload (Mirai)", "value": "9482463dd628214bd61e12c6ae557c08d7846975", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747381105, "uuid": "75ba9855-2983-47a0-9099-ef444ee3191e", "comment": "Malware payload (Mirai)", "value": "a7334a9205691694e230645d424fb8a3115009a15e610067007696e8bdb1f5f80a91eb3f74c330ed8e2b83900868ff97", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381105, "uuid": "e73b6eff-8767-4c84-8627-e052e9034173", "value": "T1E9A2D0B3878421A3CE710D73D86E9352A75A94A4D513203034184799BFE786279FF2FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381105, "uuid": "5911d15c-21a3-459d-bcfd-8d8741093ce0", "value": "384:9SwZfBW+Ggi3r5ZBeA4D8fExHXCQsM22JXkIRufWEw5/vty8/mdGU5E//q:gwZpgr5zerD8fGXCjM9+QgWx5/lJ3UcC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747381105, "uuid": "51355c8c-7b2b-4fb1-b945-7c5eed040cc2", "value": 21824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747381105, "uuid": "530966ba-de1b-4c9d-b9c4-16c8606198d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747381105, "uuid": "a051b4ce-caf6-4a04-bef8-2514a717b741", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee0f4d47-3287-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1747421984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747421984, "uuid": "e92cc37d-9bd8-4abf-9f8a-938cf84457ed", "comment": "Malware payload (Gafgyt)", "value": "aa0caa789a668e1c3f67379a720c06da", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747421984, "uuid": "f0a45aa0-234a-4d58-821d-d452435b7733", "comment": "Malware payload (Gafgyt)", "value": "b2101344569bec4e017727f5441f0f10db51ea76fd9b12964461258d55b18259", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747421984, "uuid": "c48dc5f7-60d6-4ef6-ba2f-25642dfc689b", "comment": "Malware payload (Gafgyt)", "value": "b82aec855c9d21035346663ea9b198224829596e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747421984, "uuid": "85ea12d8-f8a3-466a-8932-ecd119c99495", "comment": "Malware payload (Gafgyt)", "value": "39a8e3ba2e715e56cc3e861894a98b22304014ebf5bc827a7fd857b327e00e00eeef8d7712c30a16ed7c6f251703c8a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747421984, "uuid": "16e8ec70-7bb0-468d-bed5-bbf27c97ffa9", "value": "T188043907E4504667C1D227B6B29B128D77235FB997CB331299247EB02FE1B8D1E3E990", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747421984, "uuid": "a1681f1d-f309-429d-86ec-ceaafeaf6d0a", "value": "3072:xdc+Qoe59mUDyjW8Qc7yijaAiBtJpGgHkOahwetJ8add9QzhsKTtjO7SdmyOQ0Ly:xdCcGca7taHOahwetJ8addQ7TtjOOdm4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747421984, "uuid": "ee7c5591-0bc8-4643-a30c-2c5989c33a87", "value": 178185, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747421984, "uuid": "2231798c-7034-42c2-acbb-b8b2314f910d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747421984, "uuid": "ebaedc05-479e-4347-a630-a576c67ab7fc", "value": "tftp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62ae1e14-325d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1747403711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403711, "uuid": "573e339f-4c5a-41c3-bb14-c252f04ab61d", "comment": "Malware payload (LummaStealer)", "value": "b4c3dadf37ac98d671835a6d78cd1d46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403711, "uuid": "d9865c68-34f0-41b4-8a58-5d91597d5254", "comment": "Malware payload (LummaStealer)", "value": "b21365ca9f9cdf3d23eae82f56cf217c146bc5ba9929c6c1ea09fa7548c54e94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403711, "uuid": "9e2a13d9-d74a-4827-9d58-e33d4a545b22", "comment": "Malware payload (LummaStealer)", "value": "2bc9931b29171655dab724eb78651eec6b7770d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747403711, "uuid": "32b4e977-8417-44b3-96b0-a68ab7fd4083", "comment": "Malware payload (LummaStealer)", "value": "448202e4d58b71dcac04680c9c476ccaff00b0f893db813965eb041625e18a2eb6b6df792041c385f8ca97b4bdb664cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403711, "uuid": "67ca95aa-c1af-4c1a-acde-65cdd038ebd7", "value": "T122853307BDB8DE3BC9E445319F874F91EB354210CF67A251168918B0A86FB1D27A88F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403711, "uuid": "d8edbb8f-185e-478c-bc97-0b414d2541fe", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403711, "uuid": "f586f46b-70a0-420f-9f3f-9c7ee90e7fc5", "value": "49152:Ew0ysfICtOQdUvsjn7GbbGZ+Wqa6cwGMT:eysf1dUvsj6bbGZFVwx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747403711, "uuid": "daa09280-fd27-4476-af8f-4da3f3039208", "value": 