{ "Event": { "published": true, "date": "2026-01-23", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-01-23", "timestamp": 1769212982, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "e7129c37-d298-4394-a177-bb5122418a36", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5adb38e2-f830-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769154701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769154701, "uuid": "40482c07-fb1f-47a3-871a-93f5ccc53ad9", "comment": "Malware payload (Mirai)", "value": "19f603654dd3802ea355684955304239", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769154701, "uuid": "810b3d36-b9d4-476d-91a4-045528ffb50b", "comment": "Malware payload (Mirai)", "value": "000e8049d4d0ffa293f37491561ea085d562e20430250b5637122fd5c106e2c3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769154701, "uuid": "55b1194f-17f2-40ac-8309-3f40d464fd77", "comment": "Malware payload (Mirai)", "value": "4510486304bec99c77f10b430ce770f255f96ba3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769154701, "uuid": "05196a3b-b2f8-4864-8542-b41bce5de455", "comment": "Malware payload (Mirai)", "value": "0309e7b59cea2e99fa7245a11bfc0ebeff6742fba5bf5657bcadcecf2cae9cd877d5c11123c52cb2ddfd1be8ded8d94d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769154701, "uuid": "0dca54d8-6c78-4adb-8d76-cac7825cec0b", "value": "T1DAD3F845FC405F23C6C612B7FB5E428D3B2A17E8D3EE720399256F61378A95B0D36A42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769154701, "uuid": "7b10608e-7f40-46b0-971b-0b598ef2622f", "value": "3072:gHZ+X/AoxxFOV48wlP5nARTaPu08BiO49LS4ib7:gHZYACAV48MP5nuk9G4iv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769154701, "uuid": "67dd3833-b635-4154-a9c1-b0873b905760", "value": 133888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769154701, "uuid": "a5a89502-79a4-4d9a-a286-5d4d2c88eb6c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769154701, "uuid": "1397092b-f4c9-4451-8b00-1a92c2f0419b", "value": "bot.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc4d5bae-f830-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769154864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769154864, "uuid": "b0335db4-1ab9-4980-be3b-e16552c22aaf", "comment": "Malware payload", "value": "fa594f28309e304f2e991dc643b2efb9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769154864, "uuid": "0dd0ecd6-69f6-4ac4-9151-9fb801e9ebba", "comment": "Malware payload", "value": "0045c0b93dbdc0d6c8885ec0cf29e750f2a64bf2fcd6a7c07065dce3b4c20363", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769154864, "uuid": "13c3113d-25c0-4327-9f61-c794741443cf", "comment": "Malware payload", "value": "335a6d9902677b3efaa41267dafe4a1631a2cae5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769154864, "uuid": "1c69dde8-6ee1-4980-94a3-c9d18febda31", "comment": "Malware payload", "value": "3686ba7c1511f3f0a0365a72c813fe3e436a90eb86aca8c78c6bf4b19bfa224dc6f9d4ee938f0453105ca6df2f33d8db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769154864, "uuid": "6d3e3dda-1003-4e7b-9c67-540a916af917", "value": "T15393B509EF600FBBE86FDD3706A81B5235DD551722A83F363978D828B64A50B49E3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769154864, "uuid": "95bfc033-07dd-4baf-b9d0-9bb0afa06195", "value": "1536:/5aGkClHyfDW1Nx920HWTQXQFEbzPbK4Zr1FPaGMADO4dJ:cD0uWLv8+b64TtDO4d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769154864, "uuid": "56caa50a-ea25-4697-a4a1-0b7a93340046", "value": 89528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769154864, "uuid": "825dfbe1-5277-4f1d-8f60-3b98398301fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769154864, "uuid": "d851cbd5-eaea-4b56-a34c-3412fa963faf", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ab830ff-f80f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769140393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769140393, "uuid": "ad0ad6e2-78fc-4694-aa4c-98b7c3bbfd02", "comment": "Malware payload (Mirai)", "value": "94daad63838c5a87a2a54057c92361b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769140393, "uuid": "76039e62-aead-417c-a685-01967d7ed267", "comment": "Malware payload (Mirai)", "value": "0057626e8a5345ea434dc4f3afffb6a6e115ef1b1e684738143cf1125979eca9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769140393, "uuid": "89628d00-fc1f-4849-a6d2-0f5924e2e7ef", "comment": "Malware payload (Mirai)", "value": "67d94b74559e3e75e7d9462381283e3510c448c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769140393, "uuid": "b2b9c4ee-6e92-4ad6-ada8-adfc2ccaa0d2", "comment": "Malware payload (Mirai)", "value": "6451374c75424b65aa01089b701f57c3288b7bb912e53c3fcd14cb9b4af68ff7980b3b820211fc8fd1613feb5d55f1cd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769140393, "uuid": "5d748370-7ad7-463c-9394-514f60312ae3", "value": "T144437CA3CC2A2D28E45589F5B038CF749B63E415958B2FB911BAC3795043E8DF14A7F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769140393, "uuid": "d184ced3-34c9-48a7-b109-fe87c89c8912", "value": "1536:m/5un+BzIJwAvJQuMK3eDd79f7QaC+p2ULeCC:mRufT3Ax7QaSU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769140393, "uuid": "3e177606-30b2-4ed4-802d-f442f9266802", "value": 58140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769140393, "uuid": "96b3eb8e-ba5f-472d-be52-ee1848618119", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769140393, "uuid": "ef6a514a-143a-4caa-bb9f-5512fb84acde", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c407621a-f860-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769175493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175493, "uuid": "cdd1abe0-dcc4-4a37-aa71-912a79fdcd72", "comment": "Malware payload (Mirai)", "value": "c02b0b341f1e6e08053c5dcf54ac2ee9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175493, "uuid": "56b54b58-4c16-416f-8c3d-431150c15f4c", "comment": "Malware payload (Mirai)", "value": "0218821633763f08fa37c2a7b59cd5f18c454c0d6d23ac823aa6ae840cf0b61e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175493, "uuid": "b717210c-5a2e-4bb7-97b5-9e02a7da0cbc", "comment": "Malware payload (Mirai)", "value": "9f090800b4f655e0ffcc43d0cff6369d1f78bbd6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175493, "uuid": "cb00214e-498a-43ff-b8d1-d5b32b5144b1", "comment": "Malware payload (Mirai)", "value": "a36edb0401284fe282922f34e6837abfc7f18b2bc49466a5411d7e0f29af63e42652f715e68606b04cf78b857f5c80ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769175493, "uuid": "d9d81712-1b42-421d-a357-f74a9f6ecdb1", "value": "T11393B74A6E218FFDF768873047B74A21A75933D626E1D685E29CD6001F7034E681FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769175493, "uuid": "8a0ed445-fbaf-4550-b420-30cd8434f36e", "value": "1536:J7l23RZPV5uAX4nn09TlL5ovZeijsZhkv:f233PVFlTlL5oahkv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769175493, "uuid": "17a08a97-2463-4aad-821c-73288800fb0c", "value": 88820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769175493, "uuid": "4e6dbe37-af3b-409e-b757-1f050e2a62df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769175493, "uuid": "355392d7-a74f-46a9-b81f-b81a940b18cd", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cec969ad-f83a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769159190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769159190, "uuid": "821bf8dd-f673-43cb-8110-665a0caf666e", "comment": "Malware payload (Mirai)", "value": "703d7463beb63feebd4facf2e0f15add", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769159190, "uuid": "1c8d3cef-8b59-4b65-b0d7-70e08e26eabb", "comment": "Malware payload (Mirai)", "value": "022025342910595ee6b7a025b209ff5a2b1840cbac7e5345a6e5ac4ed5c37f92", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769159190, "uuid": "a40f5a21-04e5-47dc-897b-8caf1aa4fe2b", "comment": "Malware payload (Mirai)", "value": "2cb7c975c7e6cbcd91cd4df9909bf7e8e6809371", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769159190, "uuid": "8079f674-1166-45d4-a633-db18e98353b6", "comment": "Malware payload (Mirai)", "value": "9a279c062208c50b9e4bffb0abc1ee9b23469072d0637604a18c2e7952d9cde97fa53514e8410ad7d67a70f3a5857504", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769159190, "uuid": "16e8aa70-f12c-4f11-abac-e6e38d0e4a89", "value": "T197631917B8829B11D5C512BAFE0E514E33135B7CE3DE72129D24AB2077CB9AB0E7B815", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769159190, "uuid": "7cc69fb2-ae7a-4dc2-bb47-badeb11b88ab", "value": "1536:3snNPNmDqBgcEvnc3B8CK6xa0Bb0ps+PVC+it0eAjRkK5YYwxo:eNmEgPvc3lK6xa0qCt0dtkKiza", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769159190, "uuid": "b182aaec-ce3b-4d6a-8874-fd9ea3d18cea", "value": 72872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769159190, "uuid": "56fc3e3b-15ca-4c7c-b283-c0cf5d456b47", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769159190, "uuid": "b215db99-55e2-47fc-bcda-e6611356f33e", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3726dcf7-f829-11f0-a129-42010a9c0007", "comment": "Malware payload (BlackMatter)", "timestamp": 1769151635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151635, "uuid": "a12a7cdf-b7d9-475e-9c02-fa2612fe3c94", "comment": "Malware payload (BlackMatter)", "value": "3aec3b9525dcbac3e7d6f83980c93d18", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151635, "uuid": "e77c35e0-fd1d-4f42-8293-d1a00a5d6da4", "comment": "Malware payload (BlackMatter)", "value": "023280288a154681b1652c24289acc49e44beb65e1f12948aee25dad981b3e0e", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151635, "uuid": "f9de9473-edd3-488f-925a-540bb20411fb", "comment": "Malware payload (BlackMatter)", "value": "5a924ce418c0f91c7b31deea4aed49824af62c73", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151635, "uuid": "0716df7a-0bf0-4384-9e61-a8fbfdcaf999", "comment": "Malware payload (BlackMatter)", "value": "49958108e1a47547592d7332d190b0fd303a12ab058c5b195ea61e413d6b4a4f15d0c6ce0fe82612659271660d4d04de", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151635, "uuid": "9a5bcada-f178-458d-9757-1ee77fb39c13", "value": "T164E37C21F212D0B3C83718F13736B572F39E4D2C19A96817E6D90F99BCA08236F45A97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151635, "uuid": "d5c8aa9c-c352-45d3-966a-6ddf8568557b", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151635, "uuid": "38e645c1-f294-46a9-ad6d-cba8bb3efd5d", "value": "3072:56glyuxE4GsUPnliByocWepjj2cqT5Cc:56gDBGpvEByocWe1j2VN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769151635, "uuid": "7cf61c8c-a574-45f3-adca-542c694d21d3", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769151635, "uuid": "031125c7-bcb1-4101-b5ab-024da1aa55d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151635, "uuid": "3ce5208b-0fca-4e53-be5d-096a73dd44b7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d45a696e-f865-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769177668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769177668, "uuid": "bf6ec03c-b86f-4c5e-8a45-1e66f552ef23", "comment": "Malware payload (Mirai)", "value": "fd35ece242556fa490676d9db3070dbe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769177668, "uuid": "14eeef1d-c4a7-45f2-9232-488588c975ef", "comment": "Malware payload (Mirai)", "value": "0488844caefa6b3079a1dc188bebb21fbfc966a5c7318c98d7739de257abc32d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769177668, "uuid": "b2c91e1a-9d4c-46e6-94af-3d1b6dde1402", "comment": "Malware payload (Mirai)", "value": "5ecd4ad4b488412fa56388673efcc50328b9c302", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769177668, "uuid": "7ff9101d-01eb-470c-8b29-94ced70f551b", "comment": "Malware payload (Mirai)", "value": "5ca897faa294824bbcaae1dc5042e9a83f041ec442761884d7041217e43c94fb5f219dbf8747d5050727a4b1a0f09470", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769177668, "uuid": "89fb30eb-d978-4a4b-9112-7dc16a5a63a3", "value": "T118C31A45FC405B13C6D212B7FB5E428D3B2A17A8D3EE72039D256F61378796B0E36A42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769177668, "uuid": "8ebd0b2d-09d3-40a3-bc73-00c66436aab7", "value": "1536:Jdv+s43G5bUWkURAASh71QAFMxK4VIGUT2yd69O/LsA46nGtplEGwyw1FrR7DVP6:jv+XQ3R7g71QNE43Uqyd69O146GPYbT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769177668, "uuid": "7ff182f5-3663-47d1-b4d4-01acd494a455", "value": 129792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769177668, "uuid": "231dac4e-14b5-42ad-ae64-2f474c01e667", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769177668, "uuid": "ac493afb-b097-4300-b973-66ca773327e5", "value": "bot.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25015902-f88f-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1769195413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769195413, "uuid": "387493f6-cc19-42eb-877b-7c40481e83ca", "comment": "Malware payload (ValleyRAT)", "value": "00b84d595265ebe892bbb18682b5ffa4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769195413, "uuid": "2e546d56-83ad-4121-9c02-7a7cb6ba1060", "comment": "Malware payload (ValleyRAT)", "value": "0614c1c45ff21a2eddf629cfc459ee1b4f5034e0bb093e127d916216f3b8b1c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769195413, "uuid": "82ca3609-ad36-4a64-a860-ca18a63cb39c", "comment": "Malware payload (ValleyRAT)", "value": "7bbd105f553a85fb47b3787f99839fef00131449", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769195413, "uuid": "660692dd-e9d7-492d-83b9-93a3af43f548", "comment": "Malware payload (ValleyRAT)", "value": "1e7e8bb0d4898f0d02fdbd36a9180a38f64669e28ec4e35600462a77af9a588bf2b5ca23acd382b3f47ac32a9597b8d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769195413, "uuid": "4e9d4c7c-72b8-48cd-b1e3-55d095fa21c7", "value": "T124D36C4733A460F9D4678279C9A24606E7B374660775A3CF13B086A66F137D1BE3A331", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769195413, "uuid": "8d4302d3-7637-4c72-a3b9-2c2ee7dcc037", "value": "c4c4ba3b2d407fde97c1108270ed1cfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769195413, "uuid": "59d4344b-653c-4fba-ad5f-e197d7f827ea", "value": "3072:CkEOSO65mF9xns+YsDjT4ZQcIhkpNzGbq4/WD5FbsPjelxIU3ezoA:CkEJ5YcgT4ZuhkpNibq4+VyPQlPA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769195413, "uuid": "82f28c66-0516-4a5b-9fa1-e6b0f80bff29", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769195413, "uuid": "c9bb7d2d-dd07-46e9-8443-dac954415cd7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769195413, "uuid": "a85d629a-c23b-4fd1-b718-4e3b19b861e3", "value": "0614c1c45ff21a2eddf629cfc459ee1b4f5034e0bb093.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "328e0054-f847-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1769164512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769164512, "uuid": "ce90a178-ba9e-4c02-b43b-e663e28b3c02", "comment": "Malware payload (ValleyRAT)", "value": "35d7d76835e8644f8650efb4e8995af6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769164512, "uuid": "d45c8c10-76c2-42d3-83c7-de92766aecf8", "comment": "Malware payload (ValleyRAT)", "value": "06fbe6ea88df54d1d4e2e50cac0c44874c8a4e2e2e7dab623938f38fea70dcf4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769164512, "uuid": "b4c02e20-b11c-475c-9df7-b1e85ad96f93", "comment": "Malware payload (ValleyRAT)", "value": "610f306919f2da9ce9cfd92ae9d4f5ff2dbfb65c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769164512, "uuid": "d56a8a63-c39c-4bf7-a705-92a512529ce6", "comment": "Malware payload (ValleyRAT)", "value": "edb49113f12901ea71de5d8f8e29d2c46de1761eb22ddacbb090ebeba88d4e34e46f1e83abfb6e8ee83a3538edea1b92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769164512, "uuid": "b0a1638a-68e4-48a0-a75e-5451c23006e4", "value": "T1B437AE0BF9A541D8D0BBC13C89675712FAB1B8454B3057CB2B50A3A92F73BE49D7A390", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769164512, "uuid": "c5527e56-d5de-4af0-80df-b5a77bbe89a8", "value": "b5195a86117f20c0c491365082d1dd4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769164512, "uuid": "2678f942-27ab-4f53-8dd3-a485c3a28609", "value": "393216:ulmZTSwpmex006UOoP8EpWzxsmeulUrGhn6YrIN/MsmST:uEAD064P8EpWzxsmeuOrGhn6YrIN/MsL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769164512, "uuid": "656dbc71-769b-49ab-b259-a9df98d8e137", "value": 22374912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769164512, "uuid": "face6642-f928-480a-b0a4-30ce2fa1d885", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769164512, "uuid": "820cd118-e63e-443a-a38d-e8ba4e443725", "value": "x06fbe6ea88df54d1d4e2e50cac0c44874c8a4e2e2e7d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82d8e252-f825-11f0-a129-42010a9c0007", "comment": "Malware payload (Phorpiex)", "timestamp": 1769150044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769150044, "uuid": "4f9b8108-9a00-4a88-adce-8328fe4e9c71", "comment": "Malware payload (Phorpiex)", "value": "c1c333e46b57b2c12a96915e43b2939e", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769150044, "uuid": "beec7c03-4441-45e6-9817-25ccf6089f57", "comment": "Malware payload (Phorpiex)", "value": "08aeadb7453ab5762b51609871c7b15782af7025a349516a4b4f905d6c7be871", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769150044, "uuid": "7226fb35-9018-4901-af38-50a368bea063", "comment": "Malware payload (Phorpiex)", "value": "8aaba18e69dbfbce2515422f3306678fc491fd0d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769150044, "uuid": "c6378606-65bf-426a-ab9f-413d5460914d", "comment": "Malware payload (Phorpiex)", "value": "009e0477f5f24f237cd3b476580d51fe8b4833130cab28084dd5b90fcd54eb2a53d4b222109d7f20d32c8728c079009c", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769150044, "uuid": "9a17e920-eb09-4039-a609-e9b052b0cefd", "value": "T1CEB37D1034C1C472E527157688AAC7755A6EFC700F359ACBBFC406BD8F266D1AA35387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769150044, "uuid": "e3b8078b-1b92-468f-847f-82f31c78fdbe", "value": "c6cbbdd643acf2dc6daa2bfb97e98d80", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769150044, "uuid": "9d739258-8a8f-44af-843f-590799a66c10", "value": "1536:YahS3W/OdukaPxMzmIWXzoLDeVsnPWXSBv0+a+5HgK:vhSG/SaKPWXzoLqVsK+a+5Hp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769150044, "uuid": "86990549-b9d5-4d89-a07d-76af0e51e820", "value": 115712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769150044, "uuid": "c08cda9d-b781-4b3f-a15f-9bb7d02edc7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769150044, "uuid": "c985acc3-c694-4b1c-b82b-81071effe652", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80a977de-f864-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769177098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769177098, "uuid": "e4db9468-70ae-4304-94af-ef78a759c164", "comment": "Malware payload (Mirai)", "value": "e1688501e993e8a08c97ca512aeca730", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769177098, "uuid": "16ddb6f6-9eeb-417d-a7d5-feefb76c7abb", "comment": "Malware payload (Mirai)", "value": "0a401ef20221ec54fe4a873b7ef0953676001ea80c74c7114580d8ef3d0ff739", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769177098, "uuid": "ed328169-a61d-4076-968b-4ee2e0f15b34", "comment": "Malware payload (Mirai)", "value": "7b42264f220271181913eac27482bd50eda74a6a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769177098, "uuid": "1f1be08d-2dba-44f1-9a41-d25c225dc1fc", "comment": "Malware payload (Mirai)", "value": "920288384ed3871623e58ed601fd79d3fc3deecaf7265f8e13b0cffccb7c4514cfff268ac5c1fe1a2b39e4ac7fc609c8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769177098, "uuid": "8128f051-df3d-43c2-ac1d-524d40e934e1", "value": "T14AE32AD7F800DEFAF80AE33748530905B630B7E245925B372257797BED3A1991863E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769177098, "uuid": "9541b2a5-b6f3-45ad-9650-ca2097bfaefe", "value": "3072:SuRsZR504+TWvhKyZAjAzyslYtVrjbiQLrBXEtycwcEO:zsOcjZ4AhlY/LrBEyczEO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769177098, "uuid": "9a612499-eaf1-426e-adde-8139b1966e67", "value": 150496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769177098, "uuid": "7434284c-dd2a-4e0f-bb45-051f63a0aab9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769177098, "uuid": "a464af43-fe90-47e3-8995-91fa59afb1aa", "value": "bot.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08e57153-f89e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769201808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769201808, "uuid": "3b64d19d-2ae4-43a9-999e-a72896d2eaba", "comment": "Malware payload", "value": "a427a8f2123628809961bbcf25a01d0b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769201808, "uuid": "aa413758-21f7-49c0-a67a-6de89d25116a", "comment": "Malware payload", "value": "0ab0af5d18ae4a05593b1fa6c7ba87906761203eaf15372f4527d5870d66be42", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769201808, "uuid": "9594539e-45de-4ae6-a600-dbb227b10cc1", "comment": "Malware payload", "value": "de83146ea36459f0ec23f9682dec43448f5cbfc6", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769201808, "uuid": "e5e91c2a-59ba-4c7c-afe1-7efb7fc33e31", "comment": "Malware payload", "value": "6c33580287c5d5972713596c9f2a0933bf9a988fba5b218db6983a1313f5b57ef4d435a751c4c4ee1daebe9bcd6988b4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769201808, "uuid": "97b547d1-4cfa-4d88-8e1a-35f3eda75141", "value": "T12DE0EDCB60D7F646CE3AAE99606684446006D3C820B3CFA5E4855976889B6457014FD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769201808, "uuid": "19b8ea93-cb20-4b51-9167-5731d5563980", "value": "6:SbSWJjbAhTuxSWJtSA1OSWJvaa6A3wSWDAASPnDnSWK6AADSWgT1A+eX4y:HWJbQbWyYxWFf6SWDQ/DSWp4W41YXT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769201808, "uuid": "698be8e4-dd8d-4610-af92-19028767e8be", "value": 368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769201808, "uuid": "aa9296dd-c626-49a9-90b2-71cf2e50d668", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769201808, "uuid": "ae2dd231-4509-4802-84ec-6bde073cd833", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e7cf406-f812-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1769141930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769141930, "uuid": "f662bf14-0a2e-4fe4-87b1-58ea24263ddf", "comment": "Malware payload (ValleyRAT)", "value": "6332c9e3c530e951159901ae63561a4b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769141930, "uuid": "9b15be09-678c-4191-b1f0-4b44d315b83d", "comment": "Malware payload (ValleyRAT)", "value": "0ab348e15caa97c08f7803915216cc410b4bd608058fcf01ba3fbb152da0d84d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769141930, "uuid": "64be71ca-6287-4347-acc5-9ac7faf25e32", "comment": "Malware payload (ValleyRAT)", "value": "68af89b953fb8692c15383ca1436d225253135b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769141930, "uuid": "fd9f8baf-6bdb-450e-aa99-224e50c28bef", "comment": "Malware payload (ValleyRAT)", "value": "0291aa2adcd63ad40a502299d19082666fcce3c6c2112c9db2a7827733f3189248f009d727ed5f3a11e97964646c6f13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769141930, "uuid": "fdc16621-c7a4-4f31-b33f-87fd969315b7", "value": "T17A2833CC21856B2AC1985B7A4CB99A94F41B3C682F61550C51EFB7F0397F99BC0B423B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769141930, "uuid": "862c621f-9c44-427c-af7b-44f6927b65c7", "value": "039d1617d5f0788dacbd04b35a141ebe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769141930, "uuid": "b18fb7f6-bf00-4811-8b70-a6944a12ffbe", "value": "3145728:urq9dK4cfeOhytVe2jiyTHtD02yd8AVLYAq:104lgMVWyhD/yd8AV0P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769141930, "uuid": "ab8361af-19c3-4de5-815d-e6da502b6ea7", "value": 101298170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769141930, "uuid": "2bcdf016-ebb3-4d86-8ed3-15ff97ba3e63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769141930, "uuid": "008c79cc-bdae-4c8f-97a8-e04e312647cb", "value": "Xnmfiwabyhgvmikef.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8a53cd5-f876-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769185030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769185030, "uuid": "f6e15c30-9acd-4f7b-b555-1acb2c08a18c", "comment": "Malware payload (Mirai)", "value": "42bd9d4f12b8771714577c66f7cda860", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769185030, "uuid": "d09c668d-4028-4b13-a8c9-f30e812c48f5", "comment": "Malware payload (Mirai)", "value": "0c6eddd1d6c15173a0c3745f31772fe7f0f18b2b6f0766a8b6341ff642cd5630", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769185030, "uuid": "b14f4927-39de-4dce-8d0c-a24e43477beb", "comment": "Malware payload (Mirai)", "value": "aebd5f5c7e0b7a743b755849f040df2076d0a6e7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769185030, "uuid": "a758f0f3-0327-43d9-bfc6-635d12f6a2c0", "comment": "Malware payload (Mirai)", "value": "6b3ea65a2d5b80dc9a3dc852ad5ba75a5b5f58145760767d16dd8b6f88ec8094a6bb6786185d751aab52b0b9186d8f80", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769185030, "uuid": "24f35e20-d6b0-48a0-b074-921ddd417d66", "value": "T17E519FCD29A10A351C56D4B7E269C64C214B80BB0CBA9F41E8DE36F4C0ACE4675BCB62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769185030, "uuid": "63e23ae5-f3b2-4ac9-8af9-43cf03fb4018", "value": "48:vzyfl3GJJVXntjxE7QWT9GDprb0Sol3CsKe3DugrB4i93PaJarnaeVcaxdKxy:vzyfl3GJJVXntjxEtT9G1Azl3CsvDugn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769185030, "uuid": "9b60232c-3845-4190-b015-b047aeb68117", "value": 2898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769185030, "uuid": "de320955-b45c-4f31-a052-88dff379d9d9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769185030, "uuid": "eab64053-1139-4bf7-9e59-d0df5270ed32", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76531d93-f87c-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1769187389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769187389, "uuid": "beee4ddc-4440-44e0-a912-3737bcc9bbc7", "comment": "Malware payload (Formbook)", "value": "3825f9adae4b28feb3ba19dca174c10c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769187389, "uuid": "4e7f45d4-0fa5-46a1-bee5-516dd1f13120", "comment": "Malware payload (Formbook)", "value": "0cc5a2fd9f73331cd37bef1667d4057e325c098602c61de8aa3a94cfe08cc519", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769187389, "uuid": "80e5982d-b05b-429e-9a0a-af5850b48b81", "comment": "Malware payload (Formbook)", "value": "f6b0cd48faafe7729d186d73862d977337093db2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769187389, "uuid": "d8970cd6-f4c6-474b-b303-6d5f8a3b6e90", "comment": "Malware payload (Formbook)", "value": "8764a7389be80601f7b306d3818758e5b1a2fd906a1e8f3bb035e7f186fe4471ebfec0e3ce8af253e87af9f2def166c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769187389, "uuid": "8fbcd7dc-16df-4586-8912-2966a1e8060e", "value": "T15945BF027391C062FFAB91334B5AF6615BBC79260123A61F13981DB9FE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769187389, "uuid": "3904eaf3-c5d7-4a75-a855-97d9a53f5677", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769187389, "uuid": "2475eb0f-6024-40c3-bc10-4857db8f9bb6", "value": "24576:v5EmXFtKaL4/oFe5T9yyXYfP1ijXdaWzf4RN4MxTRMVZrtsFDaJiM:vPVt/LZeJbInQRaWzKN49eW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769187389, "uuid": "d5f2e565-5b7b-4763-8cac-b2c879db7d0e", "value": 1251840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769187389, "uuid": "6e56766c-e7a1-4fa2-9e11-70d24243ace6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769187389, "uuid": "b1cfa8d9-88e2-4cce-a893-b2b8a2bc326a", "value": "1EP041089.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96a6549c-f85e-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1769174558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769174558, "uuid": "612d28cc-b8a3-42ad-a718-cac07c4c04b3", "comment": "Malware payload (Vidar)", "value": "0fd8140976ccedd428f206b87821461f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769174558, "uuid": "399c5536-7ad4-43fb-abb5-e6cc03529298", "comment": "Malware payload (Vidar)", "value": "0d39bedb355db41014782eae1ccb7780e981343f0ff1d867fdd23d34ebb5c5d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769174558, "uuid": "2d684563-a3e3-4ce6-bb1f-0c4bdfaf196b", "comment": "Malware payload (Vidar)", "value": "77373440eb381e11662e3bdbb17234d4a669c0a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769174558, "uuid": "134f1d05-c167-4bbd-a3c3-2bddb968ecfe", "comment": "Malware payload (Vidar)", "value": "999b27786c4d1f748624e262fd5ac584f625bfb50126ac7006182f9fc3de67250c9ce46c44e8704abc45ad94d6f19b15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769174558, "uuid": "c96e978b-5172-476c-8222-c59a6a2203b1", "value": "T1D0D53807AC918865C4AEC134EDBA5049B770BC044B3573E72E92BB782EFBBD4257A354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769174558, "uuid": "20169ed0-eeff-4e03-9f3c-fab0040557a0", "value": "0951d9f67c9a9e1b6ea746ed01bccc26", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769174558, "uuid": "aedd3917-263c-4c13-9db8-67cb6fb89fdb", "value": "24576:aCVNteO8puml+m+aDSVsRKR73/QyXuM1MYCpkw53nLGKD1IbueXRd:aCleO4umltVSVcG73/XqYCpkw5XvKuI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769174558, "uuid": "72a2a894-06ef-48f4-9108-ac675b38bade", "value": 2944728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769174558, "uuid": "ded70ae3-094e-4593-adfd-182e79f178a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769174558, "uuid": "3b71d359-462f-455b-a1b5-f7c07b444669", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83800eae-f829-11f0-a129-42010a9c0007", "comment": "Malware payload (BlackMatter)", "timestamp": 1769151763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151763, "uuid": "c0016714-5442-40ee-86e7-63f40fe963e4", "comment": "Malware payload (BlackMatter)", "value": "f877556c934509f401f17b4a8ec8d1c8", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151763, "uuid": "35e6ed17-8da3-4702-8085-3693f47faa82", "comment": "Malware payload (BlackMatter)", "value": "0f14a05d458d8645c63e666c96ff0314fe2461daf81a19feae74ef748378f60e", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151763, "uuid": "2a7b6321-4f52-4160-9216-32bd9ba46985", "comment": "Malware payload (BlackMatter)", "value": "0a9dee6c03e49644fb9ae7f908637f6ac94de750", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151763, "uuid": "fdf67ffa-fbaf-4ba2-ad0d-371e8daf37f9", "comment": "Malware payload (BlackMatter)", "value": "86b621cdb29a4f101337ee88d15ebebab487a03d2a794d68c8e7808f1e834ae33786ba1c88098d5e893335e62897b8dc", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151763, "uuid": "8520c755-78de-4abe-abb0-e83dd1e6c340", "value": "T1BBE36D21F612D0B3C87718F127367572F39E8E2C29A56817EAD80F5DBC648232F45A97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151763, "uuid": "d2778a0e-48fb-46c8-add8-41952f6fc404", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151763, "uuid": "d68a06a6-99df-4cb3-a367-6fbea3fb84fd", "value": "3072:A6glyuxE4GsUPnliByocWep7p9b3YjzYAVvIIQU:A6gDBGpvEByocWeFpNuzw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769151763, "uuid": "2bcd6b4c-6f0a-4850-8a87-49c21a95f2f3", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769151763, "uuid": "01e277a7-135c-4cd7-b761-2cc904a43f35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151763, "uuid": "4b37fdd3-9be8-4194-8776-d4afac9f7fcb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a3c9545-f865-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769177490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769177490, "uuid": "d58e3762-514c-4d2f-9e48-363ab4a816cf", "comment": "Malware payload", "value": "fb21a92518347763b769b465efd28ae6", "object_relation": "md5", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769177490, "uuid": "0c77bd37-959f-4add-8097-9ac6aab3ded8", "comment": "Malware payload", "value": "0f3726b4ac1841d4baff65396acc3a70c628e5f6c04bc3e2fbe7413b1099044b", "object_relation": "sha256", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769177490, "uuid": "c41683ef-f803-45ec-a66f-25375661b5d8", "comment": "Malware payload", "value": "df020d14b152d1417e4de8f06359108d472cb414", "object_relation": "sha1", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769177490, "uuid": "b4180a6e-9b10-4269-a5d4-8f6831a37129", "comment": "Malware payload", "value": "b274b4488c64be18857fee56e5661f692ec4e449c730b566b45b07d07a1d86644b081d54265fd0513117fa54d9fe0df0", "object_relation": "sha3-384", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769177490, "uuid": "87be4162-6d66-4c84-ab26-0c03fa03aa55", "value": "T1670733C885E0C909DBF376AB28F48915166A0C5F620EF2DA752593DB0DCE4F28E75C9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769177490, "uuid": "9346b361-21fd-4600-8087-14e85929f908", "value": "393216:2EehduRaUkqQWLbwjogzQSEV3kRgZciImM6GfDb7U4zCAzkv0C1KrEmO7o08:2EWWLbw0SEtz2ivMLDjFkc3EmMo08", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769177490, "uuid": "418d9a04-3f40-4a03-bcfc-2e7373adcb4f", "value": 17446504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769177490, "uuid": "f8a8252a-2ae1-4b21-a69b-f05c9f6044b9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769177490, "uuid": "d58a76dc-b612-46b7-ac15-0eaa02770f4b", "value": "bottle", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba89b456-f830-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769154862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769154862, "uuid": "d35fd069-d751-4499-84d2-e8738505fa13", "comment": "Malware payload (Mirai)", "value": "7fcfaa14a8e3c42366548a2ec15b1cab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769154862, "uuid": "14373c2a-f498-48e1-b504-aa6485d715fe", "comment": "Malware payload (Mirai)", "value": "0f50ef34334a2dd1f69765a340a93fc293fea57865f9bfa3ceef429aaa8f9b71", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769154862, "uuid": "80349d21-9228-400b-af96-134c20734bb8", "comment": "Malware payload (Mirai)", "value": "edb87ffd69887e649deaa0c80edebf622f858ede", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769154862, "uuid": "d1eb0c8d-9a13-469e-8f12-5ba6c704d134", "comment": "Malware payload (Mirai)", "value": "ae84c53bc28c735877bb0f9ae709457dd33deedb05d65fd800c85b99bc4204153ac1deb0ddc94c6222f1dc86cc03306b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769154862, "uuid": "22372b47-a9b1-4a95-a820-fcc99de87851", "value": "T1CED32A06B30C0A47D2632EF03A3F67D093EFAAC121E4F640355FAA899175E365586EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769154862, "uuid": "2152f900-22e9-423c-9cfe-0ee68b131b2b", "value": "1536:WUHQLSWPOHYOlI+QcAizmJxpHvTHNIUMpQfg+CbPMPHvANIKUjjWfM/qiMkkxN/2:9WPOx9VzexZ7HZng1PMANZxNbhI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769154862, "uuid": "218192e4-6d42-494c-ab13-f70580c2e4dc", "value": 132376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769154862, "uuid": "5cade497-e2c6-458d-9b79-db4d3d13d792", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769154862, "uuid": "03deea94-18a7-446c-abf1-26f112636823", "value": "bot.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eda772f2-f864-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769177281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769177281, "uuid": "6043ffc6-1ecf-49f2-9654-62bbbb15687b", "comment": "Malware payload (Mirai)", "value": "332ea3ee7e6ecf92ff04c568369e90e3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769177281, "uuid": "3ce7be73-6b89-4e47-83e6-5f269fc72d66", "comment": "Malware payload (Mirai)", "value": "0f9d6f6d7bf227842228719c332170ca920bc8fb7449d62dc8871862269b3be8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769177281, "uuid": "97cb49f3-727b-4504-b804-6549e466a69f", "comment": "Malware payload (Mirai)", "value": "0249d55dcd70442c64bc562bff15026eafb04dcc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769177281, "uuid": "944d8b9e-80b0-4552-875b-951ac3ca7efb", "comment": "Malware payload (Mirai)", "value": "933a619d668bc8a82d7d333e09f690933cc4dd5e387212a4ec316f97215c27b64cd0ede0dbb44d5e230c94140c7910d7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769177281, "uuid": "61561fff-db01-49cd-aaf6-a6202cf2f7da", "value": "T10583E8CABC848B10D5D525BAFE0E218E33538B78E3FA7113DE185B2E538AC5B0A37555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769177281, "uuid": "d4fe82ca-244b-40b4-8f7d-6e6c776c896d", "value": "1536:/PdnXrCJWrRNZtuHNFQxWKEeUYfF6sdQm4MD3d7/m2K2lJHiqyIFTHp5:/EJavnQNqxWKEeFfF6nm4MD3d7/vXyIJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769177281, "uuid": "c6aed6ea-aa96-4993-8bc2-42d0700e03cf", "value": 87412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769177281, "uuid": "b4810c58-a7b8-4e63-9ef6-638ce775b301", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769177281, "uuid": "99a1047c-d257-4d4b-a3ae-f37942f8ce7a", "value": "zerarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c46b7a2-f829-11f0-a129-42010a9c0007", "comment": "Malware payload (BlackMatter)", "timestamp": 1769151804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151804, "uuid": "00eee721-ebca-41f8-bacc-130f361f5f55", "comment": "Malware payload (BlackMatter)", "value": "b859ad88dde748d124bae583d4396096", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151804, "uuid": "0821da2b-7fdf-43f3-9c4a-de218db5b9d3", "comment": "Malware payload (BlackMatter)", "value": "0ff637682614ed66cdc76643efc709b6af08351dd701f92604a406ccbb3bf045", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151804, "uuid": "022a4b64-e6f7-445c-8a25-f9599da5d64f", "comment": "Malware payload (BlackMatter)", "value": "68159f248440e396b4c9806893a95bad852691ab", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151804, "uuid": "39984bba-82ad-4d1b-a881-91aaea6cdd1d", "comment": "Malware payload (BlackMatter)", "value": "db2d99c59b31d79f166b35644796ec72f3b9a46928246c1516aa1bbd7c26a2dd2a89bc8b7daf75625418cb6da9506ff5", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151804, "uuid": "ed5294ed-2019-424c-8748-5934bea484ba", "value": "T188E36D21F212E073C83718F12736B572F39E4E6C19A96847DAD80F5DBCA58232F45A97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151804, "uuid": "14c112e9-4bd0-4515-8c17-aa2e148bf197", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151804, "uuid": "e9baf830-b191-4f91-b41d-2b4ab5741fa9", "value": "3072:M6glyuxE4GsUPnliByocWepYFIklvGoNT:M6gDBGpvEByocWe4Ito", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769151804, "uuid": "b38597d6-c174-4660-9449-52d5555ba621", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769151804, "uuid": "7438f610-c344-4c36-b394-4fdb856f8ab1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151804, "uuid": "47c208d6-7084-4ad6-854a-baf746374b44", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71c662cf-f862-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769176214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176214, "uuid": "75b36432-f67e-4aec-82d7-183dc3b95317", "comment": "Malware payload (Mirai)", "value": "62d032e1ece110b98966c7ddbff3b3d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176214, "uuid": "b63b5ed9-13ec-407c-89f1-e044d37379c0", "comment": "Malware payload (Mirai)", "value": "1068de113f54c8a8666e9b945eaa7042bfe774b2b11d0e8d986fe1f3f08695a6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176214, "uuid": "597f32f0-f2c2-4f22-8153-e8cdf5c00166", "comment": "Malware payload (Mirai)", "value": "2631d3317399ac26320d5164c00955ef682fb44c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176214, "uuid": "d35550d4-2c8b-4f4d-8fda-146b3e823ce9", "comment": "Malware payload (Mirai)", "value": "3a283e7a9451a330147bc8f384358cfcba229ece5c5c22810ae584fe8955833a930e10675d12397a3e389d58f58cf40c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176214, "uuid": "366a0ffa-b570-488e-b18d-e47bcfe28dcd", "value": "T16604885E6E228F7DF668873447B78E25976823DA27E1D644E1ACC1101F2039E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176214, "uuid": "64120c6c-9872-470d-a72f-9da0e6e2d0b6", "value": "1536:yl2JvnXPvLDQ+chMJdDNsCK9HFP18tOQGgezLiM+C27TfF+h/iuf/P/z4d/o:ygv//cwZsCK9ltSOQ+LidFS/v/Pb4Vo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769176214, "uuid": "9d1c6732-9b3b-4485-9348-94cb6a771916", "value": 173796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769176214, "uuid": "958f74ca-b80e-43ff-8fff-c18737f047c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176214, "uuid": "49944feb-0f76-4a9e-8429-e012e1689a8f", "value": "bot.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca901787-f863-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769176793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176793, "uuid": "62cbd837-e4e0-4e92-bc85-cc3f53994f7d", "comment": "Malware payload", "value": "190e3571e8248a20fd625dc859a4590e", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176793, "uuid": "4e67b9a5-38c7-40c2-bcf0-abb331932f87", "comment": "Malware payload", "value": "110892a8c3c58ed38dda69836cf4d591f96fe2b376a087c9dc23e96c5806ca66", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176793, "uuid": "9949ebad-b18a-440e-9969-79907a5efa66", "comment": "Malware payload", "value": "7ea08b6d436f7f718828527f99ac73dadebb36b7", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176793, "uuid": "70ad47e9-72fa-4c51-8617-3dde4aa9aa8a", "comment": "Malware payload", "value": "ab779a23ade48bd0191b571982277f2e3e14681c5f2ce17c28b171aa8923c40ecba7121bcd40533c6ba023a2925256e2", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176793, "uuid": "eb53ea56-b886-4db2-bc19-3009cf655413", "value": "T13F11B7BC469D886ECCFC8C0BA24BCDC050994A7D655CD6738CB2E2ECA0B622982560C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176793, "uuid": "3e2d5865-235c-464d-ae53-aa8171de598f", "value": "24:ZOrs+9IT2u2g/mJskWvvayWOe4gCS94EPRvg:ZSJ9I5l/mJfWvvBUCS7PFg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769176793, "uuid": "3f1499f3-18ef-4040-850b-17179ab58656", "value": 908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769176793, "uuid": "1276156b-6c37-4888-809f-bb667e33f728", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176793, "uuid": "b7c3b3dc-d599-494c-8acf-2909cc5b074e", "value": "Annexure-1.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dc5c0f1-f857-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1769171537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769171537, "uuid": "616cb977-6a3e-4229-9e64-24508d3499a4", "comment": "Malware payload (Formbook)", "value": "a788eb0c66e877cef51f3ab21d147f1e", "object_relation": "md5", "Tag": [ { "name": "c9r7n6", "colour": "#559ABF", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769171537, "uuid": "349dd015-0cdc-4893-803e-4bd442810f35", "comment": "Malware payload (Formbook)", "value": "125ecf04a563d09a00f6ea38ea4edfe35b86a817ac40eda019bbf9c6f1e40bdf", "object_relation": "sha256", "Tag": [ { "name": "c9r7n6", "colour": "#559ABF", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769171537, "uuid": "38960297-a791-4f90-b946-3933d88fe7d3", "comment": "Malware payload (Formbook)", "value": "cedaa09e03f0d49c8d386a3be678fd4981616c68", "object_relation": "sha1", "Tag": [ { "name": "c9r7n6", "colour": "#559ABF", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769171537, "uuid": "f32bdd41-cb28-4944-8e7f-1f95bff62d36", "comment": "Malware payload (Formbook)", "value": "1c4ab4a085c367253710766737944b6b6fd05df4140afe554e9102b99293e0f1115942cd371ff448d0b3fd8d08fda9d4", "object_relation": "sha3-384", "Tag": [ { "name": "c9r7n6", "colour": "#559ABF", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769171537, "uuid": "622f9f37-81a0-4fc2-ac31-5dcfb0a861a4", "value": "T1D8A3B7C977C9B03807673827776FB09AE52FDF91614D4060E28A9D98BE21309EE7953C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769171537, "uuid": "d36bad84-1dac-4e30-86b2-a6e0a252d881", "value": "1536:gfaSqgntF1Gon0Aj9j/59GbEmGWmAED/pM3nNHlwcNfy1:gfQghG0jR9MEbWmAEDhSnNH+cN61", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769171537, "uuid": "5f76aebe-c7c0-4ec4-8a5a-52fb82c42c32", "value": 106107, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769171537, "uuid": "52543f10-fa3d-48f0-b407-22f5ffa8d0fe", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769171537, "uuid": "fad414e8-1162-43fc-baf6-60eec0e9531e", "value": "Purchase Order.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bab1120-f864-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769176902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176902, "uuid": "d03abc7c-3776-4a1a-9a2f-4cdce831e315", "comment": "Malware payload (Mirai)", "value": "734c09ffc6e9f06625a837a693d376a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176902, "uuid": "c177d984-43dd-4686-9e01-c4db12b1650f", "comment": "Malware payload (Mirai)", "value": "1324b7889d04146a419cb1b45168e0fedc8b4bc51b962f0c09a23e0274de7197", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176902, "uuid": "6870dd61-485e-4158-9c33-8674dd0bab80", "comment": "Malware payload (Mirai)", "value": "e46ed9b568d46f504adce49d0620e523afcf3324", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176902, "uuid": "b3284d76-abed-4e49-923c-f2152bb55eac", "comment": "Malware payload (Mirai)", "value": "5cba9a526051544b7fe6fd08d476147a867eb636dfb85b4c9bf55775e90d0642586a30c9a78e558e8403f90425d51cb2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176902, "uuid": "7d238025-2b88-4123-aebe-a328a72f8a68", "value": "T16C430B95B982D612CAC07677FF4E42DD771643A8E2FE73039928AF24278781B0E3B551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176902, "uuid": "0ad8b241-6553-4130-b1ca-2177072688cc", "value": "768:3W6+f1e9irMOCN3K+oqTdubeAZcf7d3jYTsetIeEh1ROvqPXstOw/b:Me9oMFN3tcZcf7dTteWnXLw/b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769176902, "uuid": "53c061fd-3e4c-49a8-a57b-cb400ae79d01", "value": 55200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769176902, "uuid": "6665819c-8316-4d42-bb47-8e467265f1a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176902, "uuid": "ff61d164-9c3c-4010-8930-184c06afba31", "value": "nabarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a93c988d-f880-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769189192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769189192, "uuid": "5d42234f-3c16-4ff8-896c-95f654ede4b0", "comment": "Malware payload (Mirai)", "value": "d89301d641b256372cb1b24735450e8d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769189192, "uuid": "c8555b0e-af94-4a86-a446-3519f857a71a", "comment": "Malware payload (Mirai)", "value": "136b4df11d2a76b7643d9b3f1ec147c4f9abc06b1006e26d8c9485cbddedb0ea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769189192, "uuid": "68508e27-c8b0-4208-a85e-0643a085c3eb", "comment": "Malware payload (Mirai)", "value": "dcbdc6992800d1e36fc7ab02ad1f66f02c5f03b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769189192, "uuid": "28da85cf-b8fd-4845-bbd1-c9a8c50cd732", "comment": "Malware payload (Mirai)", "value": "28416168e24546f093dbb3b1d0428b1f754d8493e6f6ea1f2303c285c9cc65f2f6db2cbb0e79b3bb007877ff2af264d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769189192, "uuid": "143f42c7-8d40-4539-b886-25e0f059c8cb", "value": "T1F1146B07FA82C1F2E19306725097C75A5734C9311316CD07FB895EB9BC7660A8A2B7BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769189192, "uuid": "81b050f2-20c4-4617-9b7b-ba3b9c4db677", "value": "3072:OjBYE9gsA5W+ZQE7EnVt90incaAp6tLTalQDJiIi4yYTldQSAQ7NjhgYSdj:qBYE2sAPaEoXnc80TIi4d3hZSdj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769189192, "uuid": "b7f49dc0-ae75-4ea2-a6ff-9332d5f6847e", "value": 206000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769189192, "uuid": "646fd36e-38bb-4b61-a22a-ccb29b9dcb2d", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769189192, "uuid": "7e9dbe35-8566-4bd0-bd24-c645259df791", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "877ff828-f806-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769136737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769136737, "uuid": "67011957-6f30-4d38-ad3a-80c7a5515274", "comment": "Malware payload (Mirai)", "value": "df2dcaf70e8d15f03053d5185f740f3e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769136737, "uuid": "701f1535-ba3f-4599-b270-3b7ee12fd2ac", "comment": "Malware payload (Mirai)", "value": "13fab1a575330eac6bcbb329a5bc1b0fbaa6639c0d3ab56f34c63fcecdf37913", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769136737, "uuid": "3d21e5e1-8240-4089-ba3c-8ff0f2fec269", "comment": "Malware payload (Mirai)", "value": "fc4550206d53e307206207afde01a5cd2472a2c7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769136737, "uuid": "a8630997-82be-464d-87e2-600560b759a0", "comment": "Malware payload (Mirai)", "value": "084560ceee060486d6ef0dca7ad9a73e083aa916791071af2b3f0fcb70ada5ed7f6309a6ab077daf96ecdbdb5f2002df", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769136737, "uuid": "3db0a3d9-36c8-40ec-98a6-78fc94963869", "value": "T150534D01730C0A43D1A76EB43A3F57D1D3FEA9D022E4E985291EAA8992F5D3251C6ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769136737, "uuid": "1b6e82dc-8826-4ae2-8aa4-f06e0c6f4c29", "value": "1536:BNU13CqU8ax0n3JewHQW51ugjUqaZ+8vSYQI9O8ArP:SSpW3JtlTOnvSYTOHT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769136737, "uuid": "3a7b361a-f9c9-493b-ae02-c971e6cd6fac", "value": 65656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769136737, "uuid": "7b69d85d-144c-43f1-9f8d-78e9ee08859a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769136737, "uuid": "3107866b-2356-412f-a598-c68d81db6df4", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cef8293-f864-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769176904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176904, "uuid": "442e6c6d-b0e2-4492-8fbe-6f38319b5fa5", "comment": "Malware payload (Mirai)", "value": "76355a7e93d77bbaf1d2fd2cbac88113", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176904, "uuid": "dd72f235-1fc5-4308-9387-8399a82ff224", "comment": "Malware payload (Mirai)", "value": "1486692ab8793bd206dc95d4fb22b3cb9ab7f96b1b0cc4c0051821e4800455ec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176904, "uuid": "6e899b7a-a76b-4d14-9f88-174fd17da03e", "comment": "Malware payload (Mirai)", "value": "42b101501bf53cfc6ee261bb6250ff347e7b03e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176904, "uuid": "02f8133f-4c43-4904-9b2c-b6ea280e1a31", "comment": "Malware payload (Mirai)", "value": "967bbe82a94857898f228b8604da9809d30b08cdbe3816cdb3b8ce0619ea8625035b81db68e8d5a6917987bcf7e6fd5b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176904, "uuid": "d1fc2f1e-d770-4426-b373-24f77e962275", "value": "T1887309CABC848B11D1D526B6FE1E218E33134B78E3FA7113CE185B2E574E86B0A3B555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176904, "uuid": "1ff56873-44fb-482c-b19f-6e98d566cd45", "value": "1536:zdntuEjF6j9MtiiFF84lLdEAqYf8W6sqbaMrbIMxirfp2VBu5:TjcBJaFdlLdEAPf8x72fp2VBu5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769176904, "uuid": "263b793a-999b-4fed-ad4e-e9f8fcc1c399", "value": 74956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769176904, "uuid": "433f90a3-ee89-4396-a995-744f018f33c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176904, "uuid": "329ae2db-5178-4689-a1d6-c95194fd8bbd", "value": "zerarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab118e93-f829-11f0-a129-42010a9c0007", "comment": "Malware payload (BlackMatter)", "timestamp": 1769151829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151829, "uuid": "dadc7e14-23dd-4a5e-af74-6ede22cc089c", "comment": "Malware payload (BlackMatter)", "value": "b13b11e5b192fb6e6bc13e93a160da36", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151829, "uuid": "4210e8a9-f027-4655-bfdd-fabb79a8ab0d", "comment": "Malware payload (BlackMatter)", "value": "1589fc5bd6b430feec62c625914d94f73e261e45655f98f8553fdda708d12800", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151829, "uuid": "2c67cabc-d0ff-44db-b8f8-ba7a857d9242", "comment": "Malware payload (BlackMatter)", "value": "142a60359f83657ba56a0365956d18c29e433605", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151829, "uuid": "577c6c81-6398-40a7-872b-2db49571ae50", "comment": "Malware payload (BlackMatter)", "value": "6d17163b42e9d88255ac1286e2cf39ed3fc891627c5c0f3aeb331b0e7384fa4a9912d1baceab932eeb9c66b09bb48eab", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151829, "uuid": "d6a795a9-9528-4212-8726-8ac280fd9f60", "value": "T1B5E36C21F212D0B3C87718F12736B5B2F39E8D6C19A56807EAD80F9DBC648232F55697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151829, "uuid": "5822b07c-3acf-4e0a-b7dc-6735e21414e0", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151829, "uuid": "a85583ca-0559-480c-abe4-af46739e12bf", "value": "3072:z6glyuxE4GsUPnliByocWepKjM8wmxlbg8WTGIThR:z6gDBGpvEByocWecjM8w4lbgzfdR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769151829, "uuid": "cc89dd25-f88b-4032-b2d2-7039a78fed4f", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769151829, "uuid": "d68d6d50-575a-419f-992f-3c0d2b4c5b86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151829, "uuid": "850b40a6-abbf-4f75-a7c6-010c1db6c7ba", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26e825b3-f802-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769134857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769134857, "uuid": "107ab86e-fe64-429c-95b1-5fee0eec2cef", "comment": "Malware payload (Mirai)", "value": "41a4ad97fffb5573667d41b0011f1576", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769134857, "uuid": "2851d124-88db-4405-ae93-ffd4c706e38d", "comment": "Malware payload (Mirai)", "value": "15da48c82e7b95da9e8c23c1ff0c90e70578da4a521a768dec60528d29235b37", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769134857, "uuid": "69cddda8-663d-4c6e-a7e8-f1b22b1d8e0e", "comment": "Malware payload (Mirai)", "value": "ac389118cdf47caa38fdb2c2dde7fde34b0e9df9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769134857, "uuid": "a87c1901-aa30-4040-80d1-5b737980aa18", "comment": "Malware payload (Mirai)", "value": "84d919731c70a92a59d6fc1f98e42be4a88f570d0cc8adbbd6c93b96a352397794c84165a41337c06c97cbd5f4f6ad6a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769134857, "uuid": "d9196184-fa1a-407e-913c-504e176f6160", "value": "T19193E80ABF600FB7EC2FDD3715A91A49258C651712E97F3A7A34C818FA4A50F49E3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769134857, "uuid": "f9f03013-7d2c-4ec6-870e-2bbcfb3589b5", "value": "1536:932fCidnnJARyxmU0ZMZziQk9BBWaRakzZyFUyIYoB7eY0yWC1bZ/3Ia:x2fCikU0ZIziQk9B4aHxyXotWGb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769134857, "uuid": "eabec770-0e54-4101-8cde-15366ec27897", "value": 96768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769134857, "uuid": "04e3f1a5-651c-44b1-93f6-ee7ef36947f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769134857, "uuid": "2687f3d4-5c1f-476d-bc5e-069e4efa53f1", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f964eb2-f841-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1769161957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769161957, "uuid": "8b46b4fb-17ae-4c0b-b0b3-8a910ec95667", "comment": "Malware payload (RemcosRAT)", "value": "ba291819f8130927770c508958d7581f", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769161957, "uuid": "8d5858fc-0cf5-4812-a090-db5ace4c68f3", "comment": "Malware payload (RemcosRAT)", "value": "15ee53d7416cb099f8c0805e4d8296b4f55fe10f2ad6a08a84d73091a8ab9a1c", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769161957, "uuid": "39a43c7b-5beb-4461-8998-d2924dc98264", "comment": "Malware payload (RemcosRAT)", "value": "417a9c42b6b22aff95c58fa4aa4218b264448e14", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769161957, "uuid": "e2bb9978-76cd-4c7e-86ca-641044b0a202", "comment": "Malware payload (RemcosRAT)", "value": "b8b9bbdb590044e4aa6523266d7f6c5970cd87e602694bf4c5c074b57894cdbad81a9a0e746f79e892e31aad1a9fb4f7", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769161957, "uuid": "774f60b2-7563-4925-b9fa-3fe00ae26f50", "value": "T159D3071872FC0A5AF8F7D7317AE6A2279431BEA045314E1D29C61B4A3E31724EF5137A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769161957, "uuid": "8489e041-8239-425f-a5e7-ba6c24715124", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769161957, "uuid": "f3a1b72c-b6fa-4e8f-9f91-35e35f13ba32", "value": "1536:eDKrwrVGIYzjB+y8S5Si97RtAiynO6ZGNsq6GjwwM5OKsO+I1QQt5obM/NeA6wvX:eDQwrVv3Ssi99t36ZNGjI5Ob", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769161957, "uuid": "8fa5b340-36a6-43cb-987d-3bce2cac8495", "value": 138752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769161957, "uuid": "29fb6f7c-b057-46db-b48d-2e23a0c1f7bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769161957, "uuid": "2396e94e-8047-4756-bb69-d4ac928188ee", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa3d7ea1-f878-11f0-a129-42010a9c0007", "comment": "Malware payload (CobaltStrike)", "timestamp": 1769185758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769185758, "uuid": "7671731e-e21e-4c83-a945-badf25683f37", "comment": "Malware payload (CobaltStrike)", "value": "e4c7541b94ae14e15b8b6155a5318fb5", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769185758, "uuid": "92078a78-6499-43f6-be84-7adf353f9017", "comment": "Malware payload (CobaltStrike)", "value": "16b655a9a39acb43e4dcb5e384b2dff66dc0c774a58d8714598b313fe1264c9c", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769185758, "uuid": "9366db99-4353-4995-b4ed-ce2f4eef1565", "comment": "Malware payload (CobaltStrike)", "value": "c3e0bf86c16bdeb168478df2232c8e81df25ce14", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769185758, "uuid": "3083bd09-630f-4889-9a4f-db6a07e9406a", "comment": "Malware payload (CobaltStrike)", "value": "d54dace8ccccfc547a725b0db38cf001abcf6c59a6961d9a8b9efb70761cf14210b424ebaf9a12d1884f3495ec88afe6", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769185758, "uuid": "86a0d097-79fc-4412-9f00-2bcf6c293374", "value": "T1F8161265E8DA40ECC817E1FD9BDA9E76EC7730550F2457EB83F053392A228E4CEA6101", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769185758, "uuid": "888dff10-efdb-4002-9cdd-d0c565a07b4d", "value": "3d3988c381c216812ceaebe4fb051fc6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769185758, "uuid": "6f6a7fc5-41d2-4b41-87b9-3ffa828e58cf", "value": "98304:X5TJAsm3rq818mVc+GfhGlrbwkhtnVuMjA0C:ZqBbq818mC+GftytVu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769185758, "uuid": "7a4a7e27-a29f-4703-bc42-8bdb8f34571e", "value": 4256256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769185758, "uuid": "88dc973c-c494-40fc-9b2e-ccdcbe2020f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769185758, "uuid": "30b92929-6a94-4949-9bf8-0516d07975a5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57dda262-f85b-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1769173164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769173164, "uuid": "c99e1e2d-65ee-4538-9597-f2f2d9023084", "comment": "Malware payload (Stealc)", "value": "eaeb0e0479399d26ca958f0df389669f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769173164, "uuid": "edcccb9d-c247-415c-89b2-02ab34fc6484", "comment": "Malware payload (Stealc)", "value": "16e4b233b7f20b34d36f7448b9775bb2abf08cd01382a0f1088307711f2bebdf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769173164, "uuid": "2f45e6c6-1e40-4480-a91d-8469eafebc7e", "comment": "Malware payload (Stealc)", "value": "f3b9fbdc9af6450bfc8d22fd7c45a584f224bd05", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769173164, "uuid": "cc0d11d0-0424-46bf-b537-3c5e489c6d2d", "comment": "Malware payload (Stealc)", "value": "335ecf2429eef847886cc68268fdeb2bbb3f21247eadef3ffaeaf45671503e13ad58acb2b566be3b9d174315ff14c5a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769173164, "uuid": "90c65af9-9a33-4ff1-bdce-3732bf2d9b83", "value": "T1D3E539032C918DA9D46AE23DE9A241827A64BC390F3273C32A807F7D3E776C45577B59", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769173164, "uuid": "00d61372-1e89-4b2f-bf71-86916a6af0c7", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769173164, "uuid": "65cea148-3fe1-4726-90ef-4c975681d9f3", "value": "49152:ONOvrrLSzEQ3dNbV0U1z7a2wRoXbDIdWucXjKiMbOVSuEMMw+:OTiMd+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769173164, "uuid": "79e4be0e-117b-422e-82cc-e5e7959a305a", "value": 3319000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769173164, "uuid": "db8574e0-66c0-4062-b297-59b857ba6c74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769173164, "uuid": "1b89da49-8683-40dc-bdc3-372aa651108f", "value": "CrimsonLoader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c7c1387-f895-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769197949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769197949, "uuid": "a78c63f0-e02e-4039-8169-b6f3345fcfe1", "comment": "Malware payload (Mirai)", "value": "1c79a0ee168b9c2a467b3b71af21587e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769197949, "uuid": "6255c2d5-2522-4815-9260-b038b5abda8d", "comment": "Malware payload (Mirai)", "value": "1aad28b739cee9c56b143ac86a504d2c3521868b08566f8236e418609e4463d0", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769197949, "uuid": "6ef93c1c-a50c-48d4-abf2-501f60af266c", "comment": "Malware payload (Mirai)", "value": "580e7ac12b539f5a544ded4948e4f74a3d1215af", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769197949, "uuid": "75157ebd-b614-4224-b4ed-8a36f8d16560", "comment": "Malware payload (Mirai)", "value": "877d65ef6f524343f70811e4a008ed72bb62d7023627f44fff1d2ee2cab8eafb57d5bf4606e0947c1cfe1bc3d173757a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769197949, "uuid": "3091a33f-878e-4546-bd90-cf921db3937d", "value": "T159019ECF61141EBB85648F28B96364A8730DC1D5F46326486A57083B8CE4B0D7564FC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769197949, "uuid": "028a62dd-51e5-4a82-a299-d37a5f5e585d", "value": "12:xVHMVH5VHjIWKVHyeH3VH6tJVHnSXVH4VXVHB3VHFVH32VHTgOWn:CIxHQtvrVLdn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769197949, "uuid": "ca849c32-8fcf-4f54-95b7-87e38dc1aa95", "value": 751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769197949, "uuid": "bbb10051-c1e3-4699-9da3-1a9e735ec8fc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769197949, "uuid": "9e2312c7-cb0a-49c4-a2cc-e3d01daf5e66", "value": "t.