1844224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747403711, "uuid": "440c2870-b22f-4ebe-a934-ea379c14430d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747403711, "uuid": "748bedac-4782-4960-8f76-0f910d151fea", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd62725a-322b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747382389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382389, "uuid": "8b6165ad-8324-4b54-8744-c387bfeef532", "comment": "Malware payload (Mirai)", "value": "33a4eb3f6de245f189903735d5b9199b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382389, "uuid": "658dc8d5-6a49-40dc-a36c-712a5e550210", "comment": "Malware payload (Mirai)", "value": "b2359f37e0f3ca30be74347a5e6c942529948aff18747a11f85f912703276614", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382389, "uuid": "24bf1a66-ccf7-41c8-9fb5-0fddb4ff934d", "comment": "Malware payload (Mirai)", "value": "d7868569c2feffa4a374b857d6ce81f2e8a025f0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382389, "uuid": "54ca0e99-d3f2-4714-b99c-469cf88bd068", "comment": "Malware payload (Mirai)", "value": "1ba3f69a142da9de3b18262802d88891b3049a6891048047f62e8e6a499b31c9a6738611c2fcc47b03dff1427996719c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382389, "uuid": "9afea4ce-a4ac-46c2-b49d-a3b6746e2bbe", "value": "T16DF2E131BB02AD31C1000E36CFF685902F16C6B456FE725571B4B139E96632E95FB963", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382389, "uuid": "04c7746d-2fba-4016-a2ca-f58148bf243f", "value": "768:XlnAMpJqFAjOpD5b0s0hsEDNAs862oV80xG3tiDecdqs3Uozb:tJD9qNR0hsvsLV8z8HJzb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747382389, "uuid": "0b630d36-c550-463d-a636-2e35894d73e4", "value": 34580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747382389, "uuid": "6e5a5e8a-ab5c-4730-8793-ca93c9cc0bf0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382389, "uuid": "0ab9ac3d-e5f5-4a0e-9910-467049d68018", "value": "neon.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02e87a25-3288-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747422019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747422019, "uuid": "0d5139be-5da5-45c6-8d8d-00c064b743bb", "comment": "Malware payload (Mirai)", "value": "d68ff5269007e9c6dc1fe5004fbc975d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747422019, "uuid": "c17280d6-4c9a-4213-9b69-91e169fe9a98", "comment": "Malware payload (Mirai)", "value": "b28fdc295296e3103e9222370b564eecf68f8d8045f23b952d8b7a84139e3bdc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747422019, "uuid": "342c04f6-3004-4610-a204-fa3340362dc2", "comment": "Malware payload (Mirai)", "value": "a14e3d82c20a35fd42fa77b83e0b3f5844ae4a6a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747422019, "uuid": "0ec70a35-a8b6-4236-a22b-49f5c3665e8b", "comment": "Malware payload (Mirai)", "value": "4c678b87f4a6ff87e27b3a35e9b0484adac6038b1d34f3ac9191f1e8357451fc1ab84349e248004fafac7ed93cfeab7a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747422019, "uuid": "80dd9ad9-e633-4c94-9174-32476de9c9fb", "value": "T1CC03F172C54FE741EAA00577D2370B13AACB7FA5A4D632311D4E0764E597A0B93EC0E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747422019, "uuid": "ddc21f47-95c4-4438-9329-003bda402543", "value": "768:UCtitxC5gEGoG2vQfGkho8qbJGd2NVC9eEI5gWOBfy6q3UIRm:UGZg7oofGk6bxMdIuWgytQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747422019, "uuid": "7e09b627-7eae-4ffc-81e7-0292d9067f85", "value": 37904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747422019, "uuid": "12ea73f2-db78-4546-a8cc-ac9fb0767f4a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747422019, "uuid": "4eed86c9-27a1-441e-bc15-7b1b1c56cbfa", "value": "db0fa4b8db0333367e9bda3ab68b8042.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be632646-3220-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RemcosRAT)", "timestamp": 1747377666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747377666, "uuid": "45b0ce56-aa03-476a-82a6-f8a1cf18cf16", "comment": "Malware payload (RemcosRAT)", "value": "d2a8d50220c7230a9ee15d5bde66403a", "object_relation": "md5", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747377666, "uuid": "e71d2783-8a00-40e7-865f-5c91bb44a016", "comment": "Malware payload (RemcosRAT)", "value": "b2b24840f56af08dc2e2b6f247bf441eb03c7e00c5b839b32f17b82bb67bfd47", "object_relation": "sha256", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747377666, "uuid": "2f0d7f96-5b33-4d81-b905-cf941999a642", "comment": "Malware payload (RemcosRAT)", "value": "5da8b43007585fea500255bd4ad0a24b527e7bfc", "object_relation": "sha1", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747377666, "uuid": "27c9657c-1c46-4ec7-abdc-961a8162ba32", "comment": "Malware payload (RemcosRAT)", "value": "2306230f4cfcafa96d3e49fcf6d20e73a5a24d52eaf724e9978b0869f76e18b4cdfbdfd54826a7b7dd0671dd21957a5f", "object_relation": "sha3-384", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747377666, "uuid": "10666f04-c4a2-4214-a919-4b99a0952589", "value": "T1C5A4BF01BAD2C072D57654300C3AE775DEBDBD212839897BB3D61D97FD30190A63AAB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747377666, "uuid": "96671242-27fa-42e5-9674-fe938f0f5d3b", "value": "e77512f955eaf60ccff45e02d69234de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747377666, "uuid": "4a41eea0-72b6-4710-85ce-cbc88db5b0fc", "value": "12288:x13ak/mBXTG4/1v08KI7ZnMEF76JqmsvZQPS:jak/mBXTV/R0nEF76gFZg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747377666, "uuid": "122fe887-a051-4464-90c8-d10d9967672d", "value": 493568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747377666, "uuid": "0f6ed4b9-9239-4dd2-90c2-3d2f8986c629", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747377666, "uuid": "a94e3343-0d6b-4efe-a341-8ac133856746", "value": "1747377663e2d43327510827a15a837f0f18ff9d7b41c9435d2ee32382f73afbc21d25021c298.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92a11df2-324c-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1747396490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747396490, "uuid": "0671907d-583a-48e6-899b-8be6fa1a0650", "comment": "Malware payload", "value": "2b8d6fdf1664f173cbec4fe9baef968e", "object_relation": "md5", "Tag": [ { "name": "1po56mdxc-localto-net", "colour": "#E5C76C", "exportable": true, "hide_tag": false }, { "name": "AgidCert", "colour": "#56D604", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747396490, "uuid": "c8a237b3-83d9-4dee-86a7-fa8a91dcdee6", "comment": "Malware payload", "value": "b3899787ad6dd1f7b4e039f822fdc9ffc8695a7474e6a49707cd269ddf096b98", "object_relation": "sha256", "Tag": [ { "name": "1po56mdxc-localto-net", "colour": "#E5C76C", "exportable": true, "hide_tag": false }, { "name": "AgidCert", "colour": "#56D604", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747396490, "uuid": "35b396ed-9d2c-414c-b2bc-1e7059813c3a", "comment": "Malware payload", "value": "02d56412a99f966a916d359bc86a6f0e52b5d71f", "object_relation": "sha1", "Tag": [ { "name": "1po56mdxc-localto-net", "colour": "#E5C76C", "exportable": true, "hide_tag": false }, { "name": "AgidCert", "colour": "#56D604", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747396490, "uuid": "a938098c-83c0-430a-8c6d-d605df33b7af", "comment": "Malware payload", "value": "014bf57408b55c03116b3ad1a87fa6c7f6f3428a3b83701cb8dd2be4caeb1671cae5a30c7b4510c2a2058232670825af", "object_relation": "sha3-384", "Tag": [ { "name": "1po56mdxc-localto-net", "colour": "#E5C76C", "exportable": true, "hide_tag": false }, { "name": "AgidCert", "colour": "#56D604", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747396490, "uuid": "8163359b-1575-448e-8718-dd8b4a6e222b", "value": "T14682F96E96F4043585E52AB90327854BE5327FDD6928DA4BF2074C0F6027262DD3FBE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747396490, "uuid": "77fcc7a6-0034-485f-ae5a-cc8af5750925", "value": "192:jzMAZvtFvA4Ocvfpo2SKfdm6gxcKSDY94YoyJyaEN89Bm6M:joOvtFv5ju2v1e3S8WYXJJm6M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747396490, "uuid": "6454cc37-25a3-43e6-9263-5fa20d288d51", "value": 19007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747396490, "uuid": "972b9ffc-e8cc-45f3-8bf1-2e1c4391c9d5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747396490, "uuid": "3c877b60-ccc6-45b0-9410-e3958f203b38", "value": "FA-45-04-2025 (7).vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec0f2ef3-3287-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1747421981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747421981, "uuid": "fef466a3-aec8-4e26-aace-bfdded9401f3", "comment": "Malware payload (LummaStealer)", "value": "9808a677476b79b3f704b944d71d1162", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747421981, "uuid": "ce18373e-b9d5-4b32-a62f-7c2ee2332521", "comment": "Malware payload (LummaStealer)", "value": "b3c91a9caf078acc8c6b8b03807b035885f85acedbe907debb016d02414c1c35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747421981, "uuid": "d718d17e-263b-41af-8bbc-7f21874cff32", "comment": "Malware payload (LummaStealer)", "value": "2cb1bfa87e26e9fc62c49f2195f3979842e79fb7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747421981, "uuid": "c9811375-3151-4dba-a82e-89e64fb82570", "comment": "Malware