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6df0d1c-f817-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769144172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769144172, "uuid": "970c0fa8-7c5a-4330-9da6-772cf6c04e20", "comment": "Malware payload (Mirai)", "value": "3bf9b2455244ba753f64198da7a1c39c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769144172, "uuid": "f7469df9-bd07-4d97-a3a8-a9c58985adbd", "comment": "Malware payload (Mirai)", "value": "1b7cb51331ce505ecec2a0ca5b07fd1b843ccb681175300b1122589fb0681c82", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769144172, "uuid": "ae059827-5614-4feb-a3fd-b2a31b5cd267", "comment": "Malware payload (Mirai)", "value": "21341c7f8894705b6734526be23813605cd43e64", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769144172, "uuid": "5589d374-c465-42f1-971e-b3ae5a6a3fff", "comment": "Malware payload (Mirai)", "value": "d59219431268a5a7a0575c59faecf074848204a88363ea9e8daba7d354613da5712084ccc8a1a165dc611c62fee229fc", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769144172, "uuid": "e8f2d2c7-7170-44b7-a5c0-7f5c1f2db1e6", "value": "T199F07D9F6164CE214ABCC5BAF3B94508A0928445F2F45FE3D3854C73AE8694C3AD131D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769144172, "uuid": "38fc2162-ba5e-478a-88ae-dcfc1ed9f0ed", "value": "12:FE8i9pAC7PkxGWi2jTKg9dzCXDdg0XgUC0P:FE8G/LWi2jT6XDdP62", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769144172, "uuid": "72816644-b58a-48ac-ac13-88f3383deb5c", "value": 646, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769144172, "uuid": "ac0121c6-a8b6-46da-bc72-f854cf5bf6ae", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769144172, "uuid": "8ad72de6-cf3d-420f-9a1d-5b66c8fe1c79", "value": "pwn.xml", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1f754ee-f860-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1769175490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175490, "uuid": "edea101d-7d37-4866-a6d7-640b99dc326b", "comment": "Malware payload (Stealc)", "value": "2acd0113e4290a00b164a1faa56ba0aa", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175490, "uuid": "b9325987-a62a-4a0d-ac43-17a30a32df8e", "comment": "Malware payload (Stealc)", "value": "1d0775124c7105ffa48240288987811e07fee52b3472a25504d2706b905ba625", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175490, "uuid": "e151d945-13f6-4188-a726-0da3ccc4ace2", "comment": "Malware payload (Stealc)", "value": "9593b6944865d1f38f812093084de0756606256b", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175490, "uuid": "95e18113-fe0b-41ef-8abb-7f79128cb5c6", "comment": "Malware payload (Stealc)", "value": "1331ed3c3121bd2ca1c3512ee7c300ddf955ca8b2fdd40166e58ec7900efc94feddf4d0980f65116c9b2e07426d480ce", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769175490, "uuid": "64976f60-669d-43a2-9941-85e22935cf2d", "value": "T1F4D54B072C948966D09AA23AF4A201827E737C044F3637E72A907E391F777DD577AB18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769175490, "uuid": "01cf3bd2-4173-4764-9cb3-c3b34b96e7a0", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769175490, "uuid": "bd411809-693d-4544-8a49-b2a34f41a59a", "value": "49152:lzJvWTDMJ9kLD5oeSTnAhzNGHv1luXwoiTb4KbInC28iqGQ:lq8Nb4KbILe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769175490, "uuid": "0b8b60a3-e9c9-479a-b0ef-581bbe7ce7cd", "value": 2900184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769175490, "uuid": "64ffaa6f-ecf8-44d7-9b5f-5acc701656ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769175490, "uuid": "927c5c76-c761-4b46-b693-c86d46dca9ca", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "280fe2d0-f829-11f0-a129-42010a9c0007", "comment": "Malware payload (BlackMatter)", "timestamp": 1769151609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151609, "uuid": "6e822d30-3dfb-4842-886d-c0c469505632", "comment": "Malware payload (BlackMatter)", "value": "c064e11632486453137d7c5af9a4b159", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151609, "uuid": "1815c25b-8e63-4e29-812c-a66ac6115125", "comment": "Malware payload (BlackMatter)", "value": "1d218f810f262659fc2b6fa8a42b2fe217580666546ff802840a1350624766f0", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151609, "uuid": "ee083413-58f1-4e4d-9dd4-62d251fda933", "comment": "Malware payload (BlackMatter)", "value": "919be9377c6cfad29ead4e7648c4b1f7bda262c2", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151609, "uuid": "d5f87d49-1ad5-41dd-a4b0-28c58a7f31bd", "comment": "Malware payload (BlackMatter)", "value": "6a9cd1405f55d86997bd72aad461239fa1f99b9ef2f5c64c2a6a7201840361f1219d253cbf5077404be6b5e1ae03f5d3", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151609, "uuid": "2750f8d3-61f4-42cc-8e80-40d4edbc2495", "value": "T13FE37D21F212D1B3D83718F13736B172F39E8D6C29A96807EAD80F59BC648232F55997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151609, "uuid": "548f2e2b-9a86-4ba4-943d-ec7014e424ad", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151609, "uuid": "84ec5b46-292f-4a77-942b-fd82ed4cefd3", "value": "3072:F6glyuxE4GsUPnliByocWepO0pcZy5uKwLbP5W/+u:F6gDBGpvEByocWeg06EuREH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769151609, "uuid": "fc11ca7c-7a49-43f3-84c6-f2d74eded379", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769151609, "uuid": "cfd899e5-e11f-416c-b045-b5bdc34a1186", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151609, "uuid": "0b4cb730-80d3-4a20-aa9c-090108c64d2e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fade53a-f862-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769176211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176211, "uuid": "ffba239c-8e6b-4071-9a7a-f04d89f9b5c3", "comment": "Malware payload (Mirai)", "value": "2e784b225c1b6a5376d2a7e5fac863de", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176211, "uuid": "dc410be3-2b61-4d5e-87ce-5c788d90784d", "comment": "Malware payload (Mirai)", "value": "1d91da10b25bf1911904e6e82216bb33cba9e8b23bbc52d4df494f113cb2ea42", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176211, "uuid": "c58f3101-d38f-4785-b807-427036ea75b6", "comment": "Malware payload (Mirai)", "value": "345b836c13c9df4038b1652b9c847e727916d0d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176211, "uuid": "46c6351f-e9bc-4e24-8f84-32ba26721306", "comment": "Malware payload (Mirai)", "value": "f1915b2ea38a623c33080af8c8c12098e783445453d17031d4f59f7d1b38b4833c5aaae61765b22c61b7e4b936d2f0bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176211, "uuid": "0935acea-27c8-4fd8-8545-558b6ed4dcf5", "value": "T12893088ABCC5C712C6E071B2BB1F51CE335643B8E3E6B1438D19AB29675B8570E3B251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176211, "uuid": "72fe1bce-c674-4ef7-b747-081a974cb9be", "value": "1536:yMwGIHgptGkQq9cPZNc4v2IqvtRQsWI0rBiQYO938wBI/b:y/lHYtpCPheIqvtu/I0kQJ93zBI/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769176211, "uuid": "375357fc-455a-4a22-ae59-9d1d1eeffc86", "value": 95444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769176211, "uuid": "340026c4-af85-4cd7-9bed-4fb7e28add4c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176211, "uuid": "0a5ce637-52c8-44d2-9b65-f44aa4447a1a", "value": "splarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f57dd0e0-f829-11f0-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1769151954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151954, "uuid": "e104f0fd-39ae-4714-ad38-71206eb5ae70", "comment": "Malware payload (GuLoader)", "value": "05b9ff47314c60e6458af6e385c79234", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151954, "uuid": "97d8f063-8d00-4de2-983a-a49df610508d", "comment": "Malware payload (GuLoader)", "value": "1daa7c9e5c25067c4395fbc6c113992f769b6418e1c096873b5fc9ef3be53050", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151954, "uuid": "ec5ce2d9-251e-41fa-b5ef-6c32d2f7bb9b", "comment": "Malware payload (GuLoader)", "value": "50eed015244d32c36436f823bf362b2382e354b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151954, "uuid": "492d85de-f5e4-4ec8-8ee6-4199a592c7ee", "comment": "Malware payload (GuLoader)", "value": "5b84f0b6a5abaefe5e8ed8f7390f8660918c7fb2038019c934ff47ac1e4e722b845cb1194e3de06d238dcbb2925f0c33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151954, "uuid": "b9710981-33ae-4869-9a23-2e2649a0a035", "value": "T122A4D083B980D5D2D8584C35A9B3933011BFBCB96B8D9793A388715139731C7663BEA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151954, "uuid": "512ba89a-2953-4956-93d9-a732bad8c619", "value": "ea4e67a31ace1a72683a99b80cf37830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151954, "uuid": "6adf328a-e0fa-404a-b953-fb59a2f88f40", "value": "12288:XcODb7v0o8JvG5UFP+ibiucOTjjjjcjzjcjcjjYXYiABW75cAq/3+WNaNgQo:sO4njjjjcjzjcjcjjgMK5cAW/a6Qo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769151954, "uuid": "2ece6563-a853-47f9-b000-4e2dedab6c54", "value": 483439, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769151954, "uuid": "80b6317e-eb2f-4682-b34a-6db3d7eac3c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151954, "uuid": "9d6e0d84-a0b8-466d-8a6c-348012386c7a", "value": "PRE-ALERT ==HTHC4537315207.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "848729ce-f89a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769200298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769200298, "uuid": "b082ac26-b885-4847-9159-8b750f3c9e2b", "comment": "Malware payload (Mirai)", "value": "76d49557045f9efb58681eca36feafb3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769200298, "uuid": "473a4bce-a0bc-44e8-b0db-7aead76e74b9", "comment": "Malware payload (Mirai)", "value": "1dc125cef3b307f79281bb76ee31f6f4645db1d32abfdbab5a609b5f90ae6947", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769200298, "uuid": "276bc1b5-edf0-4562-80f1-17c96d2664da", "comment": "Malware payload (Mirai)", "value": "39b1e848a768dc2df563d794714777c4c879abdb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769200298, "uuid": "9acc303d-80f2-4bc8-b74c-30df9711b291", "comment": "Malware payload (Mirai)", "value": "e6cbed0e5816fbdd1869a1641eb14b685e14ad7b16477bc5040264a0e2c99457a51a9bf9e10fc6d2d1132d509c5c6ea3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769200298, "uuid": "4b168572-868e-4ad8-af0a-b7d94a33ee44", "value": "T1CD746D88FF4CFB42C29183BAEDAB0613B33D34607B4A46637D15623DFD927989C66146", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769200298, "uuid": "c814d308-2070-4fe0-bd59-227260fdf7f8", "value": "6144:4XjEXf9W7jxF/YYRTeQ2tjgLykgKhrAQWEXLohjE0sGtyEe:OjEXf9W7jxtYUbPUQWEbohztle", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769200298, "uuid": "0d764094-d696-4828-8e80-364c76168bd1", "value": 341000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769200298, "uuid": "8fce5f99-a0c0-420e-a2d6-60e9be71507d", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769200298, "uuid": "e5b19df8-6804-4f07-b333-0edf8d57a0f8", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4e7b651-f897-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769199198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769199198, "uuid": "b73c4970-af9e-4c89-98cc-4751686dfcd5", "comment": "Malware payload (Mirai)", "value": "fd61c3ea7ec1b3515d1428cbc167ef10", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769199198, "uuid": "b120bce0-da8d-4d28-bf32-8c3117a424b5", "comment": "Malware payload (Mirai)", "value": "1fb32d9130b8d5c7919259e77f454ec6fecc2d3569a569672460c71ec166412e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769199198, "uuid": "8c33771b-8a71-48ca-aeeb-52bb8179c4aa", "comment": "Malware payload (Mirai)", "value": "1c0cc39d96a7ca64d94c4a3b96e3647fc1b2c498", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769199198, "uuid": "f7646ed4-588a-4205-b1df-f85e7770dee2", "comment": "Malware payload (Mirai)", "value": "b00483b54bf0a1534e839402e500219b6e7f4d6cd52c9dc9122aabe1ed386530450a4301169ccbfae92bc286b9f66030", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769199198, "uuid": "8ea23037-f98c-474b-b32e-191ae303f341", "value": "T16393B54E7E218F7DF76D873547B78E21979823D627D0C245E15CEA101E6038EA81FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769199198, "uuid": "e56075d5-0dd2-42e6-bc9d-f544890e2eb1", "value": "1536:7KKapgvxRtfmXw037Kh9+Iz3H7xlKY2h+L5OsDgzpoOoBxWO/oZq4y:7KKa6ZRBmrK/3zXdT2h+L5hgzVoCOSfy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769199198, "uuid": "f90d9ee2-33e9-4694-93b9-0f2379d52319", "value": 92672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769199198, "uuid": "a6d46019-f682-43b5-8f36-d0b628e264ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769199198, "uuid": "5981cf1e-a2dd-4ae4-bf25-b790b995ea5c", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c1b9375-f863-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769176554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176554, "uuid": "fcb46812-b17e-455c-963e-b1a9632e17f6", "comment": "Malware payload (Mirai)", "value": "73e1591277ca9ca88f8982a596b1dfda", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176554, "uuid": "eae153fb-716c-4c51-9ae0-06e50b1cb201", "comment": "Malware payload (Mirai)", "value": "1fe8601eada9215a40c41f88436f6aeb75fe176fd828a39504bfc3951d085137", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176554, "uuid": "68a8d658-2098-4c61-b77c-89ad75680ce4", "comment": "Malware payload (Mirai)", "value": "d6e28d4f2fea2c3f8850f5fa9cdb4d7511815da6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176554, "uuid": "eccce005-b29e-4b3a-8d08-7cda2a9f284a", "comment": "Malware payload (Mirai)", "value": "a36c651840a03a2128874001c13b884764d623714ca92a3144fb3e51f6fa45e0163caac468e1e11d4c4fcf13825bbb18", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176554, "uuid": "3cd21068-14b7-485c-bf88-375794d765a3", "value": "T16CA3199ABCC1C212C6E0B1B2FB1F51CD375643B8E3E6B1478D19AB29674B8570E3B251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176554, "uuid": "8a0ba825-9f00-4333-b2df-1270c6190043", "value": "1536:PziyY7HkCF0UVh3p9N4K/cQN7I+4SelxTJyHPaR+u+rvh/b:P+ySEAn3CicQxI5DlxTEPagLh/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769176554, "uuid": "5cbd3bd6-fa79-4d27-ac75-53e2dd38d02b", "value": 98296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769176554, "uuid": "ebc2d1fe-5ffc-4249-afad-df3cd8108247", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176554, "uuid": "60d5d3b2-4776-46f0-939b-e9a7d1287d0d", "value": "splarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d31e296-f866-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769177871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769177871, "uuid": "dd4f7378-92c9-4415-8c2e-ef2c1184f9df", "comment": "Malware payload (Mirai)", "value": "f597726d1e2e85c5533b1dadd5aac382", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769177871, "uuid": "8bb46039-0d64-4f02-a69b-344cbe2b07e9", "comment": "Malware payload (Mirai)", "value": "20da866de8d074b879bfdd2cf360d2252992ab5a5c877fb398bcdf16147a76a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769177871, "uuid": "a8ee0e40-e1ee-43c0-8607-4b6b47803473", "comment": "Malware payload (Mirai)", "value": "8050c3fdbb627ef07a4204388dff368ef83878bd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769177871, "uuid": "89421b6d-c178-4292-9f62-573775b47209", "comment": "Malware payload (Mirai)", "value": "b6117dfc675e0c367f8e76f1702e1cf10c13ee12dcbaca1704106b67a097e3586edbf4033cd327df0392da1725128ee9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769177871, "uuid": "c7a08228-5052-4eb9-b329-6f821f4d2f9c", "value": "T17CE30A56F8819B12D5C111BAFE1E124E37131B78E2DE7202AD246F747B8A97B0E3B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769177871, "uuid": "0b20bbf4-f236-40e7-830f-a249f8c0ce6a", "value": "3072:ZUIK7maU/0VjLoXUg+3woauXB2jITCW395Rpw:ZUrHU2oXV+3Bae7P395Rq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769177871, "uuid": "3d581bf5-f2b1-4fc7-a29a-84b16365085b", "value": 143292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769177871, "uuid": "d5b0257f-567f-4923-85f9-30c9d88227a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769177871, "uuid": "1e37af86-f8bf-40f8-adb5-13fe8949b7ab", "value": "bot.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6566f5b6-f840-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769161591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769161591, "uuid": "e417c7c4-119e-416f-b1e0-145ee266dd2f", "comment": "Malware payload", "value": "638e9f02046f01c8d6109ada1142be10", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769161591, "uuid": "d6d5dbbf-bfcb-45d1-bffc-58a7a74cab4f", "comment": "Malware payload", "value": "2122774f22c225c9bc6f48672d4004c1791369e597921305a5aa3ae52f64fb75", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769161591, "uuid": "ddf6ac10-d5e9-4406-9b8e-31cb94ed5bde", "comment": "Malware payload", "value": "46a327f98a2d0ac2e9a73c8b57efedcf7f62ebb7", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769161591, "uuid": "46ca074e-dc6e-414d-8119-996d6441d797", "comment": "Malware payload", "value": "36d2e5f777295952e004ebc3463c145adf65adf3bc2648a8626e90d32b97c1dded11118407b891885d09a9d8e255a0ec", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769161591, "uuid": "c1b5f3b0-462c-4f3a-9f1e-d091715da3ab", "value": "T1F763DFA209AAC4650445A6747090B53B3480B7EEE5DFA7431892E430BFFC6C9671FEDB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769161591, "uuid": "dc7a9deb-73ee-4f3c-ba81-8a3aa30ad0a0", "value": "1536:nCTi+ET/Qs9r8d97RRoRKi7XYwWLuwSI7WMP5MzPv1G:CTi+Yz8vi7XTKUEg3w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769161591, "uuid": "8ca9cb71-2f3c-4e2a-adb9-029aad26a351", "value": 67954, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769161591, "uuid": "48e4a881-4d45-4353-b281-e53de20d9e88", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769161591, "uuid": "2bc1c63f-c3ee-43ec-b87a-dcf56ef18eeb", "value": "2_12_6_1966_23.01.2026.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de41375a-f801-11f0-a129-42010a9c0007", "comment": "Malware payload (Phorpiex)", "timestamp": 1769134735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769134735, "uuid": "e6e56dc6-a36d-4f5e-86fc-91c71c89d835", "comment": "Malware payload (Phorpiex)", "value": "64fd63da32501382acb331a170a6aaed", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769134735, "uuid": "14558389-a92b-47f0-a5f4-bf9ddc566e62", "comment": "Malware payload (Phorpiex)", "value": "21f13ddfa4edaf7ae54a076e6f9fff2e9d8233581b610960934d35235b52071a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769134735, "uuid": "5a67288a-8144-4fdb-a226-1ad49e331e70", "comment": "Malware payload (Phorpiex)", "value": "05b614e39a783f116dfb1a1a6cdc40bec149c2cc", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769134735, "uuid": "9ca51ffd-e88b-463b-96a5-bcbe01352936", "comment": "Malware payload (Phorpiex)", "value": "10a030c1fffbfdd9b321865c8e1f60b925fd731c1a3a06f35b6008459a61791640e500129884f0d4893001485b995d24", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769134735, "uuid": "78abcfbd-ea1a-4a02-9b11-20c4fb2fbc73", "value": "T115B37C1030D1C432E567117588BAC7B59A6DFC310F69AACBBFC406AD8F266D1AA36347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769134735, "uuid": "a4a89e2d-46b6-42b0-86a7-2d987e839b0c", "value": "c6cbbdd643acf2dc6daa2bfb97e98d80", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769134735, "uuid": "2c03467e-4c38-469a-a52f-fe44a500ea15", "value": "1536:RJPYxSFcyGHyd3NOugMzm1sEdLD6VsWPLfSdKm02JpR52Q:PPSSZG2EyCsEdLuVyo92Jf52Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769134735, "uuid": "84abfeb0-ddba-4241-8def-1a2269303839", "value": 115200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769134735, "uuid": "b7a65ae2-0cb2-4e10-a015-e7bc64335883", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769134735, "uuid": "5bc1de90-6ad4-4e74-81f3-f15ba7531124", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98b3fe83-f829-11f0-a129-42010a9c0007", "comment": "Malware payload (BlackMatter)", "timestamp": 1769151798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151798, "uuid": "1e2a661a-271a-4d1a-96be-c223ff591d7d", "comment": "Malware payload (BlackMatter)", "value": "a583aa6ce01a80ec3edbbeeac6ed089f", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151798, "uuid": "1c361db9-86ff-4424-8308-09066b3b7ba6", "comment": "Malware payload (BlackMatter)", "value": "2212b78bedb274dd6be7bbebdeeffe9406197cb065fedb370b302b720573fb25", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151798, "uuid": "94c015a1-0043-45e4-b0da-b7199ebf58dd", "comment": "Malware payload (BlackMatter)", "value": "1b7467829475d12bfe3c29dc3409450708b1f795", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151798, "uuid": "3f7a9aee-adf0-4fd0-ba46-3963cdeb68fd", "comment": "Malware payload (BlackMatter)", "value": "f8abd0589336485b9c3183646c0066c10c08b16c83dd050fbe8aa7e8d0a556cc1f129fe65ff97cea2e40684844267b8c", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151798, "uuid": "c1c16619-fe35-4846-9abb-fe29ceca0d9c", "value": "T186E38E21F212D0B3C87718F12736B572F39E4E6C1AA9A807E6D80F9DBC658232F15957", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151798, "uuid": "04c32ebd-40d6-4a4f-91f0-1dbaa1902598", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151798, "uuid": "46e192a7-3eef-4e6b-bec8-a321ed51b55e", "value": "3072:Z6glyuxE4GsUPnliByocWepAA/oWBrbnG1i+D:Z6gDBGpvEByocWeeAQWBr0i+D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769151798, "uuid": "e86f8955-12b6-48c6-bb5b-c7457dafcf0b", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769151798, "uuid": "591e0aae-aa75-4748-862c-c20e1a0996fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151798, "uuid": "ddd7ae23-e6e8-4fca-a222-af47b898163a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c327e28-f829-11f0-a129-42010a9c0007", "comment": "Malware payload (BlackMatter)", "timestamp": 1769151750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151750, "uuid": "b3e92245-5f58-48a8-bd9b-9f1828e5c2a2", "comment": "Malware payload (BlackMatter)", "value": "6334a7b9a57a7c1471764384b0e2258d", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151750, "uuid": "01ef5154-437b-4390-97da-dc90da0382ec", "comment": "Malware payload (BlackMatter)", "value": "2322908792f3bd634a139411d42474c93951599c5356195b6f1f7f09bd455023", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151750, "uuid": "841a3e9a-4de5-40f5-9972-d94ababada49", "comment": "Malware payload (BlackMatter)", "value": "2e3556bf04c1483c547bbce7a7fd4c1f3b7b11f5", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151750, "uuid": "dab192c3-ec7f-40b9-8346-48ae366b547b", "comment": "Malware payload (BlackMatter)", "value": "ca3dd39be59e0ff71eed616328804c9abfbc4105da4ac2d9a2e21bc6e4ca9019139eb920caae029628dc399664bc732e", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151750, "uuid": "9aba5f60-7c33-426d-8a81-01d78f32cdcb", "value": "T169E36C21F212D0B3C87718F137367572B3DE8D6C25996957EAE80F99BCA08232F05997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151750, "uuid": "579fbec9-5cfe-450f-8e23-ff322d6ec79c", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151750, "uuid": "9d41934b-f27e-4fb3-a08f-8eeb7c70ac5f", "value": "3072:S6glyuxE4GsUPnliByocWepGn8AyEK5lo:S6gDBGpvEByocWe0+EK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769151750, "uuid": "3997c6af-3980-4a84-abaa-b17ef034d003", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769151750, "uuid": "830f4905-f8ae-4c56-86d1-d1882c4b6dc2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151750, "uuid": "e06bfb1f-16d6-435b-b95c-a2c033e7fef9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eef5c1c-f860-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769175324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175324, "uuid": "b0e0561b-d7ad-4b27-a1b2-6da4390f14a8", "comment": "Malware payload (Mirai)", "value": "265c91b16e2570d4ce61e8f475432da7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175324, "uuid": "b673dbcb-da23-4af7-a02f-51f2df227114", "comment": "Malware payload (Mirai)", "value": "23a15d0b6762895205ff8b4b713cbfa6c8cd5693ece863f2940becaf11ebbe62", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175324, "uuid": "a4bf06c3-d8ff-4da8-9543-ec6cb227583c", "comment": "Malware payload (Mirai)", "value": "c79380d9c058c5488138f600a6d69eea5552f0ad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175324, "uuid": "59f3165f-bd26-4130-b9d6-e03ed1f3d578", "comment": "Malware payload (Mirai)", "value": "f06325cfc4a9d85ec2bf1cee9a1698676593f52712a382ea7ed0faa7229b75f104c568fdf712eea2eb9f42771d0a51a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769175324, "uuid": "b4b67f7c-2360-48f2-9e34-0b061d746648", "value": "T1FA93188ABCC5C602C6E0B1B2BB1F51CE375643B8E3E6B143DD18AB29675B8570E37251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769175324, "uuid": "e7fcd459-0f75-4da9-a528-7f3384f14a4a", "value": "1536:yfOA4IgUbtIeN0akwL9/krd4sVpnfYI0SRJEyFCiUV5b:Kx4IlbtfL5apQI0e9FC/V5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769175324, "uuid": "1417c67b-fd73-488f-9adc-5a572e63bf69", "value": 89808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769175324, "uuid": "2b481880-2ddc-4274-9582-69d7ec295822", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769175324, "uuid": "7592ba8e-96fa-46a9-aff7-129437f2fb31", "value": "nklarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a62cdfbb-f861-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769175873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175873, "uuid": "826eaafe-0f25-48cf-a501-d1c413c6953c", "comment": "Malware payload (Mirai)", "value": "ff4ee4f416ad0cff12cc229173fd5ce5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175873, "uuid": "718dd554-9b73-40ff-acc9-da0db6cfea41", "comment": "Malware payload (Mirai)", "value": "25c9b703c9c2ad1b47581666c83a90777c2cbbbc97379eb7c04f5333c79629e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175873, "uuid": "e2845749-57da-4a29-904f-7c59999aea41", "comment": "Malware payload (Mirai)", "value": "850ce75be7f9aad52abd6b11d633cca95773dd22", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175873, "uuid": "feb25891-3e08-4db3-a0af-dbfd784aff99", "comment": "Malware payload (Mirai)", "value": "c7a0af79f2d30cbb17a2ee366ffe447a561277eb9c30ec04f2e991a59e1356724926bb52b8f46bb518edb274796ded9f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769175873, "uuid": "3cf2c74a-124b-40aa-93d6-196b2b526063", "value": "T142532AA57510AC3EE42BA6F780430A59B12173F98942BF27663AFD63CE7E1742C12D47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769175873, "uuid": "7d0867cf-ee57-4713-bd64-336a7211acdd", "value": "1536:XbUUHutJ9F9JgHOrHUIRfAsVWHkHoQkX3TjI8aKuH:XbUUHuBzssHAjiw3nxuH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769175873, "uuid": "8f044a99-0f68-4f1d-9b92-a99cafdcddaa", "value": 63200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769175873, "uuid": "fd70b225-3112-45b7-b9e9-49f55cc59a1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769175873, "uuid": "bf1412db-3f00-4e8b-a9a6-440adb6553db", "value": "zerm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e31617a-f829-11f0-a129-42010a9c0007", "comment": "Malware payload (BlackMatter)", "timestamp": 1769151727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151727, "uuid": "b404e644-8ff4-4bb0-a5d2-562a7dd516df", "comment": "Malware payload (BlackMatter)", "value": "cac48d0d15ce4a64833f4768070b1eb2", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151727, "uuid": "ae341bdf-a2fa-4223-8604-765dd7aea608", "comment": "Malware payload (BlackMatter)", "value": "267df6cfd790b8c9dfd48f518f5cad435df3158344f7f5adb8b6ab1e0a6aa251", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151727, "uuid": "2450e531-b436-46f1-b300-7378f50626af", "comment": "Malware payload (BlackMatter)", "value": "b1fd175274a610d2729016ba4eaf86f4108b80d5", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151727, "uuid": "3daf91ef-7d44-4394-88ca-11b50df54116", "comment": "Malware payload (BlackMatter)", "value": "c5f60317c178bb27c75bf4aa33f0203e73cd5f59c0b033cfe6226d68271fd6cfd865ef1ac0e0cd2bc2fcc88c640a5c39", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151727, "uuid": "463aa58e-101c-4df1-a1b0-84c4397c12d5", "value": "T16EE37D21F212D0B3C83718F53736B572F39E4E2C19A96847EAD80F99BCA58136F05997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151727, "uuid": "9f3772b9-ce4c-493c-bda7-36591b9385f7", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151727, "uuid": "dd1a9c36-f7ef-46c1-9a93-b3758e91dd78", "value": "3072:V6glyuxE4GsUPnliByocWep3tt8LJUQ1Ix7:V6gDBGpvEByocWeltjQyx7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769151727, "uuid": "6ac02470-33b7-4b2e-aeed-aecdb950e3e3", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769151727, "uuid": "575de2d6-2a1c-4095-820a-b7e11a791d90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151727, "uuid": "a4ac7142-a149-4108-95d4-e3dcfd2b2732", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd60657b-f899-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769200017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769200017, "uuid": "8f19fbf3-3efe-4547-a019-cd56f6622ae6", "comment": "Malware payload (Mirai)", "value": "996d61725cbba2e544dfdb95f58b94d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769200017, "uuid": "e9e7e5e0-ed3f-42b3-ab60-2cc4f7aa8dd1", "comment": "Malware payload (Mirai)", "value": "26a8ffffa35bdf8e1026097d452d0306bbc89178d154946baded5f24cde859be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769200017, "uuid": "3fb629fd-7f15-488c-8a1a-2b25f295daa8", "comment": "Malware payload (Mirai)", "value": "1a30e8478c914f69e69fb1bbea197bb643dbc2e3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769200017, "uuid": "22efc525-2934-4e98-9625-092e7e0c8513", "comment": "Malware payload (Mirai)", "value": "afec7ba942f30546e62a9aa1205c3194cfc10b6416f5a0aa7f05a246f139779866c2ab92cbca9b3155c4db66a3523f26", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769200017, "uuid": "d7d7e776-b506-457e-a547-34d187f1785b", "value": "T1DD531985BD82DA13CAC4537BFA5E42CD3726279CE2EE3213DE155F6032CA82B0D7A551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769200017, "uuid": "ebdafca8-1117-407e-bcd2-3855d39c5155", "value": "1536:tXU9w5YknCF8CLCLWXShn9f/JPz/rksBF:mOnCjo93VPk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769200017, "uuid": "385017ba-ee11-4203-80fb-a1e6e59cf66b", "value": 64296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769200017, "uuid": "1d242a2d-0ee1-4ddd-865f-e64644561880", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769200017, "uuid": "8dc14e30-d6f0-423e-a862-2017c669999e", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5229a473-f833-11f0-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1769155975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769155975, "uuid": "b81b75be-d6ef-4288-9be8-23651d1731a5", "comment": "Malware payload (PhantomStealer)", "value": "939b6dd1d19376633329e57f4d80c9a5", "object_relation": "md5", "Tag": [ { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769155975, "uuid": "0c6522a8-1a00-40c5-a0f6-c7840f086083", "comment": "Malware payload (PhantomStealer)", "value": "2765a1ed721b4e2ab38c06fcd76d1c55e8734692135ddea6915b58ac82ae92cf", "object_relation": "sha256", "Tag": [ { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769155975, "uuid": "04b92ff5-1f45-474b-8f8f-bde56d3f1884", "comment": "Malware payload (PhantomStealer)", "value": "78b3183d91b73e170abb4304ffac5d8cd8782bfa", "object_relation": "sha1", "Tag": [ { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769155975, "uuid": "1de68458-1401-464b-9d3e-1d2dccca6fe0", "comment": "Malware payload (PhantomStealer)", "value": "3d2810c9391907ef8aa6a4741d57635a10d010e5e3374ae538c3274436243445999aca651e51b88e48284b9464ff84e0", "object_relation": "sha3-384", "Tag": [ { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769155975, "uuid": "ca4807da-ea4e-46e3-ae44-7b394ab6ae2b", "value": "T139D375A123C12C5513AB1F7B3B3FF1D1F93A4D6A39540D8FE261BD80A199626EAD1433", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769155975, "uuid": "6cd73324-a0d3-4f04-a491-c721e69a7aa2", "value": "1536:VG5pafkpNsMNcan3sHnVHirGuC2bxrSikkL3QgbD4Y87/AJeQhL5Z8:VG5mkp93SgVSiL3QgZcwe+8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769155975, "uuid": "5f0d6f05-c019-4643-bc93-65079cf9fa65", "value": 137104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769155975, "uuid": "b5c74f41-3aee-483c-94d2-20dc8da0bda7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769155975, "uuid": "5799d531-aecb-4d4a-8711-a34e164f03c7", "value": "EDH098765678900.jse", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bc615c9-f865-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769177466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769177466, "uuid": "9606303b-2dde-442c-b730-8f40c3dd9c8e", "comment": "Malware payload (Mirai)", "value": "331da1b9528dc2af02ac5558162b86ae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769177466, "uuid": "d5126817-6ad3-4aa8-bdb5-092242da46fc", "comment": "Malware payload (Mirai)", "value": "2b55565e5f31824c28d81aafa520043d701a2db174868996aa0d10140d09403d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769177466, "uuid": "5f43b61b-cc27-4f31-8357-b87622d7d4c9", "comment": "Malware payload (Mirai)", "value": "ef78a0a4f1ea91d8dc123c26846bb25f4da9fe24", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769177466, "uuid": "994f774e-470e-4574-bfc8-65c73ddd30ee", "comment": "Malware payload (Mirai)", "value": "513d00ec0b5bbb3373fdf0d3bc17d85506567f09f7bd0058f131fba9b8d179fac1406325a9fdec3173dc5b53b0df82ff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769177466, "uuid": "b09cb021-cf0a-4c5a-b5f2-47db0ee66c70", "value": "T122337DC5A243ECF5F825017510BBE3722A77F53A10B9EAD6D7A6E831BC22111F24679C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769177466, "uuid": "22a70c7d-3bcb-45ed-992f-9e986a5b8ae5", "value": "1536:eRNJ1ef3NdpD/rqiu3ao/qixElfgbxDv7uB:INJ1oNbDeiuD72VmZu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769177466, "uuid": "0f276634-f97b-4415-8c15-dbdd13d50205", "value": 51956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769177466, "uuid": "7d61a9b9-c3f0-42ce-9274-df99b97d54db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769177466, "uuid": "75863ad1-f69f-48a2-958f-7fe6dd505969", "value": "nabx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "818403a8-f864-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769177100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769177100, "uuid": "a40f3ccd-36a2-4a84-bdf9-37319aaf039d", "comment": "Malware payload (Mirai)", "value": "1e92409cdd401b3ab474e6b278233c86", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769177100, "uuid": "18448ddc-f307-489c-bc5e-3c3be91ea7fc", "comment": "Malware payload (Mirai)", "value": "2d92919811b20e5477bbcb50f312e6f14f8a5a3bbea8b323c3e4dfaa8f1e5c87", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769177100, "uuid": "984020dd-f516-4020-ba95-9485e62cc783", "comment": "Malware payload (Mirai)", "value": "8e721426c0763e027d45b7610b34200fa858b2c2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769177100, "uuid": "3cdcdff2-5396-41a9-8269-b7ffe2d8a50e", "comment": "Malware payload (Mirai)", "value": "79790bba2fae6bf761958a150d0712456aebb6d225ac4a77325f95f15ca89a785979beebfa16759bf96caa69c0e61028", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769177100, "uuid": "341d1934-5502-4da3-8577-a5f1e0daab57", "value": "T174432A93B404ED7DF809DB7385570A06B275F6A50E530B737333A967AA760C8093AE87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769177100, "uuid": "abfedcf9-27df-45b3-9c07-ff5ed119fbaa", "value": "1536:+H3SOqUYBt3dRNpruPaIsDHBU33Xnc3k8nXPuSK:U3SNrNRj4PsUnXnc3VPuJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769177100, "uuid": "12f68d9b-9024-4d6e-b24a-142f201c170d", "value": 60312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769177100, "uuid": "99369b88-9b30-499f-9b50-3744f2ab40ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769177100, "uuid": "8b8c4140-4687-4152-9312-180e98b8f487", "value": "nabm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4efa145c-f858-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1769171861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769171861, "uuid": "5c5edf0c-795b-4b92-8be2-6ca0ec9e5592", "comment": "Malware payload (Formbook)", "value": "7101040932e5083e212d955063083f6d", "object_relation": "md5", "Tag": [ { "name": "c9r7n6", "colour": "#559ABF", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769171861, "uuid": "e403e5ca-9380-48ca-be21-5425c85d1ed5", "comment": "Malware payload (Formbook)", "value": "2daecf6f4e14083d42305a69b40e2f0c8d26e98eeb929feeed975b369bcea588", "object_relation": "sha256", "Tag": [ { "name": "c9r7n6", "colour": "#559ABF", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769171861, "uuid": "76fb8e5a-7fb0-4828-a3e8-783113665233", "comment": "Malware payload (Formbook)", "value": "fd6acf97b9cd97a115340566b763a127be4cead5", "object_relation": "sha1", "Tag": [ { "name": "c9r7n6", "colour": "#559ABF", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769171861, "uuid": "02e66f58-c6c8-4e21-8a88-0864fdf02403", "comment": "Malware payload (Formbook)", "value": "de9210fe8e8587f44cd5f5b2d4241db784dccabb782b9a48dcff3fad70541093f76c4a5f6d8079fa8ab98f8be2538f7e", "object_relation": "sha3-384", "Tag": [ { "name": "c9r7n6", "colour": "#559ABF", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769171861, "uuid": "3555ec6b-06e5-4efc-82df-ce0e21c44d95", "value": "T13265334096A63C7E47A8D32526BF3F1787768F88501AE1EE76D596C99BDFE010C0B834", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769171861, "uuid": "e990b043-cbba-4f87-9496-a3df99687d45", "value": "24576:APK1zatZwuPfkZX4drzt9CAev0lpxDG7g4z72+BZwoiXQi:1QZw7ydU1EPuXBZQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769171861, "uuid": "a3c5b064-eecf-44eb-aa4e-03112b50eed2", "value": 1437935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769171861, "uuid": "8179fd2a-c024-45ff-bdb2-cedadb85211d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769171861, "uuid": "b02431e0-b973-487e-ba6f-0145ba9d1cac", "value": "c9r7n6.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50aea9be-f8aa-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769207083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769207083, "uuid": "abece935-148b-4d6d-b217-1d0cb6b0cae3", "comment": "Malware payload", "value": "0c1d7cbdd6a598c05a3d7b052dde2554", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769207083, "uuid": "c8c44eab-f572-4f98-bb15-2bfb5e843d27", "comment": "Malware payload", "value": "30bd186f06f86411c555e68449f5b5615ca398aead688ea11b69130dfa180f26", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769207083, "uuid": "f14d97f9-3972-482f-af10-c0827405db95", "comment": "Malware payload", "value": "b6fffca56e730cba8b8de460f675850399b081e9", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769207083, "uuid": "4ddb1c0e-3e44-46ed-a382-2b4e959e57f4", "comment": "Malware payload", "value": "c2766e09271c8923133fc39a7587da5c9f9f99d2b7b5223bdb5c6ac57dc06cf145020c6815ebe29586c566b9dcce93b1", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769207083, "uuid": "34633ea6-36b9-4262-a201-4898ef209673", "value": "T1F2168C07FCA108E9C4A9A3358AA796527B35BC480F3223D72B60B7B82F767D05DB5354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769207083, "uuid": "83955bb8-b27e-48a5-bf2b-8d581e679aa9", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769207083, "uuid": "5258df24-4204-46f5-9c47-17b743963382", "value": "49152:2cEXBaZg+bRlPO8wX7R4J5Nd2q/vWRt1No6vdiXZavSU84W8:29XtX1oNlWRt7HvdiJa6ob", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769207083, "uuid": "a78b13c8-2373-4cbd-8454-971aa3c87c3f", "value": 4164096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769207083, "uuid": "58e1bc9a-d0f4-461d-a643-841ce7955360", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769207083, "uuid": "d0778472-d5bc-431f-bfde-8dfa554e9fb9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6da907b7-f812-11f0-a129-42010a9c0007", "comment": "Malware payload (MimiKatz)", "timestamp": 1769141848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769141848, "uuid": "48fed5ae-426d-4bbe-9f59-30dd2cf44e2e", "comment": "Malware payload (MimiKatz)", "value": "0a29c95bfbc8b14ee85c7c7481eeda5a", "object_relation": "md5", "Tag": [ { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769141848, "uuid": "3461b261-5723-4675-bcfb-50857abfa0fe", "comment": "Malware payload (MimiKatz)", "value": "320a2103e7dba828db31a8ec2f42ae301ecf1a666e42ac1dfeb7c3ae81e3d6eb", "object_relation": "sha256", "Tag": [ { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769141848, "uuid": "f49ba38d-de5c-4eb8-9566-8913a847f295", "comment": "Malware payload (MimiKatz)", "value": "25919bcacb25d0aec63b8767c60fdc0a44ac74e9", "object_relation": "sha1", "Tag": [ { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769141848, "uuid": "5726cb98-1267-4269-ac59-f359cb9c4346", "comment": "Malware payload (MimiKatz)", "value": "7e678afb25723314fa2a8039a51682c928dd97b13c142657f728438881ded72b130300c53036e88ff5561574c6646ccb", "object_relation": "sha3-384", "Tag": [ { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769141848, "uuid": "da92aacd-7951-4d15-a6d1-c167bb334f89", "value": "T12CE7333175CE8374E5BE92705561DF2E92F53ED007B080EB83E4A86B5E369C1493AB63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769141848, "uuid": "4f32ab04-eec3-4227-9566-6c736cd30488", "value": "1572864:xucq/mvvgkLE5KRLBMzBe56lhyI0KnaY4M/xhC:xXZvgshiT3yKaY4M/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769141848, "uuid": "70c4843f-6888-413f-a963-971080905c7c", "value": 65857536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769141848, "uuid": "50609d20-fa78-4ff1-a833-461d28471474", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769141848, "uuid": "aeb354ab-8d93-4e63-9aea-b1fc66c67a9b", "value": "win32-telegram.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63225ef4-f830-11f0-a129-42010a9c0007", "comment": "Malware payload (CobaltStrike)", "timestamp": 1769154715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769154715, "uuid": "93644c4b-a59e-4bff-afc8-79ac66c9f7ce", "comment": "Malware payload (CobaltStrike)", "value": "83c5b99ff2b720b455b3c1bcc17abb55", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769154715, "uuid": "5d0fd98c-fcce-4ff4-ae5d-794fbc4a7399", "comment": "Malware payload (CobaltStrike)", "value": "33309eaab4f1cea04595e76b671b848353207183c81b1ab0f35fcae60c94e49e", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769154715, "uuid": "433eb7d6-4932-43e9-8091-4281b356fd22", "comment": "Malware payload (CobaltStrike)", "value": "f216a212c588eb0f05a275c78e250fcfa4f98a99", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769154715, "uuid": "372be5a7-ec1f-4f6e-a276-e62555004a59", "comment": "Malware payload (CobaltStrike)", "value": "f97c4153815c974c02cf68a8af36bf836a39a7ad77d4aeba9c67ec5fcabd4ab1bb535c8b56d9175479d01fd8f759a807", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769154715, "uuid": "307e6211-c5fa-48a6-b6c7-8f67bc6004b4", "value": "T132161262E9CA40ACC41BE0FD8FDA9E76DCB774520F305BAB83F057342A664D5CEA6111", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769154715, "uuid": "8f1a22b2-3d72-4f6f-a81d-25090a544968", "value": "3d3988c381c216812ceaebe4fb051fc6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769154715, "uuid": "f657e5a5-bd21-4b6e-920d-f7078bdef0b6", "value": "98304:NEZgNoqsJSvtL99BFRC5bgfW8JSzytoQvrrk:NEZJ4J965bIWDOtoy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769154715, "uuid": "dbe44f2a-cb6c-437d-95ed-ad2ead734b30", "value": 4251136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769154715, "uuid": "9a576eb3-ce30-4866-95fd-313a2e034e59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769154715, "uuid": "c2da6b41-7c22-4b86-9143-f43091296dfa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "661ff9d7-f86b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769180060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769180060, "uuid": "3d17b8f6-ef88-4ebb-8929-500bded9c7fc", "comment": "Malware payload (Mirai)", "value": "b637ead73e9268f90b909d5e2d2524aa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769180060, "uuid": "1c9a8eba-d09b-471c-be68-3d6917a94e97", "comment": "Malware payload (Mirai)", "value": "3403c58d9ca5472f744a40cf9341624c2345d7d8bf91158d435c9cdfa9888989", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769180060, "uuid": "307dcb95-f220-4f40-82f7-92cf10298518", "comment": "Malware payload (Mirai)", "value": "4622cbc9aa2c95dc09d465a74a60f8ea4ae9fa78", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769180060, "uuid": "86f735cb-f9e8-42a3-867b-7669599bc890", "comment": "Malware payload (Mirai)", "value": "490e1f1880f70adb0cc898f470733491d218538efb91cbe46a8bbd0876f46357d90ca3a686512d867021d50a108457b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769180060, "uuid": "f1d93b7c-9a2f-4a42-9956-0025232e0dd3", "value": "T172337C23C9AB5E68D51946B43935CFBD07939600A38B2EF6646AC675C003D8CF1AD3F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769180060, "uuid": "99e324b2-93eb-49a4-bd86-e37cb88f9c5f", "value": "768:kYFQ+AKu4KrRToI8JuLpJjzDgs3POGCHLh8Mve4foFDDC40AdpZU00/Z/b:kY++x72JobJuLACPYGptDC4ha00x/b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769180060, "uuid": "2c4dce42-e0ed-4166-ac80-dc003a93a7aa", "value": 52164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769180060, "uuid": "4b9fab0b-cfc2-4ca7-a4ef-3efdf5d45189", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769180060, "uuid": "280ffe96-5334-42d5-ac2d-d1ae760ee82a", "value": "nabsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0815bb77-f861-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769175607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175607, "uuid": "6ba4fe26-e2f1-4d7b-b2ae-5cbae620d708", "comment": "Malware payload (Mirai)", "value": "e6199eb4a7454d5013164589444cee95", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175607, "uuid": "6f2ee4d7-783b-4679-8a47-3449b0d737b0", "comment": "Malware payload (Mirai)", "value": "3430dce6e85a3f00a4fa603a94ca7c84224bedd177c10997901756fedfba279f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175607, "uuid": "9f2b451a-6bea-4973-adea-325a987112ad", "comment": "Malware payload (Mirai)", "value": "86da10a2126d4074d922702e50fd26bd07a66da0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175607, "uuid": "dca62558-e8bf-4a69-89bb-fe6845ed6f84", "comment": "Malware payload (Mirai)", "value": "4aa6709d11ee2e450f4a51474271281533c58401f745105abcedd572301a79ae08ef7b8110299f088d6051abef795abc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769175607, "uuid": "410ccfca-da2c-4a5a-9a1f-6a7f6a661453", "value": "T1AFB319CABC819B11D6D566BAFE0E518D33134B78E3FA7103CE145B2A638A85B0F7B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769175607, "uuid": "c0c01e69-b259-4f48-b3ba-2f612d2fd36e", "value": "3072:3lkipR5olQoEO8fnPvOv+HFrctp/frVUunR6a6UQ0Rs1fVC6TZJ/:kll4P6+HFQprVU6R6a6UQ0a1fVfT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769175607, "uuid": "20f96bfb-3e49-43a5-bd61-473b31c8e67a", "value": 114224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769175607, "uuid": "7596eccf-786f-4620-b0ec-8fa2a5eae811", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769175607, "uuid": "56198160-4f98-4cd4-b2d1-0602865df638", "value": "splarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65f85915-f829-11f0-a129-42010a9c0007", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1769151713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151713, "uuid": "fe51d119-3fa8-4d56-8a82-104f7b2a49fb", "comment": "Malware payload (Socks5Systemz)", "value": "0c58047ee883d1fe242e7c560bf3fadc", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151713, "uuid": "554918b6-13d5-48c7-b59b-46e0c080522d", "comment": "Malware payload (Socks5Systemz)", "value": "34e0b3a1a98639162e189ce204f7ccb9a86b1a3af4384bf56915a9a61b6e8d0b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151713, "uuid": "12653278-0fa0-4a70-aa27-495aeea4804d", "comment": "Malware payload (Socks5Systemz)", "value": "80b494302ca0d4f21ee0b06abced831f0521f97c", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151713, "uuid": "c078a29c-d10e-47a1-8632-06f5dfbdf6ae", "comment": "Malware payload (Socks5Systemz)", "value": "a1fa03458b99f34f0ca3f90c576606be31d84d89ecf8791848f5400318b552c72490e5ec2ee13cfab305d1d0f0ffdffa", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151713, "uuid": "03d46f37-1ea1-42d4-856c-7e7497949445", "value": "T1CE063312539C0575E03278B9DD366B03663FB83F5E3D0BB0386EAC144FB6817952A7A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151713, "uuid": "04229777-6fd2-4650-8339-4fe141ed49f4", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151713, "uuid": "7c09638a-7d9b-4639-863b-6bd816cba3fc", "value": "98304:MLsx6Jimw+cW9qcLN19kreIrr6xMkR7EHo6Au4Rit8DYy:UsxvYdNnYeIhkaHoLZit8DYy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769151713, "uuid": "b938f195-e8fd-4157-a49f-227926717f4c", "value": 3845486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769151713, "uuid": "bd175ff4-dc79-49f4-ace8-8b66f08f31ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151713, "uuid": "0e15672b-65fc-477a-b5db-d14b3c2b070c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b186b33-f8a4-11f0-a129-42010a9c0007", "comment": "Malware payload (ScarfaceStealer)", "timestamp": 1769204469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769204469, "uuid": "6430f45a-60a0-40b5-9942-ba0153004a53", "comment": "Malware payload (ScarfaceStealer)", "value": "d3030039ccee2288beddf4b95b21baae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769204469, "uuid": "2d8dcffd-f245-4910-8e7e-4cd56f39eaaf", "comment": "Malware payload (ScarfaceStealer)", "value": "38b1fbd2cdfd0e208c7399ba1e6b480714f05ca90b46419e10fbeb07c6583716", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769204469, "uuid": "d8ce0243-a9c7-4002-b5f3-a9abc447932e", "comment": "Malware payload (ScarfaceStealer)", "value": "12a05679a5f62e15ad291052fc26881248579929", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769204469, "uuid": "feff2b96-bc7d-4e0f-ab9f-7a4eddd627ff", "comment": "Malware payload (ScarfaceStealer)", "value": "0357a0896073264ce1bd40086b02611721f6ce485523d018b8acb389bb4a2d4dba79bb849e1f1d1c009ad3d0bb430434", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769204469, "uuid": "b361ab10-b7a9-4329-b9e4-c8f95367686d", "value": "T1C446238274EBEE70D007C7F07992246CF62F77C1C9EF4FAE3685A5450E9A53188BA245", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769204469, "uuid": "830165f1-1b91-4acb-a312-7f3bf8e749e4", "value": "c6e890f2bf1c766e673a9f6fba99f26a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769204469, "uuid": "eb06c95a-b0c0-430c-b03c-10eb0a29ef14", "value": "98304:MPIpqaaXpnvFhBYJzghaJzZ4v7axNHQ/Qa5hrkGA5NJatnSmaY6BR2gzfd:yttXGJzghaJzmn4+jU0SmcBNf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769204469, "uuid": "0874b443-7a9f-42ec-aaed-3b732beecee1", "value": 5767168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769204469, "uuid": "6ad75bda-eb78-49f9-8c15-fe524548e953", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769204469, "uuid": "d2c407b7-ba61-4eca-8ebb-673471adfac2", "value": "InstallerV2.2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af503693-f842-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1769162574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769162574, "uuid": "f7a5b038-9343-41fc-8bb3-4d5ef5909ab9", "comment": "Malware payload (Vidar)", "value": "9aae289de2a344c8f84656da941a33c4", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769162574, "uuid": "60af6863-e9e0-45a4-97a9-14e012ce0936", "comment": "Malware payload (Vidar)", "value": "394717dcc8a7491f56d04d93fbdc9d8ad055e73be7285cdde676bd9e525e0639", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769162574, "uuid": "8455ddcf-8a83-4775-aba3-e5a1298271e6", "comment": "Malware payload (Vidar)", "value": "5e64ddec9f8cb35ed1791bb7b47fa8ffc6836d94", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769162574, "uuid": "0f7f33c9-fc73-4044-bec7-88081b5b224b", "comment": "Malware payload (Vidar)", "value": "8fb62f49a59a7183185e33b649f9e3b3f76b9ee8f16852fbc0ca339299447a9ee059cdf57f7849a4a8803f03dfd91ea1", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769162574, "uuid": "798e5a2e-2d1f-4ab0-bc80-d3824e222667", "value": "T1921422C0B3B49DE5E34520F8821B53B775EA2A114FCABFD2A47F1E5191A09DDEC31A21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769162574, "uuid": "11b07d25-757e-4a6c-8700-42aacc154b8d", "value": "ee53c10aff1d01eafea53328179e33a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769162574, "uuid": "ad43e00d-3d25-4e57-88b5-d75004db1d30", "value": "6144:/EXbKMoHeVu+kXDkc6q+hamEok0z86g7E6NiWg:8GMoHeVu+kwc6q+hrv8l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769162574, "uuid": "3cb06376-cbb7-41b6-8164-7586a77a6d54", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769162574, "uuid": "ff378114-97b2-4f95-90a9-8681bb2d00c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769162574, "uuid": "247fd503-5eb6-411c-8c4e-a7d7421bfefa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6b24875-f863-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769176867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176867, "uuid": "727d1514-4ca7-4e87-8d45-0565b6b5f566", "comment": "Malware payload", "value": "03b1cf6c66e104cfc45dc540d3d9561d", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176867, "uuid": "e4c92833-9725-4f3b-b95f-f5b46a87c51d", "comment": "Malware payload", "value": "39f9a970f648e2925eaaedd6f4a33154c0325a391b4e2f6699000e6ad75c7ef5", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176867, "uuid": "bc17c4f0-de90-4e19-9695-358a01009acb", "comment": "Malware payload", "value": "7d6672346c0e3e9f253cc491d6fcf046f19a0e41", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176867, "uuid": "2173cd0f-853b-4c94-86b2-7a921c2636c9", "comment": "Malware payload", "value": "e1f71f392215335f8f3cd2214bc7b73ecbd5804c64e5535d6024f51ec92b4854b69918527d797712f5779b33f1e7fb3c", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176867, "uuid": "4394e93e-a325-417a-8f02-9bacf2d49352", "value": "T1A911C4B846AD495E8CED8C4AA20BDD8050888AB96558C2739CB1E2E8A0A621982020C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176867, "uuid": "66d4e9de-8c33-4436-8800-f5e6e3c386fa", "value": "24:ZOrLshBr+9IT2u2g/mJskWvvayWOe4gCS94EPRvg:ZSYhBy9I5l/mJfWvvBUCS7PFg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769176867, "uuid": "1954960a-1acf-4ec2-afd0-d77757a30e4a", "value": 920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769176867, "uuid": "027246b4-c343-41a7-ad24-9712e34411ce", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176867, "uuid": "38782074-006b-49ec-8844-a8fd9b218044", "value": "DSA & NASTEC ASIA 2026.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a6fd3c7-f814-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1769142728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769142728, "uuid": "7102b64e-09d2-4ee6-9a8c-d28d147c4be8", "comment": "Malware payload (CoinMiner)", "value": "9ccf9f7fab5e10114278afead0064b76", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769142728, "uuid": "51ea6192-286a-49b5-8afe-efbce4779172", "comment": "Malware payload (CoinMiner)", "value": "3a26a94d95c1608dbae3eb25902ca2ac181870ba9f58795b83e8ae9617affac3", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769142728, "uuid": "8a874c5a-630f-44a1-9f68-a351ceec2850", "comment": "Malware payload (CoinMiner)", "value": "f856283960fb0ea58950b40ef0c0095555b3b1e5", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769142728, "uuid": "7f6e2663-1bf7-4f63-8c68-87a2c86da58d", "comment": "Malware payload (CoinMiner)", "value": "34c86e18ec36a344575edcfd8903cfecd5a2e7af1dcee2c4972b60f073d67b77e0b45a8fd86b006da2fda2ed7baeed25", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769142728, "uuid": "4dc757b5-b386-4e62-b34f-4d0cb0d04410", "value": "T165D523D29BC127FAE84C2778FB74743F17A33563BA8AB297C895639219348D05C7A05C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769142728, "uuid": "4bb42ee0-9c3a-4db0-9b28-f4df4dab9072", "value": "de41d4e0545d977de6ca665131bb479a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769142728, "uuid": "19068361-6c83-40cf-a3c8-607fad41f83c", "value": "49152:4vkkPpcX3D39WqfCKoz1yuMgCxpL2auVbk8sVHCjVJX62HM5uOh3o1NS5J/rC0IP:4kkPp63LAqq5IuMgf1k8sMl64M57uNSk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769142728, "uuid": "b8d1a634-25ac-40f2-979e-083da7ba3724", "value": 2874368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769142728, "uuid": "35d8529f-9df0-4e59-84fe-847ddace88b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769142728, "uuid": "ab7ac672-893e-4ad2-9af7-890bfc2652bf", "value": "3a26a94d95c1608dbae3eb25902ca2ac181870ba9f58795b83e8ae9617affac3.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eccdd7c-f863-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769176558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176558, "uuid": "751fb75f-00a0-49b0-a077-16a6a9376729", "comment": "Malware payload (Mirai)", "value": "ae821d2932d158db64b8ed75249f0a9a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176558, "uuid": "bf2ae5b3-a907-4afb-9235-a797be6a09ff", "comment": "Malware payload (Mirai)", "value": "3a898a23193f0e3e4c40704e786666d41b892ada47ac9b73b9ecda29e36fc78d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176558, "uuid": "b758902b-aaf2-49cb-b5ef-6a471e35126e", "comment": "Malware payload (Mirai)", "value": "9e8842cdf5c43e4d4bd84bb1e7b127312bccc3c7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176558, "uuid": "bbacc829-1584-4440-a3d3-de44449b8e18", "comment": "Malware payload (Mirai)", "value": "342efbb1f92e86f744650ab23575c1148c44ac96e5020ed74f3142744f72deea1d4d66830f1e5f7c2863fc14980a97d7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176558, "uuid": "823280b4-a189-4503-ab13-ff5794fb073c", "value": "T1B6631901776A4047F3E75EB22C2F6BF057AED6A231A0A185595FDB0F8134A321586FCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176558, "uuid": "d0951012-8bdc-4556-85ae-ea21fae037ff", "value": "1536:5ytqEH4O8o4V6ItIGkrLYIHiv2kDd3Rnb/oRhS/Ewtk54:FO8oQ6LOdBnb/0S/Ewq54", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769176558, "uuid": "1b803f28-385b-496e-9641-7bc88aae5dfd", "value": 66864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769176558, "uuid": "e7274fed-86fa-4973-b4ac-d4ebb5d1d9c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176558, "uuid": "ca027461-7f5f-4f14-88e4-9c109fb2a2d4", "value": "zerppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a24fb042-f829-11f0-a129-42010a9c0007", "comment": "Malware payload (BlackMatter)", "timestamp": 1769151814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151814, "uuid": "65833c32-fb25-46fa-ac89-8c9f00362cf8", "comment": "Malware payload (BlackMatter)", "value": "43cf14ea8a5a3d698eab8c86b7f74714", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151814, "uuid": "fdaa7c6a-8bc7-405d-bcba-567a16f4a167", "comment": "Malware payload (BlackMatter)", "value": "3ab171a4fe9b095f4bc79b88b6425a88e6962cbba0d763117a01918829fe59fb", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151814, "uuid": "df9f0729-9473-4298-ac76-804da09f2d9e", "comment": "Malware payload (BlackMatter)", "value": "6f23675742978bf2e3a4e67f3224e1266f2ede9e", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151814, "uuid": "533c5793-7aba-4970-8c34-8be51247f73d", "comment": "Malware payload (BlackMatter)", "value": "83a0f5b37e799b5a9e903645846737b1d82c1ce1cf56c3679e70841543a8955490b0bb4da0e4670eadde9f9563b6ee9c", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151814, "uuid": "d8e9ce6b-1325-4c79-9b4d-7b3d7cc93c09", "value": "T128E36D21F212D0B3C87718F12736B5B2F3DE4D2C29A96847DAD80F59BCA58232F45997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151814, "uuid": "04f8fae3-4822-4294-a547-9f39bebad399", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151814, "uuid": "05f5ffeb-cec9-40c7-9adf-dbd597ed9033", "value": "1536:azICS4AwwRlcz5AxE4vGP1iU8KnliIs3iocZMgkGJp1j2Rxwn4DcpUx3QkV3fomn:p6glyuxE4GsUPnliByocWep3JpUxL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769151814, "uuid": "b0fe4ef8-95ac-4199-b5a2-3af79dbbeea4", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769151814, "uuid": "816a1568-4ce1-4c8a-8563-8213ee45f158", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151814, "uuid": "1601887d-1882-4274-ad03-3c8409d443fe", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f03d35f-f89e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769201926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769201926, "uuid": "7149920a-955e-4031-a6f9-282b9577b6b7", "comment": "Malware payload (Mirai)", "value": "fa3158200e7640ba34fa9daada1d963a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769201926, "uuid": "e7291648-28ab-4e8d-913a-c15e4a2584fc", "comment": "Malware payload (Mirai)", "value": "3ae1dbbf7c0c9f733c7d3344c5783902041c8c859185a8977d8ca29feeb4680f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769201926, "uuid": "0368071a-babf-4425-af66-b59722a6cc6a", "comment": "Malware payload (Mirai)", "value": "4688aa4f04e1b8bea4b6cfa93f66a01049791b92", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769201926, "uuid": "c9e022ea-884c-474b-810c-a3083463d1dc", "comment": "Malware payload (Mirai)", "value": "44db8da0d66e9e96a4f0c168c31980154d594dc289b64f5d43c7b7a76e375aed737f8a6ff5bb7b51a34f5ba308ead54f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769201926, "uuid": "cb519278-bc2e-4002-81ab-d8abb5132aa8", "value": "T1BCA3120063A59CE9FB100D7715ABB0B6571DF559503B778FE104A7880F8C37A927EEA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769201926, "uuid": "e473935c-1faa-43ee-bbe8-87ecf98e5c0b", "value": "3072:O5zPSZRN6RKkZtcyrPv8e1LaXvSbSh3/AD4D:+z4K3BUR/WW3/u4D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769201926, "uuid": "97c7bf26-cbc2-44ce-a806-f77c58d1a93e", "value": 103740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769201926, "uuid": "2551c763-7b95-4d05-b245-d5acf997ebc2", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769201926, "uuid": "015d0b04-87a9-4d9a-aa37-2b06215b550f", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c17bdd54-f860-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769175489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175489, "uuid": "02b7fb09-d9aa-456f-8c76-b592039aea6a", "comment": "Malware payload (Mirai)", "value": "19ef773ff0f0450f6324eb74cb04c63d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175489, "uuid": "1ed27d86-b795-441c-9306-77fce386f835", "comment": "Malware payload (Mirai)", "value": "3afcb0412ce8a14a27e3bb9a9275f33db2109a42a62b8dee4f568d30cbbe9685", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175489, "uuid": "54c15fee-b776-4b94-b7ba-f06e5a17f65f", "comment": "Malware payload (Mirai)", "value": "c0ad1b51496a6c2736497fc771be9717d4a626b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175489, "uuid": "0bcd7bc1-3de7-4929-96a4-a77844e9a5b0", "comment": "Malware payload (Mirai)", "value": "c1a3771dd940602f65c2fa0d925c2167a402827cb82efc32f1e2d04d57f468d428302d55d4a895197cd01c82ba17e081", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769175489, "uuid": "a471589b-a48d-4263-a7ba-cc6d977b3158", "value": "T127636C128C7559ACF07B7D711039CABB9713E40AE95B6CBA3D438215401FA88F5A7FB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769175489, "uuid": "1da845b8-aedc-40f7-ad31-6f0a699ecfcf", "value": "1536:t74H8TYcqEO+zTi+yTOzHUbsbEoouCPH5:t7Q80cW+zTirTOTi25ou05", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769175489, "uuid": "5db5fede-1bdd-4acd-9cad-6bcc9f640158", "value": 