payload (LummaStealer)", "value": "2b13e851c77e768c438fb51e5ed4392ad782aba81f73abc1de9f4819f72e72aa96725e112bf222c86d3042102c03a232", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747421981, "uuid": "de1d5cea-a5a1-4185-bb04-d6720998e8e5", "value": "T16B95331A29ABC9C4CB0DD0B649132F167F2899E1AEF7C026377B5D67B63F8885021C75", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1747421981, "uuid": "350a3ced-1298-4766-84d3-dd49818bf294", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747421981, "uuid": "f037f7bc-04bb-4ef8-984f-219e3e48417e", "value": "49152:DNBc7C4fK9ZURP5sHBTg6KoIu88s/6fwUbIs9Ow5mgmk8+:JBc7C4fKzoPm4o/1g6fwC9b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747421981, "uuid": "63997040-077e-4d9e-914c-f9fde1061774", "value": 1915392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747421981, "uuid": "4a55078c-b6bc-45b3-a0f5-05166da6cfd7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747421981, "uuid": "8193ecfb-50e1-4fe2-8999-c4f074d3f309", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a3e5d41-326a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747409361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747409361, "uuid": "22266390-0ec4-40d6-b3ec-9d9d7820c035", "comment": "Malware payload (Mirai)", "value": "a2c17c5dc74df30571355cbd04a1a100", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747409361, "uuid": "20d52ea3-1810-4cd3-b81e-de5318d246a9", "comment": "Malware payload (Mirai)", "value": "b3e509f39806502fe4cda978305e89854fdaa7c46ee365bb6895233068d91c0a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747409361, "uuid": "1de02581-ba23-4eb0-823a-fbe2b16e4c88", "comment": "Malware payload (Mirai)", "value": "04725efa86e6a8fd1edab9e38bcbfd8e6ee7695a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747409361, "uuid": "91a9f945-7c98-46ae-ba6f-0c5e07d49c70", "comment": "Malware payload (Mirai)", "value": "d59f0f93a74c97a83fb1b6eb4b82a748aaaf90c9602e74012561f2d5a6703f27c51bc087db87e552948ab7579cf961dd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747409361, "uuid": "1f38920d-5c6e-4838-b471-cb0923538c1b", "value": "T19273841ABF654FF7E8ABCC378AA91B0124CC651A21A97F797930D814F24B24F55E3870", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747409361, "uuid": "88a472bb-8092-40f5-a39c-bb1c2789f822", "value": "1536:7p/bgkjaVYjj/46mI7MZz4ODnu9d6dPRRo1/:7dbgkjaVYHzQZz4eP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747409361, "uuid": "60758dc1-6d0e-487a-9a9a-96b83ba6f852", "value": 76476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747409361, "uuid": "eb070ce4-50ef-484c-9cd2-ac27e703922b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747409361, "uuid": "d51aaabe-46d9-483a-9562-17ec75ccd03f", "value": "kwari.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e01a4663-322b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1747382447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382447, "uuid": "f3431010-6abc-4254-aa92-c3e16a396759", "comment": "Malware payload (Mirai)", "value": "081bd07aef255f5058c2b85cb299f3e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382447, "uuid": "b6e9a1a7-303c-4487-b3c3-1de64ec7c260", "comment": "Malware payload (Mirai)", "value": "b3e5d47bfe82e5b16be4b1a23eb0245ce3b9227107d5b18deee7e81cbc93cf82", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382447, "uuid": "46fbcaba-b75f-49d6-9b7b-9b3521fa55a1", "comment": "Malware payload (Mirai)", "value": "d3e9f1c8e48bdc454b17c3b8a8d61fd83da2ec80", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1747382447, "uuid": "c7551293-911b-463a-9474-ca8f010e7a89", "comment": "Malware payload (Mirai)", "value": "9c27a2794638c98d71aabd3eadc3b57683b3ed2c61327d3b8424fd3a8560a6ae775b0b3280e1abf25cbaa5389005b121", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382447, "uuid": "c95364eb-446c-4d84-98f3-fd180de7fd45", "value": "T15473295AF8819B22C5C1127AFA0E114E371307E8E3DE73139E24AF71778656B0D7B816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382447, "uuid": "d766f4a8-be3a-4dff-85ca-2a6e110e3a62", "value": "1536:1AnWf7Y0AhV+q8iMMbD09CuuaipfOQJMYi/uT+F6w47eJ5ZYWek:vrA98h9CfaiOuT+F6w4CJrR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1747382447, "uuid": "57d2e0b6-a729-40b0-8d0a-50a546cbd529", "value": 79196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1747382447, "uuid": "a9d219d4-3154-4a56-b011-ceb0647acd72", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1747382447, "uuid": "cfaa0413-64d1-4d57-915a-c80427e61b4a",