66760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769175489, "uuid": "f0442ed1-72ca-43d5-8d53-4faf48040d28", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769175489, "uuid": "c4f94850-04b2-4e54-bb56-793f4b54dcab", "value": "zersh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6042cd5e-f829-11f0-a129-42010a9c0007", "comment": "Malware payload (BlackMatter)", "timestamp": 1769151704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151704, "uuid": "75eba6c5-7ac6-449c-8ef4-84d59cc23d83", "comment": "Malware payload (BlackMatter)", "value": "8fe0eed5aa48af2ffcf0cfd38221d66a", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151704, "uuid": "5123bb62-4d2e-408a-8d10-8daf04b58f74", "comment": "Malware payload (BlackMatter)", "value": "3bb10edb151f0b54ea11de5b216a0f7e4c6b899bcae54da97b3ec87b5b862359", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151704, "uuid": "910a1959-43e5-4074-a2b6-4c5687f86f20", "comment": "Malware payload (BlackMatter)", "value": "1cdb1d9573fee97477dc27c043c92f03583eac2a", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151704, "uuid": "d53d052e-0537-4869-987c-97f90ea832a9", "comment": "Malware payload (BlackMatter)", "value": "e805e0033e7e94b8a7a947e732942189b14e6c9b6577b1cd4371af3b5b2b5810259b52fc80df009ae9ae84184e28722e", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151704, "uuid": "9df0007f-80f6-4470-888d-22c21943b562", "value": "T1B4E38E21F212D0B3C83718F13736B571F39E8E2C19A96947EAE80F99BCA58232F15557", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151704, "uuid": "23c61810-c9bc-4f6a-86dc-a76579b7ca97", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151704, "uuid": "bec4df16-512d-4029-b8b7-e8963a1fb140", "value": "3072:K6glyuxE4GsUPnliByocWep7H8dxrXeykFFigg1Ek:K6gDBGpvEByocWeBH8dhXAr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769151704, "uuid": "bfcfee12-438f-4a6e-b271-d8620b6e264d", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769151704, "uuid": "4e5a5e83-34b7-45dc-87f8-9a47ed64e293", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151704, "uuid": "03e00c78-dfcc-4921-b91a-2849ebedbf00", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "504f6974-f85c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769173581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769173581, "uuid": "0c9d823e-aa81-470c-8a4a-f9096610e108", "comment": "Malware payload", "value": "98acf97e1321cb1838c10bda94c4191d", "object_relation": "md5", "Tag": [ { "name": "BB1.file", "colour": "#D5282F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769173581, "uuid": "2fe85c86-d7f4-4df5-8c08-ef4e911dfa7b", "comment": "Malware payload", "value": "3bce4115a79807d3eb298df7addc6a9c34377766ad1363da6cbf45869ba181a4", "object_relation": "sha256", "Tag": [ { "name": "BB1.file", "colour": "#D5282F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769173581, "uuid": "7fdf996a-29b1-4a70-ab7d-d480c8b23693", "comment": "Malware payload", "value": "dc6329ff88fb24c0f94c3fed5ddbe9a6e961d925", "object_relation": "sha1", "Tag": [ { "name": "BB1.file", "colour": "#D5282F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769173581, "uuid": "307cce32-9723-4e10-8b3b-565197c72f89", "comment": "Malware payload", "value": "a34a1830fd990ba399b582b6db910d92b08df0ceedeac796c30a153066fd0affee055c09398e0433570b94c11e93ff7b", "object_relation": "sha3-384", "Tag": [ { "name": "BB1.file", "colour": "#D5282F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769173581, "uuid": "ebc43b6b-c9ab-49d3-9d0e-ee0364ae6eb3", "value": "T1D60733457DB364F2C39A8BB63363546A9D90B5C902CC96F3069F9E9E41F20DE83B0746", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769173581, "uuid": "e9d292b8-41ae-41a4-8a7c-0cd7046db144", "value": "b58258e2297dcb3863be03d7366a04b4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769173581, "uuid": "39664453-0f45-4c95-8c73-1f21922ea059", "value": "393216:Y0bZgq/RJ++S2L7/+kSFuqPmRkvwYm9N+YlWc0:X1pL3jSFuqPPBm9Nr0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769173581, "uuid": "db3bb188-7ba4-498c-a65a-9004d364ce8f", "value": 17511440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769173581, "uuid": "5dd2e1fd-7898-4298-a2bb-803297fafa8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769173581, "uuid": "f77a3ae6-16cb-4d92-9e69-7b276e4a82d5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b21b8338-f892-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769196938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769196938, "uuid": "9d75c0d9-7de5-4ce6-aa17-9b1dfa8f6171", "comment": "Malware payload (Mirai)", "value": "764d5a5cd1e266dcd121f2b772771137", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769196938, "uuid": "9e5d015d-898b-4897-a5ab-d955c2e1f6b3", "comment": "Malware payload (Mirai)", "value": "3bfaa33f75a6421d1f89fd0ea14187cf6b202d0a1c9748139e487dbe2feb9add", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769196938, "uuid": "a0c77ea5-3e08-47a0-ab3b-8021d1888436", "comment": "Malware payload (Mirai)", "value": "dae45aeb04569823744804c83fc2177c202cfcfe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769196938, "uuid": "60e1cb8d-ac01-417f-9411-f9b21cf89595", "comment": "Malware payload (Mirai)", "value": "fbf0bf7a8f23977b2fc76166b2374559b940125b1021270d148c4ea41a03860de941e95d05370fbbd980ee7e72bde69b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769196938, "uuid": "7bb2760a-a9a3-4283-8ada-0980dd1808c7", "value": "T1C5B312506CC8C4763588ADFB14EF9B5B03DAC08157356E7DD697FE024ACA3C22A8AC59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769196938, "uuid": "5d82a9d6-69b1-496b-9e28-2470a38f95c5", "value": "3072:+X3tDmyKPyowIvHUOTH4Svkpc1mXVAsgR35Ms43jJN:C3tDmyUH9TH4Scpu8LgRpMs4tN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769196938, "uuid": "7e25c159-d1e5-4e19-a23b-74023af917c0", "value": 113892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769196938, "uuid": "8c013733-e23e-4b50-90de-e718aa2d6d8b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769196938, "uuid": "7b1368bc-080a-4519-a4a9-77333188803c", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a554c05a-f861-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769175871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175871, "uuid": "556f9ad4-bbc9-47b8-87b1-ad65185e3c57", "comment": "Malware payload (Mirai)", "value": "48e0fb8a1805e883b7b710b71b38e3e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175871, "uuid": "fc33aa6e-4033-4cc3-b953-5667bc9aebd0", "comment": "Malware payload (Mirai)", "value": "3c36ad0afda4ef2e3c26bb8d0f8fc34709140b717281964779abd7997d82f6a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175871, "uuid": "8ffa4acd-3a43-449a-be2d-1bb9e1863792", "comment": "Malware payload (Mirai)", "value": "7611e8e051d6f5a7a4ee26fb2ae504b8b4ff28ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175871, "uuid": "52dbb582-4132-43dd-a6d4-a15e2226e0d9", "comment": "Malware payload (Mirai)", "value": "68377dfade4253cd75f8fe168fa1caab1e63ae630f5e662ffd08ef890a98d076b2afa52711f2563ab60634a57c8d3086", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769175871, "uuid": "79f30442-3239-4e53-8b8c-c7ee175d98b0", "value": "T16FA34B25ED796E27C5C0723A51D34530F5B643AA25BC990B3EB31D5CEF18320316FAAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769175871, "uuid": "4cb3dc4d-41be-460e-8199-672fac8f8c39", "value": "1536:COms1+ZD3TqdNDU8sqZHGXHFj8ONAtY7yZ0DIpaUgvQDfbn:xFYL8NJsxuONA2GPdTfj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769175871, "uuid": "71a9ad10-c813-49c0-aca6-91085dabffd2", "value": 99548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769175871, "uuid": "cbaebff8-2a9d-4cbe-9f67-9b88844ec37b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769175871, "uuid": "aafe1896-2d50-4220-9d3c-c424bc526b35", "value": "splspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a0616d2-f84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769167236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769167236, "uuid": "18624371-03f0-4d40-8990-044f17011aac", "comment": "Malware payload", "value": "985a169f6661772c05bb4fbc4f8a2dc6", "object_relation": "md5", "Tag": [ { "name": "pkg", "colour": "#01B8C7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769167236, "uuid": "9cccf128-4c94-4802-b523-1d89bcde2f61", "comment": "Malware payload", "value": "3c5f51855a7ca85b5ed1d34f57cc2ecb19ca7c4bf7cadf6fc621606a9d7a5586", "object_relation": "sha256", "Tag": [ { "name": "pkg", "colour": "#01B8C7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769167236, "uuid": "a890a349-cf60-4e28-b857-82dc5ec5555e", "comment": "Malware payload", "value": "a7364ec27a70a85db3e3202d367aeddd88a6c0b8", "object_relation": "sha1", "Tag": [ { "name": "pkg", "colour": "#01B8C7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769167236, "uuid": "7971eb5b-74c2-4418-bc6f-cbdad37b4d40", "comment": "Malware payload", "value": "ee7f3a8623ac9a1e3c168cb5fa296398a1167135fd1493f8ededc7ed683a50c9e97b602a52f48aee2af678263319c14e", "object_relation": "sha3-384", "Tag": [ { "name": "pkg", "colour": "#01B8C7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769167236, "uuid": "b3dd2728-e4e0-4c6b-86bd-438ab17700a5", "value": "T10F8733EDE42A1F1ED1C57331A7BF25806D2C00D99CB714F0F6519A1BBB623EA490BD4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769167236, "uuid": "f84312f1-5347-4bd0-ae63-fb365bff321b", "value": "786432:awQsS0xx+U76EbQoKIayp/aszfv0QdCNFGsnwasPFW9S4dmi2cOUX/s:awQs9p7p86JsszfMQd6wC4PFWM4P2v2U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769167236, "uuid": "1c406894-459e-47bf-9909-53b9bc23dcbd", "value": 39579109, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769167236, "uuid": "e126c75d-49b9-4b8a-9887-d07a480e4864", "value": "application/x-xar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769167236, "uuid": "1d3a36f9-34fe-46a2-b1a4-1690090ff3cf", "value": "DocuSignAccessUtility.pkg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e86408fa-f85f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769175125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175125, "uuid": "bc0aa7a6-0ecb-4ee6-9dc2-fc97a079af30", "comment": "Malware payload", "value": "d15e8b5c27689d02654504eafb8a1a11", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175125, "uuid": "381af769-0341-4426-9cf3-3bc54ae77365", "comment": "Malware payload", "value": "3d09c181f116e2bf97165dfad8b2c648a5d09d238c81f7ea87d9a59c76f368dc", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175125, "uuid": "ba6421a0-ca95-4c7d-a8a3-f9bb3c40ab77", "comment": "Malware payload", "value": "5e6bece8df187a07ce8a20b42a891bd4bc08316d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175125, "uuid": "c8261c3c-e4e5-4896-872d-b80ae972a1bc", "comment": "Malware payload", "value": "74f7c8464b34422be2abea8da42fb3edd8c97f2d82281e8df54be90a3f9f91923c40065b4231f584ae1e85953ce0bc79", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769175125, "uuid": "d9937a9b-cb4c-4436-8540-eb1845ad463f", "value": "T13357001842CFDFA1B7C914A26E295B63636B35670774031ADBC06CF1C7A1A3E6ACE1C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769175125, "uuid": "aace792c-2741-4f90-b922-91ac1a141f7d", "value": "768:V91uVhi4J54iuBoqPutMyucfO/4NYHuBTOUNshRl9BuBKaJw9lNKQy7uBijJuSWh:V97t20YJgNo+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769175125, "uuid": "49a8a870-8847-4c39-8e7f-2086762a1ea9", "value": 28787097, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769175125, "uuid": "fc51a16f-d16f-4ae1-b4ba-3dd50a3788c5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769175125, "uuid": "dca2942b-6ee8-437c-bbd4-db42ea9aba40", "value": "\u0421\u043a\u0430\u0440\u0433\u0430 \u0443 \u043f\u0438\u0441\u044c\u043c\u043e\u0432\u0456\u0439 \u0444\u043e\u0440\u043c\u0456_ 056 20.01.2026 \u041d\u0411\u0423.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecd52a60-f864-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769177280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769177280, "uuid": "c314fb29-b428-428a-8a1a-8e337846b723", "comment": "Malware payload (Mirai)", "value": "7104dc2f43351da5b90a4ac26c579404", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769177280, "uuid": "a16d7feb-8d35-4dcf-80f9-6c1e1577d8fa", "comment": "Malware payload (Mirai)", "value": "3d2e7343f160704591fd03b539d0d19d06ffefba4127a51dab7ba1a4faf72f6a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769177280, "uuid": "c51eb256-b744-4bed-8b2a-590707a05580", "comment": "Malware payload (Mirai)", "value": "437779e09d304cf403003f50b50a5eb7656de168", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769177280, "uuid": "32f7a2f5-5064-469d-b279-f9ab491494c1", "comment": "Malware payload (Mirai)", "value": "97cc3eae20794588dad4e6c01585e021fbd9e801bba8daa837f3ab2cfa23224e97a6b799f00c66e5ca5ea855a534a65a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769177280, "uuid": "aa91efaa-0382-4393-aa74-41b53a078320", "value": "T1F9332907B9219F16C5C50A77FE0E53893311A39CE1FBB2029D196F6637EF45A0E2E186", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769177280, "uuid": "5995ec84-08d3-4f7b-bb1d-1eec031678fb", "value": "1536:caHxvuhFp6rMKZ8BSaX2rArseVwWLuF80xQEp9GsPg3+M:cgu3kPZ8d2rgsUlLuF80xQhH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769177280, "uuid": "de8f2c00-55b8-4de5-8c5d-858fca57042b", "value": 55080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769177280, "uuid": "25dc0eab-4567-433d-8129-5a2892ec47a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769177280, "uuid": "4198ead6-b576-496b-a3c5-a22ac141c25b", "value": "n7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33df8b80-f88b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769193720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769193720, "uuid": "80787dac-9c0a-4200-81cf-6b7b4c579376", "comment": "Malware payload", "value": "2b9683686a391aba55d6981c6408e7f4", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769193720, "uuid": "2d121b47-1e57-4b18-9e50-cc20e0377994", "comment": "Malware payload", "value": "3d7e54021498349570ee9e823d9b736a3f9f410e8654613755cfcf423a02c988", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769193720, "uuid": "6e78844b-f873-4449-bc07-d2f0523cddd4", "comment": "Malware payload", "value": "c7bb6635833127e5a58b463758929f910d2f272e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769193720, "uuid": "7688fe15-2b05-4a4a-a131-af2f94579828", "comment": "Malware payload", "value": "87b3d1770aa0ca225c1551cc40f97a1fcad30a367c179d8954b318725038af1b9c66a4dd891d12a9066d3cca64038abc", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769193720, "uuid": "5899505b-0328-4397-8761-753f6badc732", "value": "T161577C136DE449A6C06EA23AE5A21146B7757C0A4F3233DB2E50BA392FF73C41477768", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769193720, "uuid": "e48f8652-e81b-4b44-b5eb-a49ae67ffb33", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769193720, "uuid": "e666611a-00b1-491f-ae21-a38e074b20f0", "value": "49152:jpTNZzRkr4fFdqAttOi1rcB8QLzGh/LKWkYRz:jcsrcBXLW/LKy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769193720, "uuid": "0ebd9d7c-4593-4cb2-a898-30248248f877", "value": 28081888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769193720, "uuid": "a82563be-42d0-4429-8067-6d7c9447b6e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769193720, "uuid": "371c566d-05ac-40d1-9041-28a0d91280cc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccb91e57-f862-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769176367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176367, "uuid": "5324d91e-cf80-4002-8b18-5a48502e11a8", "comment": "Malware payload (Mirai)", "value": "98c31688e71fd2a70f3e752897abec00", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176367, "uuid": "ad8d2d26-cd8e-4d1e-8270-e5d0401c7e63", "comment": "Malware payload (Mirai)", "value": "3e0a775813e54987ef01d1c06b546679d25eea27087cb9fab9bcfbd558bfc1d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176367, "uuid": "bca5577d-3be0-4d62-a81b-376e99c137e8", "comment": "Malware payload (Mirai)", "value": "b33cccf5c15ede4ff87aba34e0143014adc94807", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176367, "uuid": "db7d6307-6169-4452-8846-86de91e799e9", "comment": "Malware payload (Mirai)", "value": "bfddad6cd6ff457e34934da7f08ec7335b9f02bc4926c67643a53913297a7fa33875ec96592819833b29d710ad00c3e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176367, "uuid": "2d725b2c-2820-490c-b323-dd360eaea4d6", "value": "T111B319CABC819B11D6D566BAFE0E518D33134B78E3FA7103CE145B2A638A85B0F7B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176367, "uuid": "06a645eb-d28e-4ed6-b458-7674c4e04a6f", "value": "3072:3lkipR5olQoEO8fnPvOv+HFrcWK/frVUunR6a6UQ0Rs1fVC6TZJ/:kll4P6+HF/KrVU6R6a6UQ0a1fVfT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769176367, "uuid": "57ef39e6-df8f-4508-be47-b846aaab904b", "value": 114224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769176367, "uuid": "a722611f-1334-49c5-b87e-a7a449f8ae33", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176367, "uuid": "f7f2c0a4-a8ad-40a1-a92f-a5280281764c", "value": "jklarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a26955f-f856-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769171101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769171101, "uuid": "76773c7e-bd06-4369-83b7-d5962a3278ca", "comment": "Malware payload", "value": "e143cf4e5bdd102c090abd7dd1a6ce0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ReserchOne_loader", "colour": "#8A62F7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769171101, "uuid": "6d362e46-69cd-4695-b7bd-fc1be3160281", "comment": "Malware payload", "value": "41f591f64e604740ddec7e32d2678f5f482058088399d7b762a2d4b0ce748ad2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ReserchOne_loader", "colour": "#8A62F7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769171101, "uuid": "dea04f29-f737-4200-a092-2bc9710d5575", "comment": "Malware payload", "value": "c0af5cc192938e453d864bcb827f115164b31914", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ReserchOne_loader", "colour": "#8A62F7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769171101, "uuid": "616aca99-35ec-45d6-8273-44180248d33c", "comment": "Malware payload", "value": "54f9db5e2824e3203c66d335ed41dee3c9326c0496c1848bdb05ababc240c13f2465e7ced16ab984d96a1a97a35b2f6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ReserchOne_loader", "colour": "#8A62F7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769171101, "uuid": "8e3b4674-4d5d-4f5b-9d25-ce05f60f7e1b", "value": "T11F132984BFEE5015F2BE0B3C687345100A76BA175D72C75E0DCC545A0AA3AC44AA5BFF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769171101, "uuid": "dfe9ebac-cbff-46f7-97f9-de812e1e30f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769171101, "uuid": "8c077a5d-f77a-486e-b218-30939ec98518", "value": "768:KXvR7/u+AwNbJAPZ3ZZW15+JWY9EkjRNbqRojJsTsWWEQXEQZ7f:KR7HAwZJYnz8kjRNbqRojJsTsWWEQXEu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769171101, "uuid": "df425905-107e-4b06-bbf8-fee517a0b72e", "value": 42496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769171101, "uuid": "7e8c3de8-326f-445e-8bcb-18ef3573a885", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769171101, "uuid": "7cc22549-dc04-408f-81fd-f0b78e95fecd", "value": "loader_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d56c13a-f829-11f0-a129-42010a9c0007", "comment": "Malware payload (BlackMatter)", "timestamp": 1769151618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151618, "uuid": "5a65d97a-778d-4362-b58d-2d40b2f1c683", "comment": "Malware payload (BlackMatter)", "value": "a428fa4107600e2b727875b50ecaee5b", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151618, "uuid": "6bf94c40-623e-46fc-9121-2d664299e4ed", "comment": "Malware payload (BlackMatter)", "value": "41fb6be80f588c9e7823f862baf7b43dff49206a1c45f8a03e3dbd5f15678e14", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151618, "uuid": "79cf4425-9f15-4a7a-9b54-ac126d5f8569", "comment": "Malware payload (BlackMatter)", "value": "c0bd64d834319059f399d4734fb07c8052fd8cec", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151618, "uuid": "ef1cc1be-ddd8-43a9-bd15-c0cb9dab244f", "comment": "Malware payload (BlackMatter)", "value": "456963e979638daca321e25364b9738732ff5f06d447c7f2f48229db807432972e4141308f26490cc27769e3a454ebc3", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151618, "uuid": "65e58f0b-34ac-458f-8296-a2f984ad4dc3", "value": "T119E37F21F252D0B3C83718F13736B571B3DE8E2C19A96847EAD80F99BCA48136F54997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151618, "uuid": "c63d9fb3-0097-4611-8aa2-b6094513e973", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151618, "uuid": "0efc06d5-8009-46f6-9069-1cf862a12b40", "value": "3072:V6glyuxE4GsUPnliByocWepM+CXIhlxYxBd5h:V6gDBGpvEByocWe7rhlWL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769151618, "uuid": "95cb4f20-1158-4266-92df-e15677d4405c", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769151618, "uuid": "72fe3797-9043-46ee-99e1-09f690897889", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151618, "uuid": "f61aaac7-8605-4e1c-8bd1-d6e6c532729a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c345bedc-f801-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769134690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769134690, "uuid": "fe1394de-777e-445f-a4fa-586e84614033", "comment": "Malware payload", "value": "96c29a26e4c56784e4643084c8e2b3aa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769134690, "uuid": "eb4e5821-49a8-403a-90ce-90d564f439bd", "comment": "Malware payload", "value": "45b0970fc63b105afa915027e2bc50c0703823d67f6a11e476295cdbbf5c3c70", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769134690, "uuid": "82e9ae0f-189a-455d-9e14-95756d23728e", "comment": "Malware payload", "value": "7d3eba4ff18c1738099c1b82e573508ae9a8eef0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769134690, "uuid": "6d49f1a0-aebf-4a04-b569-b89cb2d6f869", "comment": "Malware payload", "value": "3b6cdb7e32df6536474db9f20d55ab3197259e1719e3c3bc43f6a7a786758ecbfd7b26829664ae97b3f24b3dab027b0b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769134690, "uuid": "926e372c-94ed-4e2c-bfb5-0bbacacab471", "value": "T14472D11AF921082DF787F1BB9EBE22CD2093E0F51F1A5E3747300629A639845528EB5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769134690, "uuid": "d1a249d1-4cf9-465b-992d-59116b81862e", "value": "384:cEgoMxVg7bAbVU3hXYgm/q+53q2YdSVY5Ik98cF789W:cboxbUVU3hIRqNAH4Ldv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769134690, "uuid": "ec54fb30-8619-47f6-b443-de3dbd07f866", "value": 17113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769134690, "uuid": "eaf237ea-a481-41d5-8f7b-c706a4c9130c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769134690, "uuid": "5ce5880a-5a13-47d0-9340-f0c99d13c218", "value": "xans.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "718a4fa6-f829-11f0-a129-42010a9c0007", "comment": "Malware payload (BlackMatter)", "timestamp": 1769151733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151733, "uuid": "b919a7ed-44ce-4266-957c-53d58414fa44", "comment": "Malware payload (BlackMatter)", "value": "17ff96bfcc045cee6e713d35bbd63472", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151733, "uuid": "52724130-8663-4bfe-947f-4b41f47469af", "comment": "Malware payload (BlackMatter)", "value": "46bb3df9a85c89c546cf5a01f5b8d7e9ae0d6bf4d92372c82d0764bb89dd5421", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151733, "uuid": "78862830-4892-4a14-8813-5151509a6165", "comment": "Malware payload (BlackMatter)", "value": "a0d6eed4e60e11e579d0c0df7ef06c8c95ba56b0", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151733, "uuid": "9400796d-9df4-4e2f-93b9-4c506818f4a7", "comment": "Malware payload (BlackMatter)", "value": "62ddf4eb7143e0bdba8fa2fb2667a9c9c69fe6ad2337cba76310879cd12e5754319552e8b12b890ba9b57df74c571c2f", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151733, "uuid": "48161358-9c4b-4ecb-b6c0-20fe1198b26c", "value": "T1C2E35D21B212D073C87718F13B36B572F39E8D6C29996817EAD80F9DBC648232F45997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151733, "uuid": "c478316c-e905-4784-b810-80cc862bd2af", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151733, "uuid": "2024a1fd-cb5a-4737-95c3-ce2e8bef547a", "value": "3072:a6glyuxE4GsUPnliByocWepMcpy1M5Vyj+z0:a6gDBGpvEByocWeb95Vy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769151733, "uuid": "c33df262-0b4b-4ee6-bee5-b19762307368", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769151733, "uuid": "8c29c73d-eec9-4c6e-a40e-8d3e8b5b8af4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151733, "uuid": "738eae54-bcfb-44f1-bffd-ea03ea8fa3e8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d365f7d3-f874-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769184109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769184109, "uuid": "f04bd84c-399f-4c3a-9945-47658c2a1883", "comment": "Malware payload (Mirai)", "value": "f267e82603f8d10a3af408fbca8d34de", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769184109, "uuid": "a513c829-a441-4394-bcca-2b73fc95a3ba", "comment": "Malware payload (Mirai)", "value": "4788d630ef841509bb7e7621a13501d5dae99b261347890db7d81ba8c3b0e5ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769184109, "uuid": "bfdfdf43-91fe-4866-ab17-113082353788", "comment": "Malware payload (Mirai)", "value": "89c14fa8ccac4cc8037b94086e5df3b4ffcf9986", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769184109, "uuid": "e3d618a8-b916-45db-83c8-fde8089c9e6b", "comment": "Malware payload (Mirai)", "value": "0a8f0cc89c50f248b9584e03808e5e1ddd4dabd11cfe68bb3b40fcffe7743acf1e4f42725ddeda4b5aaed5df41f30d7f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769184109, "uuid": "8e8178ef-1d97-4d11-9e92-5e56b4476ec9", "value": "T140533952BD829602C5D412B7FB4E428D772B43A8E1EE32039D29AF2137CB95B0F7B511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769184109, "uuid": "e213a4ed-ff7d-417f-a680-27cbca515dc7", "value": "1536:ZIPWw0l5Uxpjsm0JVjjAXO6VzlROwz6FJGXOiL:+PWXyvtERjAXOEiJGn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769184109, "uuid": "71266f27-518a-448c-8c90-c3cf32925cbf", "value": 63388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769184109, "uuid": "3854a9db-925d-44ff-adea-b30c9179aea7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769184109, "uuid": "60d2fff4-1483-4c83-9852-acd3b8102610", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67a747a6-f829-11f0-a129-42010a9c0007", "comment": "Malware payload (BlackMatter)", "timestamp": 1769151716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151716, "uuid": "0b0ee426-d0f2-4d70-80c0-fa1e5a43b1b2", "comment": "Malware payload (BlackMatter)", "value": "7f8c65347a23759a87f203205c8cbd4e", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151716, "uuid": "740f71c5-7ada-4357-a971-3a9b17923911", "comment": "Malware payload (BlackMatter)", "value": "48975e8570cc778b5b94e51237d1c67f923047d0c90e5f9a0eb8b8da04fe04bc", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151716, "uuid": "b1c88134-c86d-4d91-984d-4a9bb5c77d29", "comment": "Malware payload (BlackMatter)", "value": "efddd561c6ca303fcef8eb20ac6bd26230084304", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151716, "uuid": "d9097eaf-22db-4588-9083-d7fe3add06f4", "comment": "Malware payload (BlackMatter)", "value": "f3652bbac246eb781d2b7817e9a77ca0933b7bc328ff513349c7301812acf268c677f887e3716161360bd8ba1d2aff48", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151716, "uuid": "6613f097-3d99-40b1-89a0-20c29e5d2f05", "value": "T187E37D21F212D0B3C87718F13736B5B2F39E4D2C1AA96857EAD80F59BCA48232F45597", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151716, "uuid": "d87266ea-6ff6-47bd-83d3-c6d405ad9f6e", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151716, "uuid": "51d2814a-b321-4e8b-b032-a669e8999f0b", "value": "3072:O6glyuxE4GsUPnliByocWepNx3AxMF2v5+IQr8n:O6gDBGpvEByocWebxwxfzhn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769151716, "uuid": "c540433d-70f1-441d-a27a-8c9a58e911f6", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769151716, "uuid": "4068612b-247f-419b-8291-e0d61f3df176", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151716, "uuid": "e484b6f9-d72d-4f5d-91f5-74b5d4385db2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0a36c25-f86a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769179756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769179756, "uuid": "ee5aeaf0-acdc-4b10-926d-bba727f2e1f6", "comment": "Malware payload (Mirai)", "value": "a3950321e61e40f4609ee9df917f624f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769179756, "uuid": "623c287e-34a3-4ab4-ad6e-bd973270f6f4", "comment": "Malware payload (Mirai)", "value": "4954b7fe51ddc54245bda28cf09cfb5d7df6bd4000f250703ad1d97ee7457367", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769179756, "uuid": "b87b12a4-abb9-4725-86d1-ad8a6d3291e1", "comment": "Malware payload (Mirai)", "value": "21e517ef4e435c8a805c18d9d98a37f51dc9baea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769179756, "uuid": "ec47db66-e184-4f3d-8ec1-a3d9ebe708d0", "comment": "Malware payload (Mirai)", "value": "a33674eb25889227363c9c679e44d36dca2afbfe571e58fb7e79b6dbeb753b3018b24dcc8fcf8c39d4af9f045ab1af51", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769179756, "uuid": "b48f594f-6546-4904-bd35-354351eaf906", "value": "T1ED934A4273690547F3A74DB1283FBBF157AED5A120E0A2C5685F9B0F8135A322586FCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769179756, "uuid": "74956d7a-6d3b-4a2f-84d1-3bf16ef7f981", "value": "1536:31vBfxHPOevoRiVo0krLYIHiv2pICdP9Fz5gDNPweHS9MBIsRSzonLzf/J/b1P:31fOegvaCdPfz5OpS9tfQ/RP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769179756, "uuid": "ad468742-d365-4e23-bdd7-492a0daa97c1", "value": 95544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769179756, "uuid": "2fc0a593-e224-4aa7-99e7-082c58580d2c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769179756, "uuid": "65c54e92-c210-4ecf-93ae-ac5c9b99020a", "value": "splppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "492e8f89-f85e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769174428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769174428, "uuid": "0e1a7ca6-1213-41ab-909e-27db527f313d", "comment": "Malware payload", "value": "d949160fb1b4d145760a37f8f49844a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769174428, "uuid": "de4b159b-4f7a-48af-81db-b3f6a4416ddf", "comment": "Malware payload", "value": "49e93499bd177055bee73c36a904bf8d75571dc32866d18c5c134f8ccb89ee80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769174428, "uuid": "d27141bc-7c68-435e-b6e6-5678790489e9", "comment": "Malware payload", "value": "3b5a0924885fd61bfa28959b0f63a2085d9c5316", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769174428, "uuid": "3c4ac642-b6e2-4173-883e-ce45612d0db7", "comment": "Malware payload", "value": "060e558405b5aa3b92ce6b37f86cd3ec04c5b6eae9ecbf6347911a503d2d5780b790a11ddde1b4dfaeab0134efcdfdc4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769174428, "uuid": "596007dc-6b8b-47e5-a3e6-4f1a53ea2bed", "value": "T137086B4663EA05C4F9F7DA758AE66617C673BC122F3095CF221C17291F336E08976B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769174428, "uuid": "3c898d9b-00dc-4968-940d-a35692bfe18f", "value": "e05e31a5063c852520cc6950fe83ad1a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769174428, "uuid": "48858888-14e5-4be4-ad03-72e8157ffc61", "value": "393216:ItxQ1X2CcyJ+SKBmR0nuZeLM8bo1PgayexQu58EASEhoIaE2lShWuIRWVbTBUaaV:IrI8SQJh7DxaikFA5rs3wbvav", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769174428, "uuid": "841694f8-a336-4278-8e65-cb8c12b657e3", "value": 82507258, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769174428, "uuid": "df919b46-4223-494e-8390-5a1102298129", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769174428, "uuid": "3b721f8a-7f8c-4070-9fe1-18a7259db1c9", "value": "s\u0435tu\u0440.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a70f2994-f861-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769175874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175874, "uuid": "f3725330-b2c1-4d0a-af05-f1ee663742a4", "comment": "Malware payload (Mirai)", "value": "5197c4bc57270e0e37babe333cc4b375", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175874, "uuid": "d5c1535e-6b2c-4e4d-93ae-e00e6acc71a2", "comment": "Malware payload (Mirai)", "value": "4a216103695814c9887a8177b7643aa9a1a49c1301008da13d25d0fb88a3416b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175874, "uuid": "40fe37ec-ce3e-4706-9322-9cf621120ead", "comment": "Malware payload (Mirai)", "value": "0b6c31ce9536fe77ad66b5bd0a3b237866ac7e68", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175874, "uuid": "dfcac7ed-0afc-402a-927a-e3b0086976a4", "comment": "Malware payload (Mirai)", "value": "c2f895a21d2691137d38eeb72ea5a45bfd2c9b03f9166f924f04809b1e471b0a99e4888415aaa968b585e991099e1857", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769175874, "uuid": "f463a172-1e97-4776-9f9f-c11393b1b519", "value": "T11183E84AAFB21FBBE4ABDD3305A6074A389D650721B53B3D3A74D81CB61A64F05D3C60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769175874, "uuid": "5da68e01-17ef-4537-a42a-90f201bc3488", "value": "1536:Y6eC0557ruogqP5/2uomY/ge3mz0stqtYC9tFMblM81ixuZm/blK9caQZfqFX39o:d/4jY/lbanvP+Nw2mQA50", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769175874, "uuid": "1922e148-31ca-4995-8e6e-2457dcf5752b", "value": 84576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769175874, "uuid": "51797885-2fb3-4921-9016-b53bad3a1810", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769175874, "uuid": "7edc539a-1b02-49bf-abdc-a7bee65c6bbd", "value": "zermpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fa73554-f829-11f0-a129-42010a9c0007", "comment": "Malware payload (BlackMatter)", "timestamp": 1769151756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151756, "uuid": "04d62a77-9738-4161-9ee6-0fe18bf93dfd", "comment": "Malware payload (BlackMatter)", "value": "b99d3075c0aac8bce49eed74c655d2d1", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151756, "uuid": "096d6457-53cc-46d6-95ee-23fa8a5f3f03", "comment": "Malware payload (BlackMatter)", "value": "4be3266e0c7427823adb0b3b5136bb89d9f59bc1eff9e89456cb9517f585e52a", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151756, "uuid": "de3bb6d4-4a57-4e2f-a180-144fd1a7e620", "comment": "Malware payload (BlackMatter)", "value": "f532d999977c445e55221c04658f264e57955084", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151756, "uuid": "08fb5abe-2724-49a0-80f7-5233cf6cf9b8", "comment": "Malware payload (BlackMatter)", "value": "6349325d798d7dcb98226763288f78ec3c98008242aecfd9c7a9d9a82da5ec8c135a5dd0fbbcc48ec60a1fd9562d8d5c", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151756, "uuid": "cd49095b-360b-4179-83c2-f0235b22e985", "value": "T1C2E36C21F212D073C87718F13736B572F39E4E2C19996847EAA80F5DBCA58232F45A97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151756, "uuid": "1ef752d5-1e2b-42bb-b0a2-28eef86138ed", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151756, "uuid": "49718f51-63e5-4ba8-ad1f-2779692c5f6b", "value": "3072:B6glyuxE4GsUPnliByocWepDHaLdYH+Hf1zNy:B6gDBGpvEByocWe1aLdYH+/1B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769151756, "uuid": "7eea6635-9a8b-40b8-977a-c39cf5cd88ac", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769151756, "uuid": "c4579a0f-cb0e-4d26-a977-e3f46317cb56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151756, "uuid": "7ba29fd3-5f6d-4b1e-a205-f543416b46f8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf6163ae-f862-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769176344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176344, "uuid": "079b916a-ee73-429a-b3b6-81b5e909f9f9", "comment": "Malware payload", "value": "840f913647aa52d3ee60d85f3dccc1f8", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176344, "uuid": "175c7c5c-5b3b-4a8c-b8a7-7f8d1b8f5a15", "comment": "Malware payload", "value": "4e202279c693e3448b1d1e62f2de422b91d6f38554f651afd3880f735471a414", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176344, "uuid": "c7798689-4fbb-4d1f-bab6-11e3e295a604", "comment": "Malware payload", "value": "a8db91c4500709065b9fab99ec360caae98e341e", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176344, "uuid": "0c8ee1d7-d862-4d65-9cd6-7392bdb63a22", "comment": "Malware payload", "value": "c7b99e52246e788a854ba549f9ebdf4354f059f0803bc8df440dc6debe16c26b8c9f087f93a09fe6e39bd8a3c21a7f04", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176344, "uuid": "19c079a2-e8e1-44b9-a219-9c6ebaff1b56", "value": "T1D2C423F9F3542554216DA3EED45C44FFB76413CB3E32B22A9C1E88FD6A3E966248090D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176344, "uuid": "36b57bde-7923-48c1-9b50-2ae71571a968", "value": "12288:9+L1FsOgz0odkqcDxD/IVbrypf+Yeh3sUQqAPfaal17lXkT:9+RmJddDVbSfEh3sHLJl1BkT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769176344, "uuid": "d07098ca-85be-4ed7-9fdc-314b73341621", "value": 579978, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769176344, "uuid": "808e8cf0-b2d6-478a-b0ba-45a794196d5c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176344, "uuid": "52b0f499-cf6a-47a3-9f7d-465f696d6b2c", "value": "Annexure-1.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66e3cc82-f86b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769180061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769180061, "uuid": "78fa21f9-6d9e-474c-866d-e20693f63305", "comment": "Malware payload (Mirai)", "value": "c6c366861cf50ccc4b0eb12bd5b72d02", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769180061, "uuid": "02212418-1fb1-4ac6-9e0d-364028a77973", "comment": "Malware payload (Mirai)", "value": "50e3def86ec846988981966741007deb6f0e17fe2738e3b6b0c98dd5605a840b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769180061, "uuid": "6352660e-ed57-46eb-b3a8-5f36d8cc32f4", "comment": "Malware payload (Mirai)", "value": "7670924d712d8a4964f270cda7de196c3f22495b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769180061, "uuid": "956e8029-2e0b-47eb-ada9-257da72c24df", "comment": "Malware payload (Mirai)", "value": "99ad88daee3c5ceea140c050e55ff1c221415a28ec04535e6868d9f9f8a43fe8afbf00edec9911807f8a787f8cf3e970", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769180061, "uuid": "a6fa9208-1f24-45b2-977e-8cc8cd0e4f05", "value": "T15FA31CDABC818B11D6C166B6FE0E518D33134B78E3FA7213CE185B2D674A86B0E3B545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769180061, "uuid": "0e474888-b1db-487c-938d-2873f168aeee", "value": "3072:7HTrSBxz+r+EeBfM2PbhlK1YICyH4xol8fqNmMz067ant58gR/:I+8PPjK1YICyiolfNme06GnHb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769180061, "uuid": "1d82d9da-6df9-4ea5-9795-a607ce0e7573", "value": 100788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769180061, "uuid": "e4c6a86a-be1b-446f-898c-2ffc4cea5925", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769180061, "uuid": "4ac7f2a7-ead2-48ec-ba58-c939ab96579e", "value": "splarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2daa030-f880-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769189182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769189182, "uuid": "fc5fa6b6-986c-4d82-8ecb-f5fd85d56cc1", "comment": "Malware payload (Mirai)", "value": "7e0114b83b49abcdc3bc907bfb03d1d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769189182, "uuid": "e9995ce7-ffa6-4f1c-a941-df6788c2f0b8", "comment": "Malware payload (Mirai)", "value": "511a14362f0693fea5349acf6a44c1426abe7f660c036c854a5b9a4566e5f316", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769189182, "uuid": "283a9f7b-5780-47a0-a2fa-5eb55bc6777b", "comment": "Malware payload (Mirai)", "value": "b615c2d0fa90e4527126f76378ecb6d8d78466c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769189182, "uuid": "b7567515-d3f6-4e43-b3a9-8f7684f2c314", "comment": "Malware payload (Mirai)", "value": "17b9894eba87c31ff63b3d0fbdbead8b6d4de26d1bcfa48435781a27bb1a3c9950b8afa99ea50b183caa438cc028f05d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769189182, "uuid": "3c5ce3ac-d3bb-48e2-ad70-c57692698af6", "value": "T1019302D42174BC7AD1A7E5343D19538AAAC0E50AA14833E8953CDECE7FA3520983635A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769189182, "uuid": "e7e5c650-4c0b-4746-9fc5-b5987114950f", "value": "1536:N2J96v4+LOavkp55ewSUH6/bs7aqY17D+T8pD6bRDCFkDZdEy16lPZ/AP:c96Qcvg5rrajs7hg76gpOa04yaPZ/g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769189182, "uuid": "230a608e-3d83-4281-b615-8cdd9aa89fc8", "value": 90356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769189182, "uuid": "09c7163b-64a2-46d6-80ef-2e080b41ec93", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769189182, "uuid": "e573580a-5ea0-4e18-abd5-53e6585ed60e", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f29b1fa6-f89c-11f0-a129-42010a9c0007", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1769201341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769201341, "uuid": "8a3c5d69-06ee-457a-8ba6-edcb2c4c1299", "comment": "Malware payload (Socks5Systemz)", "value": "afe1a7499b876d31947b237a448aaefe", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "P", "colour": "#A08B48", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769201341, "uuid": "4bf68fd8-96b7-434b-b9c7-d2b2b4f1744c", "comment": "Malware payload (Socks5Systemz)", "value": "51258056b341a6520f5e57b978fb969bb0cb2e772c4abe94df7c7006c9cce6e6", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "P", "colour": "#A08B48", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769201341, "uuid": "fe931984-d39c-40a6-a268-f2241d603eb0", "comment": "Malware payload (Socks5Systemz)", "value": "7ec408ab8cc16ebf1828d64522e9a14ca94fa25f", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "P", "colour": "#A08B48", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769201341, "uuid": "9883311e-8e79-4e2b-bd52-545348b4c949", "comment": "Malware payload (Socks5Systemz)", "value": "f42045333e0e0d92e7acc89579aff905416225b9675219e57406afb014ae00205d275e8dc35d12d26bf5397734d8b890", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "P", "colour": "#A08B48", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769201341, "uuid": "1af45eac-6398-4d71-be45-d230fd941158", "value": "T12BF5330BF6D6407EFB74813465DAA3A449B6AB6811200DF437DCAF4E5BE3A82DC4C791", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769201341, "uuid": "25800113-c216-4ec7-acec-88b257910c1b", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769201341, "uuid": "fcdbdfc3-1590-4c78-92f4-416842415d12", "value": "98304:M69XmfpkIRyKPP9c6IRSuL/JR5n1xqbNEWNu:n12keyqOBM2xCS7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769201341, "uuid": "8ebbd1d1-9e04-4003-96e6-d3ef3129f718", "value": 3460005, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769201341, "uuid": "f0af5d7e-9b4b-42c7-acda-93469eba0671", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769201341, "uuid": "9ab5f493-2ac6-4186-af6c-1d07d710de60", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14f8d850-f862-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769176059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176059, "uuid": "a1ed910a-0e38-47d5-9062-0be9de98dca7", "comment": "Malware payload (Mirai)", "value": "02831f3bda82aa8bd7cbc0c2662c8298", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176059, "uuid": "e840e40b-f047-4a8c-a7c7-b33363334f53", "comment": "Malware payload (Mirai)", "value": "52cea539ff1e7522d4f1d484809c0f5e506955341b9930cc036a41bf9b78e129", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176059, "uuid": "f9148c3f-71b0-4732-9f3e-3c1a8b676773", "comment": "Malware payload (Mirai)", "value": "ff8824663377033cd7ba50db5b01980d140adb8c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176059, "uuid": "882e76e6-37a7-45d4-a16f-ef8555501b8b", "comment": "Malware payload (Mirai)", "value": "9d7b108ab0a3f315600d8556fd4c046166c4499e5cf50839f74c303e8a68901acda04098971e5c88fcb929fbd11730f5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176059, "uuid": "b2e5b8f5-a811-47b8-9089-9a2231101f7b", "value": "T1A5B3F80ABFB11FFBE4AFDD3345A90749299D460621B93B393974D81CB25A28F06D3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176059, "uuid": "38427335-e77b-4545-8c7c-502ee14b5dd0", "value": "1536:EoXwI6q/ukgm35/KmoINyW23aH0UJqhYCRibRc81OhulO/cKClmZfqFX39wu7r8N:EYVfNyqhlNciwuoQgIW5j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769176059, "uuid": "8c894830-f537-4741-bb1e-2c155018cd91", "value": 111604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769176059, "uuid": "5cc7afc8-c7a2-4619-8ac9-e8f070255e9d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176059, "uuid": "d6267569-e99d-4ed3-894d-f268117eb3ec", "value": "nklmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cfbed3b-f82e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769153792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769153792, "uuid": "058032ec-5bae-4ef1-9885-d10684024b1b", "comment": "Malware payload (Mirai)", "value": "e424f4f1c1563f4c1a0f3a74b4ec3b91", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769153792, "uuid": "4bb2ce53-5e2a-4e70-9f37-12a5f241bb7d", "comment": "Malware payload (Mirai)", "value": "53fd4663cdcf57cef80ea33494f3b982a6fbdfca0306600696a1c7efdac2f9ae", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769153792, "uuid": "eca43d05-b06e-4bc6-8e54-a953d9923039", "comment": "Malware payload (Mirai)", "value": "af1fe0251a9df605fdd71ea8f1e7413e9b211837", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769153792, "uuid": "9a2c05a9-02fd-4212-a933-9df97ed27110", "comment": "Malware payload (Mirai)", "value": "d12db8d1989d7c3fa3bcce6fb643f05a253b5d0ea42ed0f80102ad25cb2ab01efe46cdfc2c2b2fbe6e9bbf49095a70c9", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769153792, "uuid": "df007acd-b485-4518-8091-859f22b118db", "value": "T19FE0ED8E64126782C6ABEE3BE063DC10F00BDBC105401F00F0C4AA37BCD8A893011AF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769153792, "uuid": "d5b03e64-a110-4da3-8155-a783a52f0626", "value": "6:SJDO2ebAhTu/DO2QSA1qDO2Saa6A3UDOTAASPnD1DOa6AAhDOo1A+eX4y:gD+QUDUSYqDO61DkQ/D1D8TDJ1YXT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769153792, "uuid": "ef77c614-a2a0-4d1f-bc94-5337136d6081", "value": 398, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769153792, "uuid": "5bf546a4-37d1-4849-b720-417d4366e6d8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769153792, "uuid": "78cbc19e-36c2-4e7b-9f9b-7a6c82d658a3", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63742731-f86a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769179626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769179626, "uuid": "598ddc4d-686b-4d18-b83a-d478da1ead24", "comment": "Malware payload (Mirai)", "value": "c2f095c554634a82b1ede990172aac60", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769179626, "uuid": "4fb3a0f6-2fa6-435b-85d4-15a304c261f6", "comment": "Malware payload (Mirai)", "value": "552d27705576447d9c707abbcd44d6d253d1cf9c5c25e915dc62f228bb7723a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769179626, "uuid": "159a7a4b-d630-4321-838b-cf60056ec087", "comment": "Malware payload (Mirai)", "value": "5f137e8bb4e32111b46248e3684f7f7be1dc6ff4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769179626, "uuid": "7e7569b2-8622-440b-b4a1-ef93efd49b01", "comment": "Malware payload (Mirai)", "value": "0d72e0c70b466202ae6a18233a4ab25530633ee50e467fa45bd413a5c810c505769c97fe989a2e022a020e03ade22b87", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769179626, "uuid": "708b9887-c27d-4bfe-9b35-2944f7f1f3e9", "value": "T108435BC09142E8F6EA190175213AF337B572CEA802B8FCFBF75957764429AA4708774E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769179626, "uuid": "214e6501-8b7d-46cb-9c2e-ad5ce29fcb83", "value": "1536:YLV0AY0j2dP2tLg8GiKn8whAYv2zbEXjdKsRceBXGlT2ceVvu:YB01eeetLg3vcY+bejHRc2XSTS1u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769179626, "uuid": "5cfd4c9b-a817-4131-9f86-baaaf895dbfd", "value": 59536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769179626, "uuid": "7e11f24b-12a2-4056-9a46-1bbfe8b2c912", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769179626, "uuid": "ef5dba04-6eca-4cc2-80b8-58afc4e4d3e9", "value": "zerx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c877a46e-f842-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1769162616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769162616, "uuid": "0b7daee4-59f9-4cfb-ab05-a6a14c3db5f7", "comment": "Malware payload (Vidar)", "value": "7c3a234867485ed7626cae2ef87eb559", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769162616, "uuid": "7f761ac6-2536-4573-83fa-b3061f393b4d", "comment": "Malware payload (Vidar)", "value": "554465b68b9a1ce90b95339845f87f71d78d3945b536df846b6dd80bb29fd6a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769162616, "uuid": "ea28cc0b-5bbe-4759-92a7-729d7b6b1b03", "comment": "Malware payload (Vidar)", "value": "bc153e2f8fbf03703322b04c2d4f491fe274a9e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769162616, "uuid": "62cc7823-0e3b-44d1-a038-6ea2648411b7", "comment": "Malware payload (Vidar)", "value": "d776f1bb59942b2efe176807bfe4b93026e7d407b2a10772c494bf3fade6e3fe97d0c7fa8327458d1ec565cf04e7c70b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769162616, "uuid": "ab3058c9-8f09-4a10-b51d-b3d5387d68f5", "value": "T1FFD41ABDAC60E336F60C90BEE286D3539E217C410236AA9319BE93241245973DB577FD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769162616, "uuid": "8198f453-80d5-4e8e-84c8-9c5af0fc4f86", "value": "d0abae3ba8c9e5e9126893b543187d31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769162616, "uuid": "f8c51a1c-bb60-4265-9757-800a312c250f", "value": "12288:0RwejsJEr1pyO4bjyWgev0Pbj4lpwXvjeuyHT0QQz8n5s:8wgsJEr1pyRjynI0juGLeuyHTx4w5s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769162616, "uuid": "a5b9a0d4-71f3-49ed-be72-da9b6932b163", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769162616, "uuid": "85f75bfe-5926-402d-b6a0-75538b365561", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769162616, "uuid": "1da1b585-b10d-446c-ac9c-ff54e028704a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5615d1c9-f829-11f0-a129-42010a9c0007", "comment": "Malware payload (BlackMatter)", "timestamp": 1769151687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151687, "uuid": "1967884e-11ba-480a-bf9d-8cf474c6cb6c", "comment": "Malware payload (BlackMatter)", "value": "d03f48b7f644799c79799e19979f9ce9", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151687, "uuid": "71bb577f-7d40-4a4c-80cb-6238879963f5", "comment": "Malware payload (BlackMatter)", "value": "55cc603248b4c0858d18c029c500c2663394102b6b63b06cb147eab2168448ae", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151687, "uuid": "8d685945-d1eb-493a-a36d-edf8919f3ab1", "comment": "Malware payload (BlackMatter)", "value": "8df93b8dad3c0d6219f311e7e78d28be5d5bc3eb", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151687, "uuid": "c91bc847-cabb-42f4-a341-8d15b3d6a7ff", "comment": "Malware payload (BlackMatter)", "value": "21eb91a5176dc8b04be460c1eec8a2ed8a2424772156bc96ef2270f4c518051151e745e48401026ca62656116e1efb4b", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151687, "uuid": "323f7638-e770-4d42-a7c7-0d4a93877492", "value": "T1EBE37E21F212D073C83718F13736B572F39E8D2C2AA96917EAD80F99BC658132F15697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151687, "uuid": "28307c60-4e26-4b0c-b902-b8741693e0eb", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151687, "uuid": "796c7341-3a62-46ce-97ec-2939b32dc65d", "value": "3072:+6glyuxE4GsUPnliByocWep5aT1EwGONbaU:+6gDBGpvEByocWeLyDDNbaU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769151687, "uuid": "20e67e8d-665f-4eef-9a58-8b063faf2f26", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769151687, "uuid": "8a358254-b6cd-439d-a776-14b98af6e960", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151687, "uuid": "20376644-02b5-4e99-84e3-63c30531667e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62dc4552-f859-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769172324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769172324, "uuid": "98d47d77-ee75-4bc4-b793-29b86916c18d", "comment": "Malware payload (Mirai)", "value": "da0176366d8099cec74f44726ae5c20b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769172324, "uuid": "2b8ff51b-b290-47de-b5f3-4e529dc57638", "comment": "Malware payload (Mirai)", "value": "5643642320cc1c5f4a31fbebaac6bb87b37058c5461f32379ca46582a14c941c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769172324, "uuid": "906397db-9c47-442e-a0f8-0f89ffb770e6", "comment": "Malware payload (Mirai)", "value": "f62e04b17f78799df41504cbff385885b9de92a5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769172324, "uuid": "a46b4924-b886-4dec-8766-717af57a8e6a", "comment": "Malware payload (Mirai)", "value": "3d65288cab8b63b5cbb93675387c1972f3fc64db0c1a5f78576d74b051f94af490f37576083f6864474cfb61a071fdd0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769172324, "uuid": "e4a729fc-0d3d-4705-aa73-f23f55282cb1", "value": "T18773E70AFB700EBBD86FDD3746AD0B4525CD524721E83B7A3574D828F25A18F4AE3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769172324, "uuid": "30950768-8011-4e28-b48f-c08065ec9029", "value": "1536:o382pCI6i5oEPDIr1dUy++4yQu7zn7sLC/bT:oM2B6GoYabsO/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769172324, "uuid": "c1840c0b-6f5a-4ab2-a9a2-4ff9947b7dc2", "value": 76500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769172324, "uuid": "6f2deb8a-ec9b-4dc9-a8a3-1710fa5d1b1d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769172324, "uuid": "76cffcdc-dfc1-4548-bd83-2ba8f6d66674", "value": "nabmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "661bed89-f895-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769198099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769198099, "uuid": "54b6badc-c917-4410-9f2c-fbcdd4abad77", "comment": "Malware payload (Mirai)", "value": "ce6a1512010aae2b274e229d3777985f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769198099, "uuid": "d4734db0-ed73-4b50-9c84-4168770f8ff0", "comment": "Malware payload (Mirai)", "value": "567fa40676b9708ff104a36d4c03af79fcd359b1ae24bcf2a92530e9ef13d849", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769198099, "uuid": "06399253-4b93-4634-a4ba-88fbad03a75b", "comment": "Malware payload (Mirai)", "value": "2941ee94ff0e37d3dc1aa9f913a1498b7c55fd43", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769198099, "uuid": "1014207c-19fa-423a-a573-f62e9295aacb", "comment": "Malware payload (Mirai)", "value": "2f09965c5d85e4c4e466b7144a9c7a1579c6e0556f6e680ce1002c7f1243c0b8e989fefb9cb6f35d8e93d4c8e486bf3f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769198099, "uuid": "583fe9f1-794b-470f-9dcf-5bc00e6fecc1", "value": "T18B93E80ABF600FB7EC2FDD3715A91A49258C651712E97F3A7A34C818FA4A50F49E3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769198099, "uuid": "76f58676-7551-4a3e-97e2-06a06ced8c3d", "value": "1536:932fCidnnJARyxmU0ZMZziQk9BBWaRakzZ2pUyIYo97eY0yWC1bZ/3Ia:x2fCikU0ZIziQk9B4aHRyXo5WGb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769198099, "uuid": "7a3209c8-1830-4bfd-a2c2-02486dbc2105", "value": 96768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769198099, "uuid": "44b4aa27-95fa-41d2-b17a-e8274e1c914e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769198099, "uuid": "cd03f7ed-42aa-4704-8f15-15d57f6c0413", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b04ef29-f829-11f0-a129-42010a9c0007", "comment": "Malware payload (BlackMatter)", "timestamp": 1769151722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151722, "uuid": "24f78b49-d4a6-46ec-bdf5-0ed01c530503", "comment": "Malware payload (BlackMatter)", "value": "06bd4afc59e6c5b974aad55e997615d4", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151722, "uuid": "43eaa950-6702-4dea-8ac1-51b2ab9530f2", "comment": "Malware payload (BlackMatter)", "value": "56dab61397e1cbea1d8dfe7cf728ca9d61c0040881780b5f45cfe68fcd47ed6d", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151722, "uuid": "3dbbaca1-6be7-4928-91e4-650a7331cd39", "comment": "Malware payload (BlackMatter)", "value": "caf178b887c7069673b5c08bc19da0a420cff7e5", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151722, "uuid": "f818a896-e482-4868-bd87-9be333f4b3b8", "comment": "Malware payload (BlackMatter)", "value": "3bb2e3c41ecbd2038bfeffb5e91c75a18bc069cf2116f19f68eff076a30bf03c90a6d3d909c45fcf4907472f4385aec0", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151722, "uuid": "a93e317d-3948-40e8-97ea-294d717cbc0d", "value": "T1ECE37E21F113D0B3C83718F13736B572B39E4E6C1AAA6947DAE80F59BC648231F45A97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151722, "uuid": "54a97a3c-38bf-4415-8f37-2eedbbaaa302", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151722, "uuid": "a1d690b6-c220-4d92-a103-2490513ee0c2", "value": "3072:N6glyuxE4GsUPnliByocWep+LdI1TEHGwU:N6gDBGpvEByocWeHR0Gd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769151722, "uuid": "add5cc22-ce0b-490f-ac3d-b7f1784f66fc", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769151722, "uuid": "728f8e52-55d6-4415-af10-7ff0ea1dbe04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151722, "uuid": "81584619-432c-4cce-b5a5-7074ea58570b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5514016e-f86f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769181750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769181750, "uuid": "260798d2-25c4-43f8-b0f1-65e2c4e2b91f", "comment": "Malware payload (Mirai)", "value": "3caed552d24ce37c57784e5159a909f9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769181750, "uuid": "c0b82187-dc3e-4a39-9d97-013d8103ea27", "comment": "Malware payload (Mirai)", "value": "570e146408f5f30e3079c2b570b5a6f1c3627116fffdd3e9eec91fa04ece6931", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769181750, "uuid": "1b2f6319-aa06-47bd-81b9-cd3f254b33b3", "comment": "Malware payload (Mirai)", "value": "892b5f1130c4187f863b7931c6fde5f7bc4b91aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769181750, "uuid": "7f3021a0-9f2b-4af9-b699-7bb0a33c9275", "comment": "Malware payload (Mirai)", "value": "b50bdae722e16052539fc73b83b93dfafae66a9156fd15ea63b3a54ea9c08b93e0c30e2162d9dab2dcd2ec727b2a47a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769181750, "uuid": "3d4fa4e2-987f-4a2e-9f4e-be0134346cf5", "value": "T126B35A77C8696F68C259D1B0B0B09FB92F63A58182871FBA55B2C3754083DCDF605BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769181750, "uuid": "5cd69322-6a5b-469e-a3ff-d95f9842e704", "value": "1536:Sa97/a/qUAmKGJHMNGDCRlKZKs7LvqPz5dvzpO0WAMGNdtFC/zC:SyanK6HcGDMsZ/OPz59Y0WvGNZCbC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769181750, "uuid": "26c53962-c6c2-423d-9f6c-7179c82fb363", "value": 116576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769181750, "uuid": "2b887289-2899-4b50-a9a4-1b5fcad05193", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769181750, "uuid": "ff1c95c4-98cd-42d2-9ef0-d742e414e1c5", "value": "bot.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ee1a994-f864-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769176907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176907, "uuid": "e6fe6be5-b548-44c1-b7cc-c16113df66c2", "comment": "Malware payload (Mirai)", "value": "066e08b98fab7cc1ad8ab280516b422a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176907, "uuid": "eb0257a8-9a62-4c91-bae0-f9d25ae99d1d", "comment": "Malware payload (Mirai)", "value": "576cb1eaa0aafeedceaadba91926b6ce077a5352fe20d4a7a72f8c660ce4618b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176907, "uuid": "6a8ba150-a101-4385-baec-165e2c0f47c0", "comment": "Malware payload (Mirai)", "value": "2b707be9bce47ed95ee800d0c257d2bdecefde29", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176907, "uuid": "b1394929-fd32-40a8-9e18-cb227ee920a0", "comment": "Malware payload (Mirai)", "value": "12f7e89db5e9f11578de438386578d06594c1f8b022c2a7ffe08c39410ba57e5449e75cdc764d79cdc7736ab5b138136", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176907, "uuid": "cb6793aa-562b-473d-8d07-44c66a61a949", "value": "T110934B25ED796D27C8C0713A51E34630F5B6439A26BC990F7EB31D5CDF18620312FAAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176907, "uuid": "c5ce5a23-3aac-4e8f-9670-9ae928a6c639", "value": "1536:jNj6kOpQYNzdhsYECroHQXwyHErh5XNA3hVHQjHh29sURkwJbF:jd6VHlKCSrbNA3oNaKwJZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769176907, "uuid": "8541d224-2329-48f9-9cc3-373ec19cd83c", "value": 91668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769176907, "uuid": "a9c5d86d-145c-4348-940b-58deb46c5b79", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176907, "uuid": "4f3f6d39-c8e1-45dd-b1da-e538b9c65cf8", "value": "nklspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a27cc1bc-f84d-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1769167277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769167277, "uuid": "c63365a3-dc71-4b6c-8178-7cdc9467709c", "comment": "Malware payload (ConnectWise)", "value": "3defa9e403fec2998bbc159668d3b134", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769167277, "uuid": "c39e95d5-0a4b-4f00-91eb-3c8959dc599c", "comment": "Malware payload (ConnectWise)", "value": "57e21f36d53318f8144e181a0fcea917580ab6e641178ef79e5f47cfeea3591f", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769167277, "uuid": "a5efb315-1439-49ff-9563-8371ebe12e4b", "comment": "Malware payload (ConnectWise)", "value": "2f9250f000bf12a0fe120c3f57c749c51c9502be", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769167277, "uuid": "8d7f6b6a-8221-40cb-b4a6-61672f95dab8", "comment": "Malware payload (ConnectWise)", "value": "ad6d8240f97e74496e56f3430c38ff399fe7ef2ab0e23301d3aefd4854648a038474ccf587d1d5162b2d4544433246de", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769167277, "uuid": "6c384082-11da-41ba-8d6d-756040ae070d", "value": "T1FEA6237127F88429F1A75B39EE3A89E229387C64DA26C05F17B43D0E1971E509B72373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769167277, "uuid": "2286f61a-5dc2-4438-b5d6-b5b7877de048", "value": "196608:zKaLNkbgii4QVKaLNkbgRKaLNkbgdKaLNkbg:LWgiiHJWg1WgxWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769167277, "uuid": "ca5571b2-6a0f-48b7-80b2-0179142bfec1", "value": 10072064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769167277, "uuid": "eb2b70f5-1ffa-4726-bd9c-c747f7e8485e", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769167277, "uuid": "9e2d121b-4c9a-460f-bc81-2d0a677687f5", "value": "Complete_with_docusign.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d25569de-f825-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1769150177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769150177, "uuid": "40f1ca10-14ba-4960-8ba1-0dd0b764d37e", "comment": "Malware payload (AsyncRAT)", "value": "548190e66107d0a1d786b70ac94cc20f", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769150177, "uuid": "90b62c68-f296-49ef-bf14-d2ca74fc26dd", "comment": "Malware payload (AsyncRAT)", "value": "59fea32e99c83248946a486c6533618c900a6934b70e3cf5b9d119bf72481462", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769150177, "uuid": "2f0e12e5-b6ae-447c-a31b-7d36f5eea066", "comment": "Malware payload (AsyncRAT)", "value": "a7dde97c0c2d729206ea1ec004943b3b0c5eb628", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769150177, "uuid": "9fe39233-f213-4e61-9c60-16c2f87bea9a", "comment": "Malware payload (AsyncRAT)", "value": "f41a98441b0a8b0f0c06e0138ddb9a0ce3feabd12478a4eb3d47044179b04ce13bf4e1afe6963786f65afad2ef0a00bf", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769150177, "uuid": "9df10c15-0f87-4cff-9065-f1054f9f34e4", "value": "T1A5D22A04B7E48A65E1BC5BB98D7282019376E9474C63DB9E6EC440DE2A237C9CE14FF0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769150177, "uuid": "51620c52-0900-4d49-8203-f642e49bead2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769150177, "uuid": "033acb00-23ab-4aa3-b988-8c8b1f6067bb", "value": "384:wcXWSxAYBwASOF+QKIcjFh93buUsTQxnCJf+jJGIjJxZoe/+:wC9xRlSOIQK/jLRbVB/jKe/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769150177, "uuid": "813be95d-87b0-4439-9f2f-4f7be8bbc10f", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769150177, "uuid": "5fbabe46-062e-45e7-b8f6-17f44c2898a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769150177, "uuid": "3e30c6b4-04c3-4880-9833-035b2897551f", "value": "AsyncRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ab2a587-f829-11f0-a129-42010a9c0007", "comment": "Malware payload (BlackMatter)", "timestamp": 1769151641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151641, "uuid": "094fd32d-cd4d-4d18-89b4-ef3fa7af17a6", "comment": "Malware payload (BlackMatter)", "value": "a6d2d9b4a56b14abab9eee08e63b0a14", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151641, "uuid": "71aa9645-2832-4981-b338-8b96ab5c3bc9", "comment": "Malware payload (BlackMatter)", "value": "5a3e61eab1551f1459ec1a0303f5b37b981161c21bf7d1818893415711e52cc1", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151641, "uuid": "7a529407-d1eb-4cfb-9476-4185d31ae8e9", "comment": "Malware payload (BlackMatter)", "value": "846bccbb4bdff1ab40ef1071b0ec0733f60a100c", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151641, "uuid": "282ce34a-a048-47fe-86d8-e96544a7773d", "comment": "Malware payload (BlackMatter)", "value": "bc5785fa559e5afbc9610c15447bb6bac7fa520083c7b378ad320599eacf170307c79b4c3dd5ffd8f019d0374fc5d002", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151641, "uuid": "c1f63828-a03f-4830-874d-46008aacbecc", "value": "T1D8E36D21F112D073C83718F12736B5B2F39E4E2C29A96847DAE80F5DBCA58236F15997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151641, "uuid": "ee34972b-a717-40f0-adc0-f82670f33307", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151641, "uuid": "ec12a203-6f1f-4769-a9d4-cc79df98a435", "value": "3072:C6glyuxE4GsUPnliByocWeplHSu6Wpal:C6gDBGpvEByocWeLHS8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769151641, "uuid": "ebe97eae-e4b6-4f0b-a70c-579a0dad3c20", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769151641, "uuid": "782525a0-230b-4a6c-af72-5d688777a2a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151641, "uuid": "482ebb1c-c75d-45cc-9f9c-995106b7a534", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40264873-f82a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769152079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769152079, "uuid": "406075ef-3b5b-4cb1-ace0-af2ec7207bbc", "comment": "Malware payload", "value": "e63e74e3c441a90fe7a05c79e3606ff2", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769152079, "uuid": "e578e610-3890-46ad-adcd-7f436165d1fe", "comment": "Malware payload", "value": "5bacabd07b70c4dc686e620c59947ac31e9ca94c041f4d3ef4bca4baba785eec", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769152079, "uuid": "590647db-faa3-4985-a6e9-6008fe5225b8", "comment": "Malware payload", "value": "a0541e312f7fb4ff35c2017ebc7c11be15b652c3", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769152079, "uuid": "f26e6b73-30dc-432d-89e1-f871828e5c25", "comment": "Malware payload", "value": "d6f63d864b91aef4de1684c2033a82df1009feabe62b965d7be91d67d9e09a928fb06ff0a00eb3b79d9ed6210b56aab2", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769152079, "uuid": "d4cee4dc-68d5-4372-8095-3058a7f5ac06", "value": "T14FD512BB58B269576A904663FB0F2C1A339B29D13B14D341EA51909C7F3B1D38E92733", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769152079, "uuid": "ffe5e4f3-0c07-4f95-a787-acd7781058d5", "value": "49152:SOc2yD4lTPq+rXFCR7b4tVViqlAKA9mXbIpwSp1eH04ZMIk+FX:SoyEFPJTY9UwUTSZILFX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769152079, "uuid": "f8d023b2-ccf3-4aea-b095-092c8a8df6d5", "value": 2976454, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769152079, "uuid": "82895019-544a-43e7-865c-edd896b15faf", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769152079, "uuid": "b1b06847-235c-4318-a3dc-c4abd52dfb93", "value": "La Compagnie Commission DN-11.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b78274e-f89b-11f0-a129-42010a9c0007", "comment": "Malware payload (Expiro)", "timestamp": 1769200551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769200551, "uuid": "01322772-e481-46de-a331-d47dd31150f8", "comment": "Malware payload (Expiro)", "value": "cf095c0ac335f547a7857ccfff91d990", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769200551, "uuid": "73d19b96-5c6c-4350-9d11-f397791f0976", "comment": "Malware payload (Expiro)", "value": "5c523a295e64ca123dda4f517b1c9ee609af1f33ad3d8879c0e56505141a81d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769200551, "uuid": "50a2f141-af71-4c46-842c-c792d0302a36", "comment": "Malware payload (Expiro)", "value": "818480bb9a4fffce7ceedae6333e1e0c2dc960d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769200551, "uuid": "ac711d7a-c108-4f3b-aacc-35dd3669f694", "comment": "Malware payload (Expiro)", "value": "09bef99a3b327fe977d351eadc6b571886e32d2e8f2f483b03b539132b5d4fb53be274c30592e17eeed12ff4fa3436f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769200551, "uuid": "ab3b29ea-a754-4304-a339-997bbeeb7855", "value": "T13885D026E650B025F95386B06E79A35A392D3D391280ED0BB38D9F4A37B198374F531F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769200551, "uuid": "7701af88-2ac9-40dd-9b56-dcaa94d09107", "value": "c464eca66b129c448db0280585946050", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769200551, "uuid": "f7a336ca-be60-45c8-bb0c-488d3e427009", "value": "12288:/0aQ1Cc6gFfjXplaRnHh6THV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5c:PQ1wqpVg9N9JMlDlfjRiVuVsWt5MJMs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769200551, "uuid": "39b77b87-f4c3-4306-b7e0-eef902a740dc", "value": 1843200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769200551, "uuid": "0bab6dca-7514-424f-9423-d5e1b952bf7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769200551, "uuid": "f987c080-8255-4b13-8935-a81f519a1187", "value": "Cotizacion del espacio culinario.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8c1dba0-f83a-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1769159234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769159234, "uuid": "312c5b47-d98a-45b0-b32a-3b75d22ab36a", "comment": "Malware payload (Formbook)", "value": "701cd5aa59949cf1a5977b1b8391d114", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769159234, "uuid": "72dfaeb2-4b23-4b07-8754-066a0cf3a1a1", "comment": "Malware payload (Formbook)", "value": "5d5b5fb6d5b5c22099734f91f4144f99a2867d4020ddb39b4ed66522b66ccbb9", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769159234, "uuid": "2003cc69-7486-4f65-b690-cfdf0547bceb", "comment": "Malware payload (Formbook)", "value": "923860b8907596527772dfd3da8314440572ae3c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769159234, "uuid": "bc845ec2-38cf-4f70-b967-36195562c5f9", "comment": "Malware payload (Formbook)", "value": "1eec35925cbe6b49b2e912165d00ddb6ba3b86d921fdeec1a3610a7d8d39bde5e0a87d1fee54c396c9c17e683311e822", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769159234, "uuid": "3c09c68b-7185-475a-8dca-34d633a9b9a9", "value": "T145E423DEA9CE0548140195D36E7212CAE1DBCDADFA9D1B4D90FC1CA80B73A2D8533F68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769159234, "uuid": "0cf0558c-9090-42a4-9a25-f2e7366a586a", "value": "12288:8yvA5DaqojIqYTxaEgXmic1nsbcIgbwgp1ZZCuvc4:8HalYTxd4/c1nsbWbwgKQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769159234, "uuid": "58fa6e68-2dc7-4c7a-a631-5c65987f624a", "value": 705422, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769159234, "uuid": "eb3f6b6a-ce45-4dbb-ac59-fbff74ce8ba6", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769159234, "uuid": "8714aa3f-9fbe-476a-97fe-d435d5554c12", "value": "Quotation Request for Equipment.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "172a427b-f858-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1769171767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769171767, "uuid": "3593dbee-9d63-4305-8361-0fb4519e98bb", "comment": "Malware payload (Vidar)", "value": "ddd255908aa228b897aa33979678b8c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769171767, "uuid": "71e79f8e-9a4b-4c76-84e1-af7ae934415b", "comment": "Malware payload (Vidar)", "value": "5dc12f0cdbdd1488c42f1f383872a78cb95712473ec8dc1e98492fa90a8ac1a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769171767, "uuid": "00503a44-fadb-4b3e-94de-627ea383c871", "comment": "Malware payload (Vidar)", "value": "644b1ad602a88ac57fac9de39bd60731eae4dfba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769171767, "uuid": "219a06db-d799-4b35-98d0-748af4303d29", "comment": "Malware payload (Vidar)", "value": "3858d1d236bab88420e0687ef514574cbbf7726c426c25bf5a577861ebae4185cbb7eb7f8975dcee4c4d130b2a92939f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769171767, "uuid": "ca8d9563-89f1-4866-aa80-2bf77ecc444f", "value": "T186C55B07ACA68C66D46A8138AD7650497F70BC084B3033D72EA27BB86FF77C15876758", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769171767, "uuid": "9c16c11f-ebb2-473c-aada-8a159ec1347c", "value": "0951d9f67c9a9e1b6ea746ed01bccc26", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769171767, "uuid": "b57b4781-6e2a-4993-93b0-128ad3bb2902", "value": "49152:BQRnetZFIVs6JLAYNGw+ravczELqHDgGzPvS5w:BzIHGEukI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769171767, "uuid": "9f399eb4-644b-4566-9269-419989799ce6", "value": 2694360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769171767, "uuid": "756ad16b-ec6e-4514-877d-f6c0ee95fbb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769171767, "uuid": "a7772498-7297-4dd5-b77a-3d23c00da465", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82613e98-f864-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769177101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769177101, "uuid": "31b1de15-78c3-4588-803c-a4e9a2e401d5", "comment": "Malware payload (Mirai)", "value": "67a0cebd7e74d3af3397fc8fae77860e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769177101, "uuid": "2732310b-b810-4ab1-a809-0788d31bd56e", "comment": "Malware payload (Mirai)", "value": "5f0d962ef96aec45df07b09525e5d70f9ebdb282c868f5d80bcf54ce089cdef6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769177101, "uuid": "22d3c531-a58c-4abd-a98a-45eca415088a", "comment": "Malware payload (Mirai)", "value": "c95f882aee251c6c7f6a4391ab5c7623f61f8e33", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769177101, "uuid": "f95b3d66-ee2e-4773-a51f-fc5056a16788", "comment": "Malware payload (Mirai)", "value": "370f32f08da3a2aca0cc5befefd0731b2a0a4871d05982d5df24edf0a4308cb93fd07e3a08eb8927ce935eee666afefb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769177101, "uuid": "83c32305-4b12-416c-80d7-8dea9fb6a595", "value": "T103D33A17B5C180FDC4DAC1B44F9AF53ADD32B1AC1238B16B2BD4AA221E5EE315F1DA50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769177101, "uuid": "800a5a2b-b3bd-44c6-ab17-c989df823ccf", "value": "3072:tGtwnNiaOnUTuFyPT9OSQb9OaogjV2a5li7CFkzASQPdL:tGtwnNiaOnUTMZL9pSQPd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769177101, "uuid": "e15755bd-1536-4ad0-ac48-b802ae24efce", "value": 139576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769177101, "uuid": "19929a83-a5bf-4394-baf1-e86fb6468e99", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769177101, "uuid": "b618e2f8-3422-4983-a724-8294939eb581", "value": "bot.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73c8c25e-f862-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769176218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176218, "uuid": "ebcb99cb-0d35-4371-a465-e710a7f2e88a", "comment": "Malware payload (Mirai)", "value": "1d6720765e806c244b9243fd44d7482e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176218, "uuid": "65471fdf-2687-42be-b284-154b54135881", "comment": "Malware payload (Mirai)", "value": "6045e9650290b610870f6a08346537a4920617e3af78f060c03f117de712b292", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176218, "uuid": "f62bc89e-b5bb-4cf9-ad7f-3737ad61b269", "comment": "Malware payload (Mirai)", "value": "6ba4b4b618da463aa6410e8506dd1c57b762fd6c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176218, "uuid": "1cf86d98-f3d1-4729-adf0-8c2ada9d5fc7", "comment": "Malware payload (Mirai)", "value": "cdcccfb12d2c374796d8d90d183e44b998db07f0a9f5650d5ec559bc60f0e4c1ea8dc03a620172154b1434f944fadd57", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176218, "uuid": "00e277c3-e015-44c9-a7ee-a7c450198cae", "value": "T18763088ABCC5C202C5F060B2BB1E55CE375643B8F3E2B157DC19AB29671F86B0A37255", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176218, "uuid": "39b4082b-3393-43ae-9d8b-2005ea41befa", "value": "1536:Z00sQsToPt/JybD0DcM4gR3d32qzmpal5:ZDsB0Ly00S3l2qzAal5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769176218, "uuid": "eb225ec7-50cf-4d46-8e10-204f6570887f", "value": 68440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769176218, "uuid": "50c352f4-a741-4e46-ba0d-a2e4fd31a45d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176218, "uuid": "1f6c4590-c0f7-4f8d-b05a-0bcd154a195d", "value": "zerarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "647a1926-f807-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769137108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769137108, "uuid": "b4294e10-6ccd-4fc5-aaf3-de2ec0ed4894", "comment": "Malware payload (Mirai)", "value": "6e2d7839d17852ff2b29e49eb1eac2e2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769137108, "uuid": "570fe4b3-3b27-40b6-b1e9-285c0089dcce", "comment": "Malware payload (Mirai)", "value": "60ee54d823037df20b7cf3cac83011410b774a06a7a98d36c48031608c1328ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769137108, "uuid": "896ff870-34b2-48bc-8d61-34a86842ac23", "comment": "Malware payload (Mirai)", "value": "5954d9c354ecd0d7c44ecc4e7e252646e0807a6b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769137108, "uuid": "e44e74b3-775e-4263-9bf5-87cf38352585", "comment": "Malware payload (Mirai)", "value": "c2dce4fa8a70868841d5fcce2c1baec18f0a97ea4232f71d90943f4777e88e9a6863f915f588c98f3c2123f6159082d5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769137108, "uuid": "e2878aeb-38d6-4c8a-918a-224102e24985", "value": "T11F435CCAEA43D5F5FE1A02781033AB765F72E53A0064DB42C7A4E931EC52A54E71B39C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769137108, "uuid": "029b191d-65b4-413b-9c87-dbb29ef19670", "value": "1536:IeujKYsEM+K+EUVEd3K7GUrE6N34J/fihAzRw:I9KYsEDK+Eu93JN3o/6R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769137108, "uuid": "4dcfd836-9a2d-4a47-8204-0e862b2091ff", "value": 55472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769137108, "uuid": "6a6f0a52-3b42-496d-ad06-7a2174526cc0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769137108, "uuid": "dc824c6b-4b20-4b95-8a4d-74e9e46c038e", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "369e326c-f834-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769156358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769156358, "uuid": "946db118-f5d7-4401-9218-d30ea2d6e843", "comment": "Malware payload (Mirai)", "value": "fcbe78270e72e9b3fb03dd59bd94eb4a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769156358, "uuid": "22dda9b7-70d7-4c75-b667-da578480201c", "comment": "Malware payload (Mirai)", "value": "62959d7bf658f6d679c35062dd2421d830c94a4fc1b2336f9241a70832a42b49", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769156358, "uuid": "747089c9-0d54-47bd-82b5-8533293ed817", "comment": "Malware payload (Mirai)", "value": "47fa1ca534510f22adc6fb69561c6c91f139544c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769156358, "uuid": "d4a21210-f8fc-47c1-b057-b235eafd23f6", "comment": "Malware payload (Mirai)", "value": "4c4d4c2576100726b69a6bab209e8041680a59fdff08d4105a737341d39fe1343c3f6f270f86899ec06e5e55882f1115", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769156358, "uuid": "875ece10-ee2a-4e4a-9463-5d848cd0d9f7", "value": "T1F701B5CF19111EB08564EF2CBA7344296009C1D1F6630BD86D47083B8DE5B0F75B6FA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769156358, "uuid": "26e00373-3123-4f7d-88a9-c8801360a8e6", "value": "12:xVHI+jQVHj+jQVHjIWT2T+jQVHyeF+jQVH6tz+jQVHnSF+jQVH4VND+jQVHT+jQR:ZBKIM2Sq43ty+JzV4ZjM/Ln", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769156358, "uuid": "20ca17e7-3453-484c-9941-c28125c2d76b", "value": 762, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769156358, "uuid": "8e60b99f-bd0d-45b4-a557-04a7fa36d8e1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769156358, "uuid": "54992f41-3d3d-4b5f-93ef-758f4fe81bd0", "value": "t.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7bc17b1-f837-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769157863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769157863, "uuid": "0fe5d175-72c8-411d-9c72-cd7e6e064abc", "comment": "Malware payload (Mirai)", "value": "c98704d4fdd60123da077a609dd6c87b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769157863, "uuid": "d73b9101-ac54-4e92-ba71-a05938d6399b", "comment": "Malware payload (Mirai)", "value": "636c15620eceafdad3636111bbdc899a52f268e53fde8dab00317a03435af76a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769157863, "uuid": "327466ba-e9de-4097-9430-6f7c02321367", "comment": "Malware payload (Mirai)", "value": "bf53d22bd223462f8a5aabf1de34427dd9653ae3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769157863, "uuid": "6b7ee61e-0e32-4a58-851c-4ff126cea360", "comment": "Malware payload (Mirai)", "value": "ab6c966fe0beaf90750a0472ac21c1c6f7c7a5b85af4fb0a05ee509469f28aae7c4a99d41a677fac8519514429415a25", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769157863, "uuid": "a5e7f1e9-8b26-4958-8ffc-0a4db614defa", "value": "T149F3E916AB510FBBDCAFDD3702E91B0139CCA55B22A43B363674D528F54A50F49E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769157863, "uuid": "7c632ddb-c8f9-42e8-8049-16d55fa87eec", "value": "1536:UtfjgPCou6P7T1LJa7vv0YxRXIHBQ/HHZLOIiTmgCIOALrerF58qnCwAJeH:UxjDo/31fhQ/HH/DIOkrebnCREH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769157863, "uuid": "0465b6eb-2b6d-4aee-aa86-ab0705c13790", "value": 169388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769157863, "uuid": "d51c53dc-31a9-4d61-9e2a-6a9d59cfddd3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769157863, "uuid": "e6d69db5-1ed8-4291-84a0-f0fce1d767af", "value": "odin.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81d2be36-f841-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769162068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769162068, "uuid": "6447cff5-0673-490c-8112-b6b30b929009", "comment": "Malware payload", "value": "d98c5ffdc749b3b64f8ab9231438370b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769162068, "uuid": "832f5068-d328-4804-9c7b-b188073f3de1", "comment": "Malware payload", "value": "63c80f5826194dace1255bb210c2d9bcc460b7abcb4d8eba09c045d5c8c63efa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769162068, "uuid": "5281b241-87a4-418c-8852-82fc47f91d2e", "comment": "Malware payload", "value": "797210977e28ad4d2e67e5746e269512a091c760", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769162068, "uuid": "6c0a5148-ea1a-4e1f-a9fe-923e0767d7ff", "comment": "Malware payload", "value": "0ec8db6a0b0e1e7a41687ead1c179f5be84510cf2ecdee3b4050855e94017d0e9b60985573fa79805664972426d2a972", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769162068, "uuid": "5e8b0bcf-577a-4156-bbbc-59afd2d0983b", "value": "T18163290ABD41AF00D89125BAFE0F538933535BACE3EE7102DE142B2527DEA1B0F7A545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769162068, "uuid": "906a2cae-6ba7-4d7d-bc16-859173f55208", "value": "1536:LKnoM7K3CL5PWa1ZulsabR62liy9diYT+MVW9GsPg+oCd+:qK05PT1ZulsaFTT+sm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769162068, "uuid": "fe5b0d7e-b5a3-497c-aa8a-703466029efe", "value": 68092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769162068, "uuid": "d6e39b9e-6fdf-4982-89d7-b8fd82e07869", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769162068, "uuid": "1e0ab319-2485-4308-acfc-68df23ca4e0c", "value": "n8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b32b71a4-f878-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769185773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769185773, "uuid": "8045c3f2-9b36-4707-88d5-79611355505f", "comment": "Malware payload", "value": "8a43d2d488451cba5c6c4ecbc91ad5ba", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769185773, "uuid": "f673b14a-787a-41ea-97a5-8b9f4f1d7829", "comment": "Malware payload", "value": "63d1fdf7706a94f5e4e73b6d895bac9f72a51e39b75e626b4d92781e6d35756f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769185773, "uuid": "54596da9-7b32-476a-ae32-599c013728d8", "comment": "Malware payload", "value": "431aa0f65f62c272500764ec856098faa27b7393", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769185773, "uuid": "1583f359-8eba-4dea-b5a3-92d3dc7936f9", "comment": "Malware payload", "value": "4dc837d45113f0f5001833ab6b617de3aeeb86655a92f4a6428e1a25d6983bd0dad0ea1ec8af3d72ff7c1f1e85f332cb", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769185773, "uuid": "80d47df5-2603-471e-9f52-42058e6a5cbb", "value": "TNULL", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769185773, "uuid": "20d20e66-ee52-4410-b12a-760901126256", "value": "3::", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769185773, "uuid": "615e90ab-221e-41d7-9d7b-86daa88ea435", "value": 299520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769185773, "uuid": "7feebe58-753b-45de-82a1-e4bcc4bd37ba", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769185773, "uuid": "9ab110c4-0771-4cfc-b4c1-97ef9469f552", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13197450-f89c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769200966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769200966, "uuid": "917fc136-c994-4fc6-b305-04a198d0c9ea", "comment": "Malware payload (Mirai)", "value": "03a2d8a08302aab81202f29bcf37ecd1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769200966, "uuid": "ea4ea7b8-e2bc-4af8-87d0-d22e367ecfff", "comment": "Malware payload (Mirai)", "value": "648148d9e4679fbb02f7158835ef045b76f9d0c5cc61647c445b38933aadcd7a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769200966, "uuid": "7745a8d7-50ed-4c33-980c-a60075ce8601", "comment": "Malware payload (Mirai)", "value": "ccf67ec7eaa461b28f1f083eae053f345a2e6e97", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769200966, "uuid": "425ef153-cfe4-44ba-9e97-091e38f70bcc", "comment": "Malware payload (Mirai)", "value": "99506a0aa735475d77a306e14b1fba02120824c972829a4fdf5c5dba686b24b868360b5c64944f3ef495c88f6a83fc16", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769200966, "uuid": "b58752c0-323c-4f12-b2c4-81962a15c499", "value": "T115D3138AA4540665F17B79F5104A6DEF2896C418A9C2CCDF2BD4ADFE4E3D310B5013BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769200966, "uuid": "851418d1-9dfc-4ebd-88fe-a020f4511150", "value": "3072:IdXHqz+AjH9yXdaiYdlK/YubySNOppcomXogBkt37:IXqzT9uM1U/Y7SIiomXogu1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769200966, "uuid": "b61d6ed3-1fc4-491f-a8ed-382ce0006fbc", "value": 137412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769200966, "uuid": "0cfc5f22-122d-4b2b-bd21-4fc4111921c8", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769200966, "uuid": "842e94c0-b8c5-4837-92c8-0130f153740e", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3aaf5223-f894-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769197597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769197597, "uuid": "c3f6091b-677b-4416-9e12-ab8e58557e0d", "comment": "Malware payload (Mirai)", "value": "efa209989ce2ed9b9ddbb9167b81ded8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769197597, "uuid": "35b8a5f2-4c40-45e2-9bdf-5a5cca6d2640", "comment": "Malware payload (Mirai)", "value": "65ebfddf4f9fd4576715d78e13721223a6286ea8e75b8c122143d1734b03ebc4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769197597, "uuid": "a057cb0a-91cf-4eac-a874-aa509a46c00a", "comment": "Malware payload (Mirai)", "value": "3ae7c2a22301323f96be424f028f74ec821af72f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769197597, "uuid": "016a416c-90a7-4178-bd9f-f4a2e89aa33f", "comment": "Malware payload (Mirai)", "value": "9768d377db568d95dbb9353b3dc4fdc603f83096ab7bc2dd6f60d10d36f9553ca6b0af0986b17af66254ce2c7648167a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769197597, "uuid": "77d0a34f-aaf6-4497-b160-1fa72859f05b", "value": "T12F83194AFD829B15D5D922BEFE5E118A33136B6CE3EE7112DE105F2427CA51F0E7A402", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769197597, "uuid": "4db1dbb6-db41-48cb-8a31-786519947d95", "value": "1536:l+nE/rKyGYV/9pFiX+vvpATBPyrTVfR5GuScUNMKp788Ole3ihyaDxu:dRGlPT9yfFRUuScUNMKpxTad", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769197597, "uuid": "bca2bdda-6133-4a81-a800-8cf3cb446b03", "value": 88420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769197597, "uuid": "46f15719-cc99-40a9-8dff-c4f43920f71b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769197597, "uuid": "866816c9-ac53-48ff-aabc-8924e8908b6c", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dd35c8d-f89a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769200259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769200259, "uuid": "5989f09c-0873-4fd9-9678-65d18465dc5d", "comment": "Malware payload (Mirai)", "value": "70764c2537a585b01678bf984eec4efe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769200259, "uuid": "e9b49872-a263-4a03-a381-28d5c462a211", "comment": "Malware payload (Mirai)", "value": "66c0b26b89d36f249f6886fa3269271906950eb083d9757a26fffe2ad1e748da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769200259, "uuid": "066b3ea4-c5b1-464c-b88b-345c035e2173", "comment": "Malware payload (Mirai)", "value": "704409a788d3a7d7902e77e3588afbec793d286f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769200259, "uuid": "fdf33a0c-694f-420d-9b25-3c54b1362914", "comment": "Malware payload (Mirai)", "value": "66ce0b4a582bd1ca99ea23d13489b85b69f014d678fd707d84446c50da0adc4cc88722ce01ade1ee83da60e88f42ceb3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769200259, "uuid": "8d3b491b-198e-47db-80ed-40a4633483fd", "value": "T10BD312ADB46D54F4D3511B7CC88E0929A3BCD1DFA5362ECBB825D7A90A2C524480B3DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769200259, "uuid": "bae125ed-cbf0-4840-9685-2f3b277b5934", "value": "3072:HLMQYCz0kVoS4A1Ho0jJ4Q2WM/9eWpkDEBIy6t2vVRN6wf2:HLCijfVjeQ8ezDEgt2vXN6we", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769200259, "uuid": "53782ba8-f7b9-485c-840e-da87a7ff1ca4", "value": 140928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769200259, "uuid": "5500da04-886c-4edc-817a-edf817157265", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769200259, "uuid": "6f4582d6-4534-4d86-b2ee-8b7e748fba7c", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb9e388f-f844-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769163480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769163480, "uuid": "f7671fa9-a3da-478a-826a-74c6fb5fa741", "comment": "Malware payload (Mirai)", "value": "6f3ee18b6d8d0cbf71df761212807293", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769163480, "uuid": "c43e5475-cda3-43af-91a4-de2df769eab1", "comment": "Malware payload (Mirai)", "value": "66e53a1518bf2f7eef9dbe1d5a756b10a3f37147641c5089b2e6fde85bec90b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769163480, "uuid": "551e9528-a880-432f-a905-a930b8b53be0", "comment": "Malware payload (Mirai)", "value": "e633f1a97a5991be2ba3124e6f76ca4f3b66a1ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769163480, "uuid": "543bfbb0-1ad9-431f-8a41-3a0f2498e0e5", "comment": "Malware payload (Mirai)", "value": "80eadb0d02db142bf6f5ba4542e3c500c8ef47591e804e458844316c9dde113bece43386701fba150c61eadb62bae081", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769163480, "uuid": "7369ba29-0c4b-489b-bfb0-c6cbe0790a1b", "value": "T16493E717B9829F01D4C631FAFB9F41493313AFB9E3E931119D24AF9027C6ADB0A76512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769163480, "uuid": "6324c999-ef8e-4971-8cfc-1966c152debe", "value": "1536:avn9/eCcu5OUKqCJiaHIGcyJ/a6l1r89le+ihNqfYKIYkFHLX:yeduoULC0a3cyJ/aIrfhNqfYR7HLX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769163480, "uuid": "5658160b-220e-4a1c-810a-a51cdadea8f2", "value": 91632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769163480, "uuid": "26872d16-a324-4a54-85a0-936a2eb0e686", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769163480, "uuid": "26d6bade-1db9-4019-af23-41dc88e29f34", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a704de89-f829-11f0-a129-42010a9c0007", "comment": "Malware payload (BlackMatter)", "timestamp": 1769151822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151822, "uuid": "a89dc7b2-a02f-4dc8-ab0b-76cee4419fec", "comment": "Malware payload (BlackMatter)", "value": "bab09c4b2158d3da02004d8c0450daad", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151822, "uuid": "e4109454-dd96-4219-b90d-5628860bfb54", "comment": "Malware payload (BlackMatter)", "value": "67acb73457262a41508e41e7777113937594ce158e6a8e73eef2c5a2b16ce384", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151822, "uuid": "d0e89b2b-3b4a-4fbc-a8cb-82feeb484684", "comment": "Malware payload (BlackMatter)", "value": "9f97f12714855e18b26c5811706324ec9b604ac2", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151822, "uuid": "f26107e7-1d0e-43d7-b844-64e4158fa555", "comment": "Malware payload (BlackMatter)", "value": "86700f5c267121e013d4995841e46071b2936a78c5dac1b32c9c364394466e06ff5465d43e08274fd5c9a93cea598668", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151822, "uuid": "00bf7200-24ed-4866-9f77-5c929b048cca", "value": "T14BE36D21F212D0B3C83718F13736B5B2F39E8E2C19A56857DAD80F99BC658232F54997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151822, "uuid": "7e243b66-4653-41d1-9242-30e7a72f1401", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151822, "uuid": "c6809421-892c-4abe-af6b-0afee517b728", "value": "1536:HzICS4AwwRlcz5AxE4vGP1iU8KnliIs3iocZMgkGJp1cLyuVzSDAdmWQUNnEXJha:46glyuxE4GsUPnliByocWepFAdu2nkJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769151822, "uuid": "a4f6e0d0-a48d-40cb-b843-d1b918f6400f", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769151822, "uuid": "4ab6d605-283a-4b5c-8152-ee3f1b078743", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151822, "uuid": "afffebd6-37bf-4106-b5a3-2939ceff0aeb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c24b6963-f860-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769175490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175490, "uuid": "e878980a-864c-4a8e-a348-a783463a94ab", "comment": "Malware payload (Mirai)", "value": "8192ccb0341586bd34d500109796488b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175490, "uuid": "0949ba6f-33e7-47d8-842a-7abd3a10e125", "comment": "Malware payload (Mirai)", "value": "67b69ffe73aad94bdf96cb92c5c261761c5ec5a39a3f3d21ac0a7f427cddb43f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175490, "uuid": "f130cad1-14c1-4e63-9b78-2a65652464a8", "comment": "Malware payload (Mirai)", "value": "3448ba0a0d667134280d203f2cc0a3215fb4386e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175490, "uuid": "ceedf376-67f6-4d6d-9f11-64a884807632", "comment": "Malware payload (Mirai)", "value": "bffbc0cc8d8eff6063ec1deaeec8678360f891893cf08752b41cd195b41c48df3890d35fca44eb628227f07a875df167", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769175490, "uuid": "8c4edb33-7133-4e6e-b062-81f0102116d6", "value": "T146B3B64B6E529F7DF32C82354FB38B36A659238233B0C185E66CDA405D6038E586FF94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769175490, "uuid": "8b8a7500-ccc8-48f9-ac0a-746c71780e6f", "value": "1536:4WHK6OZBDbRDbySb5D7Gfku9i+u8SvI9ovw9+HF2/bXI:4T6AlCfku9i+u8D9o/F2/7I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769175490, "uuid": "fed7155e-4887-4ad9-97ca-bcd4889a8182", "value": 117452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769175490, "uuid": "34b7dffe-4904-46f3-84d2-5cf63b50ed10", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769175490, "uuid": "301c8397-c344-4ec3-9bd3-debfeded957e", "value": "jklmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1c0c1b8-f829-11f0-a129-42010a9c0007", "comment": "Malware payload (BlackMatter)", "timestamp": 1769151840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151840, "uuid": "b43667ce-ad91-4142-9d18-5008d21d4104", "comment": "Malware payload (BlackMatter)", "value": "0d73a686487815372e266860544795d5", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151840, "uuid": "af200094-a192-4112-abb0-d6bb4503a8c6", "comment": "Malware payload (BlackMatter)", "value": "68666eec45ae5f29e414dbcca1a99d2a767c45f934c7490d3464f0ce7e8cd833", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151840, "uuid": "8a0151c1-ae17-44d5-99cc-f7bab1cdf1ca", "comment": "Malware payload (BlackMatter)", "value": "2b0bb605eec5e078af93521888d8b715968ffa8c", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151840, "uuid": "311b3967-9b43-4583-a7f8-762882084c42", "comment": "Malware payload (BlackMatter)", "value": "ac76f195ce55932d8d685d66cf15544ab3b8c298a75addd21c8ab2cc169c00e0071faf335284eda530948c0eb57ad0f4", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151840, "uuid": "b87088a2-c7fe-461e-a332-33bcfa1ea850", "value": "T1EAE37D21F122D0B3C83718F1373675B2F39E8D2C25A96857EAD80F99BCA48232F45597", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151840, "uuid": "dad003fb-9df4-47fb-a56f-62ad44284f10", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151840, "uuid": "b58e7dbc-ab96-4fb1-85ab-d8b8ff166136", "value": "3072:46glyuxE4GsUPnliByocWepEsE3Z1H14Jj5mB37:46gDBGpvEByocWeDE3Boj5O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769151840, "uuid": "06a88876-9654-4456-a811-87764cb47e34", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769151840, "uuid": "436875bc-de79-47f8-abde-fd5408157056", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151840, "uuid": "bf63a230-0d8d-4fbe-8231-e5c58a25cc68", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e87be3c-f829-11f0-a129-42010a9c0007", "comment": "Malware payload (BlackMatter)", "timestamp": 1769151647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151647, "uuid": "3fa040a2-6569-4793-99db-4f098fbbc14f", "comment": "Malware payload (BlackMatter)", "value": "7ec6af79dbb58df1ea790331bd7bf046", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151647, "uuid": "52b63c06-d801-4678-9c62-002fa47bc9f1", "comment": "Malware payload (BlackMatter)", "value": "68863b0942c76880c9e9abb4c93ea235501974af3d04fa82228068878d0f4bae", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151647, "uuid": "ce0bafeb-157e-41dd-a654-01d754ff3364", "comment": "Malware payload (BlackMatter)", "value": "92a1f4596f77c7a7ba83c743182bd6ea6f6b7a02", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151647, "uuid": "24a3a467-edee-4fef-9747-1e8157902142", "comment": "Malware payload (BlackMatter)", "value": "46996a6a9aebb177badaf63ba630b5cfecefb030b72a403bd890f2f1f644e15583e47ec9e41564bb59e0058bcf196d27", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151647, "uuid": "243265a3-6bdd-4cb2-adc8-393914b9da40", "value": "T188E36D21F213D0B3C83718F13736B571B39E8D2C29A96847EAE80F597CA58232F45997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151647, "uuid": "60bad3db-a797-42c9-b7c7-cef1e65c9ceb", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151647, "uuid": "ca2f2d12-02ed-43f4-ab15-c6a1c4a1b9fc", "value": "3072:v6glyuxE4GsUPnliByocWepzOinDDkqKKJWo3NS3:v6gDBGpvEByocWeZDwqHwo3NS3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769151647, "uuid": "12f9dce7-8103-4cf8-8e85-3f362b689a87", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769151647, "uuid": "9bbafca3-e142-433d-8110-5e4766a7a1b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151647, "uuid": "3c49e84a-3949-4527-810c-2c22e2b8580b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a9f55a6-f853-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769169814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769169814, "uuid": "760c3358-8218-4119-aea0-e3e8ce35894b", "comment": "Malware payload (Mirai)", "value": "07310913f35875bee55c0836f5950771", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769169814, "uuid": "d8cd461c-b400-4ada-b016-4feb218ffddd", "comment": "Malware payload (Mirai)", "value": "694229b803f6921d4a9f7cb2ed221a0e2a72d277aaa2f6712297fb828ed1ce7f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769169814, "uuid": "1e442e25-98f7-444c-9b19-2464c912ce5f", "comment": "Malware payload (Mirai)", "value": "3ef9f408245610a05d544b5b122626ba84e9495d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769169814, "uuid": "1ad04716-6d3e-41fa-bb6c-354d075d9fba", "comment": "Malware payload (Mirai)", "value": "424b7c62be2bcd9a79f6994abd52b5f8405d276914a96230da566cafcd1698319799c15f45993bd53d88d72c879ef5a9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769169814, "uuid": "907c8050-efe3-4eb4-b665-11f58471b414", "value": "T111931AD6BCC1C612C6E0A1B2FB0E51CE375643B8E3E6B107DD19AB29674B8670E37251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769169814, "uuid": "f32e1ae3-3783-4ade-a830-466a9d066d14", "value": "1536:un3u9mUgl5bjSSjY5U4xIVWpKwxTQInJAq1LJL2kvM5b:u3ugL7vj+mVsxTD6q1YCM5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769169814, "uuid": "1a9d01d8-2192-44d9-87d9-98d2cdc632c8", "value": 92884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769169814, "uuid": "fde268d9-1446-4d8d-ba19-a6da4dce6637", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769169814, "uuid": "3d2e7fb9-6af5-4f50-bb30-4646586a6d1a", "value": "nklarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e6d9f44-f897-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769198811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769198811, "uuid": "8db772fb-504f-4348-aa29-a2bf35249d1c", "comment": "Malware payload (Mirai)", "value": "44394331ed7d011748136d56664dcd4f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769198811, "uuid": "b9de8324-21df-4209-833a-a3492f43c6ed", "comment": "Malware payload (Mirai)", "value": "6a75aacd3c8ec8e43e9347c9f9ec84474d61bac3168799b1174f1ebfc85480d9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769198811, "uuid": "40208eba-4b39-44fa-b802-701865476bf2", "comment": "Malware payload (Mirai)", "value": "06d6b13b24c59cc374910ce83234685a6ec0b554", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769198811, "uuid": "ece599d9-db03-4e06-893e-531f2f4cb344", "comment": "Malware payload (Mirai)", "value": "0292b0fba1cdcd053e979f9c0cf673d73e8437452f710cf293fc40c27f0e624317aff7fd9f857191f1a10952cbd55556", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769198811, "uuid": "a7f2823c-3224-4a61-b408-d368ace2d94f", "value": "T12A246C03FA82C1F2E19302B25097C75A5734C931531AC907FB959E79BC766098A6B3BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769198811, "uuid": "59e22334-c09e-4841-83ba-4b64a3dd5c1a", "value": "3072:/zlxskCflyieK502478Svp+GK8NAYMOWcuUMXhRPa8nDKtjUjUiTwrU4hiY/jlp+:blxskCflyiTz4oN7pcCdwjUMrcULSdj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769198811, "uuid": "68969d82-1f99-41fa-b7d6-f1b6bf0626a5", "value": 214448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769198811, "uuid": "f06f71fb-c61b-4b83-8fc3-8381b5dbe38c", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769198811, "uuid": "05cf6de1-8f08-4684-9091-d38f9b42b6ca", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc965fc0-f8a3-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769204311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769204311, "uuid": "015a0f74-4b71-4733-ad15-cb444a71422b", "comment": "Malware payload", "value": "f676cd9c8f4349537f021cfc743f7e04", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769204311, "uuid": "560bc2a6-bfcc-41cf-b78a-dff3c807e594", "comment": "Malware payload", "value": "6ac4976183815e4244c2a22625d7322f922786fe8b6fb427d986f72a8ebab260", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769204311, "uuid": "c110f58c-a9c7-495f-bb4a-02d9b67ec4de", "comment": "Malware payload", "value": "6ac6ffbe8b11dab61fcb1749eb684b8f4ea2cfaa", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769204311, "uuid": "62cf1165-6dfe-4e19-ad0a-2cddd053a48d", "comment": "Malware payload", "value": "56e87436d7cc1294dcbde9ef378ad7dc858b0da048e225160c24fd3382277163ed0f20cad12edf45eee8f1e7d264d732", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769204311, "uuid": "73136864-9c50-4efa-872d-91da0c23f250", "value": "T14C55F09397842986CCD118782D2B9F304B60D8CEEA16CA57AF26E67CCFD7382DD1944C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769204311, "uuid": "81954a97-7075-4e2a-89d8-64211697996c", "value": "24576:srkbWRJF0NUd0UzNoFptiuYuGqboqtE9XKOLZh5X+jEJ0EOgiv2JtJi9q/:srkyF0NlUzNkBl5bHiP0E3Ni9A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769204311, "uuid": "b6964052-f053-4160-8e7f-c88f26a970d6", "value": 1289950, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769204311, "uuid": "401e584e-5d40-4e8b-99aa-15b8b1f96c83", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769204311, "uuid": "57ab2fa9-b5a4-4788-bf9e-7ae977e13351", "value": "Elusive.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "214e6ae6-f876-11f0-a129-42010a9c0007", "comment": "Malware payload (Tsunami)", "timestamp": 1769184669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769184669, "uuid": "b4ad2cb3-2b38-4fe7-80a5-e4f0b3a642ce", "comment": "Malware payload (Tsunami)", "value": "c1e4857fee9b303f4b80d9b13456ab91", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769184669, "uuid": "b540b2d3-7a50-41f9-95e1-f9179409648d", "comment": "Malware payload (Tsunami)", "value": "6b6338e455c34640ca9eda99c81bbb7246c9736869312da32571365b00e8c2f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769184669, "uuid": "4b93f74e-ee7a-460c-a32f-a0bf51d4b5e3", "comment": "Malware payload (Tsunami)", "value": "871ab4ecfd3155e947debd28c9c9ceaf3c7dcc3f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769184669, "uuid": "66c36ee0-bcf2-47eb-a098-0fb57bd80305", "comment": "Malware payload (Tsunami)", "value": "5e85784caf0272e6a02db8848e035679217e4c61fc8d41e44a7d60afe32b4346ceb575338e3fbb6b7146300be1a8941d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769184669, "uuid": "cad72844-6638-490a-b236-b6c49593a22a", "value": "T1F6A34B13E653C2BFC4E3A6F62BDBC5219923F4391B36620933DCBDB56B15AD85E18201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769184669, "uuid": "ee15a009-d61a-48ca-a25e-e4546464d78a", "value": "3072:GZcEp7Im3o4QRUUje4jHwwvy9bdp/pnkodyk3GmX0VA:uQRrjkwvOR/kodyk3GmX0VA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769184669, "uuid": "2c20659c-39c3-4aa6-b97f-467ba0dd2b49", "value": 101621, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769184669, "uuid": "87f66588-aa8b-4356-bb63-9f8cc515adf9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769184669, "uuid": "d645659f-3d07-4d47-86ea-a0173ce7d6b7", "value": "bash", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "309286df-f829-11f0-a129-42010a9c0007", "comment": "Malware payload (BlackMatter)", "timestamp": 1769151624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151624, "uuid": "d0c59793-53a6-4f32-a3a8-65543f5a1de2", "comment": "Malware payload (BlackMatter)", "value": "9622acf77029bd62e2797edde7df1e11", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151624, "uuid": "9bdc2dd9-4a65-4f4d-8bb6-c76ce9014ee8", "comment": "Malware payload (BlackMatter)", "value": "6c0127433f689c0861355352460f7dc6b6ae3d86aa7db0747e60b3b9a18c4a87", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151624, "uuid": "f1a87f40-953f-4484-a489-6057e54d2a7a", "comment": "Malware payload (BlackMatter)", "value": "62746d493496516bae6dc6348a59a50178225a99", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151624, "uuid": "e7f4b174-841e-4b39-9e99-7f8ed3350e82", "comment": "Malware payload (BlackMatter)", "value": "716ddbb16bb09ea5eb76fe5f818774265488721e6800ce74c571c82b6fe2236ee036f2f29e9cffbac63424e3f74aea43", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151624, "uuid": "583c6637-9065-432e-9656-caad4cf9a76f", "value": "T1CEE36C21F252D0B3C83718F13736B572F39E8E2C19A56857EAD80F59BCA48132F45A97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151624, "uuid": "9a902609-00a6-4027-8c85-651fa6d7969f", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151624, "uuid": "94519cd8-317f-463b-8e4d-01615782e02b", "value": "3072:V6glyuxE4GsUPnliByocWepcY8Ty5w+joZeYlK:V6gDBGpvEByocWeKYt5Cs6K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769151624, "uuid": "44560b9a-2518-4ff4-bb83-61c17382653f", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769151624, "uuid": "f4c967db-c755-4ccd-823d-bcda8e28c16e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151624, "uuid": "8e184746-ffdd-41c4-8df8-d9f2c2f1a3ed", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d797415-f85f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769174999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769174999, "uuid": "909384ed-37be-40c8-bee9-3e42dcb71256", "comment": "Malware payload (Mirai)", "value": "2c46aac89a8d673dad88814712a136dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769174999, "uuid": "058f2c90-9a8c-4695-98ab-7559b2569b33", "comment": "Malware payload (Mirai)", "value": "6c9f0edb01cedf48b8af39755a9868692dcb695173c29f5ff5fa7099f9611d35", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769174999, "uuid": "2312f461-e7da-49f0-96a8-19d58f386858", "comment": "Malware payload (Mirai)", "value": "d7d1847bb6cb4c90cf7acc1d04307d2a25f2136e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769174999, "uuid": "66f726ab-6fde-4ec8-a516-598186f87b69", "comment": "Malware payload (Mirai)", "value": "824ebba441aed51568d4abc6307ccf33e72ecf0630b2ba8033485e12d9d3379314f26f19bd0bb40717424050b90ed830", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769174999, "uuid": "e2dd4cca-e180-465d-9453-003340d0f6ac", "value": "T18A934913EE264F5AD44621F461F68E340B23FC2A8D671DF6A429EEE99143DCCB6053B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769174999, "uuid": "c41402a6-a9c5-4118-b92e-9dab3ebefffc", "value": "1536:DAJjxtnpXdwx1qDyPBOfKr7HLiB23jC6DusQaE+E:D2jxbdwx1pOCrqB23j5h+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769174999, "uuid": "16f53b31-e266-4faa-aa61-594511c5bb7d", "value": 89260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769174999, "uuid": "9ea3fa31-71b5-4627-aa22-e17b7d6d0033", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769174999, "uuid": "8c7a4195-6f75-4508-8522-c62e5133d59f", "value": "titanjr.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63106da7-f860-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769175331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175331, "uuid": "d27fdf3b-769a-47e7-9901-54386b7e107a", "comment": "Malware payload (Mirai)", "value": "4c55a4c6edbf9941efb9d4d84c699d83", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175331, "uuid": "6dd7a062-5b91-4f19-b86d-663b649394c1", "comment": "Malware payload (Mirai)", "value": "6d37e0d8b0d0af50e8dbf5798beb3d2caf6cd03c489580bb8d3745802c3dc751", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175331, "uuid": "8c7d8ee1-2b8e-488c-bae6-b43a1fb0d51c", "comment": "Malware payload (Mirai)", "value": "d22d66e902f60120933fa29abc43160a3646e679", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175331, "uuid": "43cae0b7-5a2d-4ab6-b98e-e0c8b96e5db4", "comment": "Malware payload (Mirai)", "value": "63ea269d2eb605bf6f6e9dba8df28733d25ee29184e740baf034e119173aa0a91286fd2b27370961da7e4f11110793a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769175331, "uuid": "07ffe13f-72d4-46ba-bff2-44cb2df707f7", "value": "T10AB3A55BAE529F7CF32C82354FB38B36A659239133A0C185E66CDD405E6028E587FB94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769175331, "uuid": "51ff748e-a5ae-47cd-95de-df90765f6c32", "value": "1536:/wUicN6ujrbTRbTP7TgctW+UC1PawSgUS0EIe5nLJ9qa5b0VJ:/wi6e7tWZC1PawsS0EIkXqa5AP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769175331, "uuid": "99b7525f-68a8-4781-9b56-47bdea5f254d", "value": 109236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769175331, "uuid": "f8ce7e87-48d3-43ce-bfd8-a6962a1825d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769175331, "uuid": "12f9eec9-0135-4151-ac67-583ec2a23c9e", "value": "nklmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b34f31c6-f7ff-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769133804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769133804, "uuid": "3fda3ecc-8bb0-4f6d-be45-29bfddc14dd5", "comment": "Malware payload (Mirai)", "value": "efbd83e75b53dfa24fbf0700dbe9ad4e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769133804, "uuid": "ebc78492-9ef7-4eaa-9135-816fb1301579", "comment": "Malware payload (Mirai)", "value": "6d4331007553a1ecf7b544702a411af38355ee36d119f5715d799d4eb9e19d01", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769133804, "uuid": "4f71a406-8a48-4c0b-acc2-bdf114079a3b", "comment": "Malware payload (Mirai)", "value": "15c0fb97ad208d862b4f96aa870886394c0accfa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769133804, "uuid": "ba64c041-c00a-4307-bc73-1483473cafd8", "comment": "Malware payload (Mirai)", "value": "9d4792f192f64673256c9477b4998e9d772bbdc5a0fcb4d6104d8adcfa008467e9832bcccee23fae29da8538fa528a19", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769133804, "uuid": "11d49bd3-205e-4416-b11c-9a8672be7b73", "value": "T1A093B54E7E218F7DF76D873547B78E21979823D627D0C245E15CEA101E6038EA81FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769133804, "uuid": "2092f30d-98f9-4b52-8b37-7425d8c2b798", "value": "1536:7KKapgvxRtfmXw037Kh9+Iz3H7xlK82h+LdOsDgzpoqoBxWO/oZqOy:7KKa6ZRBmrK/3zXdf2h+LdhgzhoCOSxy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769133804, "uuid": "0a316bd7-a215-4cc3-bb36-7c8dd9da17dc", "value": 92672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769133804, "uuid": "1de1e13d-b091-40b2-a89d-4ad68958a697", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769133804, "uuid": "85ee7a6c-0e97-4b6a-969e-252e2fbfd4c4", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "752f220d-f85b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769173214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769173214, "uuid": "b785c243-52f3-4838-be43-509ccee43ef6", "comment": "Malware payload", "value": "de408156a27b153049a84364a8145b2d", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769173214, "uuid": "705ac73b-90e7-4bb3-8ba2-534b9539e15f", "comment": "Malware payload", "value": "6d81d794a39a46b39a78e4dadb936fe39295c2d1cc8108b644c235ed68e48926", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769173214, "uuid": "711eea9a-dc00-4ece-a8a7-7e205d165589", "comment": "Malware payload", "value": "ee4418b060484685a4bda75d1060eca72be27f22", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769173214, "uuid": "f0a2dafc-389a-45f1-ac80-797d67341971", "comment": "Malware payload", "value": "a235f092decb593c1895deb65d51d414c942c547f5e98e68e1e94576b2cc6b0feb2288cca2b9c586ca7b447bc09b0c86", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769173214, "uuid": "6f8db9bd-ceaf-44b7-9b36-0a03c2488b6d", "value": "T1FB626B606DE650DC32732F8167DCB9FB09EAE5F4682DB2B0325292444770AD5DC62F3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769173214, "uuid": "b0e73266-00bf-486f-b86a-b9e233089899", "value": "384:fPcLQobcdCy+chcBB8McifseNkDesOrmsHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHL:fPcLQobcdCy+chcBB8McifseNkDesOlL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769173214, "uuid": "57f2eb40-808e-49ac-9567-f927e499dc56", "value": 15442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769173214, "uuid": "99a59458-6760-4f75-910f-dac1ede6a145", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769173214, "uuid": "556e239f-7b16-420a-87df-751c91bacf02", "value": "payload_1.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4d765b8-f829-11f0-a129-42010a9c0007", "comment": "Malware payload (BlackMatter)", "timestamp": 1769151845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151845, "uuid": "920655f8-78d1-47f2-8254-6da1e8cd5099", "comment": "Malware payload (BlackMatter)", "value": "b08e0a38c3327816a1e605e4473c8ad8", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151845, "uuid": "935d6084-0b99-4de0-9f49-e469a6513ec9", "comment": "Malware payload (BlackMatter)", "value": "6d9f17932c1736527b80db9f3bb6ccc693ef22695a349fbc1d96e845ae5930c6", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151845, "uuid": "b34b0143-4567-4b66-a319-9a94ad5b9a2c", "comment": "Malware payload (BlackMatter)", "value": "a8b9f2fa6f82b236b8f4724e092f0136d206b512", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151845, "uuid": "6785f1e1-e100-4cd1-a8e9-6d663449eb26", "comment": "Malware payload (BlackMatter)", "value": "ec1a5931170444d282b97394f46e5b3b66434f052920225a2676206b57222b3ae05283f655efb5db4d63bbd095e9defc", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151845, "uuid": "ba2a6128-7b36-4a17-9851-27b3b1626279", "value": "T148E36D21F122D0B3C87718F53B36B5B2F39E4D2C19A96447DAD80F59BCA58232F44A97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151845, "uuid": "27bc8310-2a60-4f0b-9ade-fc29b7ac1ffb", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151845, "uuid": "d24ffeba-9632-43aa-bd46-4cb2fb80efd4", "value": "3072:66glyuxE4GsUPnliByocWepNuIdx+GXmDXqDAo:66gDBGpvEByocWebuEzmDX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769151845, "uuid": "08d82115-17d3-41cd-95e5-8bb6532995b1", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769151845, "uuid": "7d54560a-d735-47d7-9ff4-60830adb525e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151845, "uuid": "8e950e91-4fc8-4555-98e5-21ee48500c09", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00bec62e-f897-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769198788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769198788, "uuid": "b26f94a3-0430-4c78-a6cf-a430205a1775", "comment": "Malware payload (Mirai)", "value": "9da22840270a2356982501c37b1c5aa5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769198788, "uuid": "4e0cf1bf-d114-46a9-99f0-07e4cb30272b", "comment": "Malware payload (Mirai)", "value": "6e5318a39ab4a950c0b2876d204f889ad1f01bf7acd33a9385b58b7b7dd96626", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769198788, "uuid": "05228915-c935-4a03-b3db-528d9905283b", "comment": "Malware payload (Mirai)", "value": "075f85afbe4c7ea57ea5e963d80d23bee0ed3bca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769198788, "uuid": "17b718c9-8988-4a45-83c6-255ac75dc37f", "comment": "Malware payload (Mirai)", "value": "ec05be5069dc99f9943d0849a1ffa252010c0811655fde507e2b76aa36537660efc16ca806e456bb88ae91d76862199d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769198788, "uuid": "80b557f3-39ec-46aa-98ac-580250188528", "value": "T1769302479C8A8F70CF8B277C33957758ACD85A1B901930794BA5DE6FE7A3041A53C826", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769198788, "uuid": "7d1a71ef-a682-42d3-bd03-82c62d148e69", "value": "1536:IwjuSHSI8PNIrCLz1MK3iOSCIb3MniNJp1pBCt/+NSaSCSB1+dk63JhTRSZSp:I+uCSXNhLz1M2iOlIb3BpBCoSaLS7vK1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769198788, "uuid": "f4138f84-3691-4bee-b69d-c4dd7161881b", "value": 92748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769198788, "uuid": "806c32eb-a2b2-44fd-9786-28928ff69753", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769198788, "uuid": "010274a3-5e4e-4490-8c5d-e906f6e12899", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52547fb3-f829-11f0-a129-42010a9c0007", "comment": "Malware payload (BlackMatter)", "timestamp": 1769151680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151680, "uuid": "a1188b2f-bb46-43fa-b7f8-f2024413f85d", "comment": "Malware payload (BlackMatter)", "value": "70bb84b0ff878ca095fd03774ed3fc6c", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151680, "uuid": "80aaa5ad-1a3d-433d-91b3-5bdeb9e53a45", "comment": "Malware payload (BlackMatter)", "value": "6e549de24c05fcf0c5c66111e9ab8686bb9ec02677fcdc219d994cd6857f5891", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151680, "uuid": "f748d1a5-c2e8-46b5-b631-7003966f8db8", "comment": "Malware payload (BlackMatter)", "value": "cec2973aa9afe807ec49d6fd3879c87c2b884cb6", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151680, "uuid": "753f9f2b-94b1-4407-aa2a-487ca208453d", "comment": "Malware payload (BlackMatter)", "value": "9fff3acdae55715e1befd09789c3bbf8ed623fe622e6bc0558c6028295ba725641aa4e9c4ed5fb6eba3b2b3c0afcfb2a", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151680, "uuid": "bdd957ec-c894-4ebb-959b-a298c3419030", "value": "T1B6E37E21F212D0B3C87718F13736B1B1F39E8E6C29956857EAD80F99BC648232F45997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151680, "uuid": "05a71c5b-76ec-48e7-b1f2-858f89e9c7b1", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151680, "uuid": "0a57eb08-68f5-4dcb-84ce-32222d14acca", "value": "3072:W6glyuxE4GsUPnliByocWepDK5kpg3gzL8Pj:W6gDBGpvEByocWelK5P3IYPj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769151680, "uuid": "0676a039-526e-416a-a059-a72677d203b5", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769151680, "uuid": "fc966139-d72f-4031-9fb8-7ba6a91c47d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151680, "uuid": "375620df-30b9-4f4d-b20f-e6600fa1ef70", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26934926-f867-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769178236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769178236, "uuid": "0f7306c5-bbb5-4058-be10-f60e2a5e9f8e", "comment": "Malware payload (Mirai)", "value": "a4359d7b9c4658a8538203987047eeb8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769178236, "uuid": "1f16d8f3-45aa-4a74-a790-9fbb5dbb05a4", "comment": "Malware payload (Mirai)", "value": "6e65db2c29617e5a3285dfffcc098c1129c19d009ca8f7a9407568ee35dd9327", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769178236, "uuid": "8f37dbd8-02ec-4a3e-850f-167f35867ff6", "comment": "Malware payload (Mirai)", "value": "f4a1835d1a059d955daad57ca1b1e53b3d940286", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769178236, "uuid": "de17c74b-9202-49e5-8ff1-26f53ce2cb00", "comment": "Malware payload (Mirai)", "value": "504979d427144c0d0474b6435016990bc82aef033e4697ae2b9d2f202083945d66ecc745d2b805d8e0ce7e27def03412", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769178236, "uuid": "ed7a2138-53f6-4740-a799-fb4c208db98c", "value": "T1CB63198ABCC5C202C5F060B2BB1F618E375643B8E3E6B157CC1DAB29675F8970A37255", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769178236, "uuid": "39bdf2b5-532d-439f-9ef7-25a1c051ee2c", "value": "1536:5yrLAjRlZ2TLwikKifel4zgY6G2qz7M5:5GLW127lid8Yr2qz7M5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769178236, "uuid": "65255b55-733a-4df1-8b07-8565df56d191", "value": 68408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769178236, "uuid": "323feeb6-42bf-4c8e-81e1-9fa2f6317c60", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769178236, "uuid": "f695f99e-920b-4804-9424-18701c69b73c", "value": "zerarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eea21d22-f800-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769134333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769134333, "uuid": "379ee353-6e1a-4e25-a356-dfc90293a8a0", "comment": "Malware payload (Mirai)", "value": "38a8581aac65ea1311f04fb3cc1dc2ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769134333, "uuid": "025d1084-44fa-4008-a4c4-1713de843c30", "comment": "Malware payload (Mirai)", "value": "6e6a2aa1f7858271d1926469a933bee846f5abf1da1661fc86d6954e885020a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769134333, "uuid": "a06fcc89-88e7-4081-bb86-7e9f4861b813", "comment": "Malware payload (Mirai)", "value": "254cb9ea7ab6e39489ba759975f41ed2aa0277f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769134333, "uuid": "c790fe64-ea76-4950-b898-e3eb7ee27913", "comment": "Malware payload (Mirai)", "value": "e4cb1d56fb333edab808d1ca6d815d4f5ff8248b66959d8d2181eb5f19a8fb34f2aa47c9dd3e7eec29dbca31a67d417d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769134333, "uuid": "c112c5a7-725b-4cd5-a104-fe9dba884945", "value": "T1B383194AFD829B15D5D922BEFE5E118A33136B6CE3EE7112DE105F2427CA51F0E7A402", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769134333, "uuid": "318a98dc-dbb2-4412-96f7-abec01d49f77", "value": "1536:l+nE/rKyGYV/9pFiX+vvpUTBPyLTVfR5SuScUNMKp78YOle3ihyaDxu:dRGlDT9y/FRIuScUNMKptTad", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769134333, "uuid": "1a6d9e0e-5135-41de-afcb-d0df294fa7ea", "value": 88420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769134333, "uuid": "64f34507-aff5-4ada-ba86-0f1d68221281", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769134333, "uuid": "4ef1c962-4028-493c-83b6-1933055702c3", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ba09d0b-f895-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769197947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769197947, "uuid": "aa632286-16d0-45a7-839c-cade112e313c", "comment": "Malware payload", "value": "3a6cca8516fbca5a2e979b8948880da4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769197947, "uuid": "872eb241-1cbf-4fc1-ade7-c7ae5e21fd45", "comment": "Malware payload", "value": "6fe80a873fe3ee85a4885cbfec0fa7aad267432bcf867fe5e842e3fc8980093b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769197947, "uuid": "2995917d-b61e-4bea-9608-74ebfab9ad54", "comment": "Malware payload", "value": "bd86885318c2ae958bc9995e8a3faee909d6b645", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769197947, "uuid": "35c66149-371a-447b-bfb6-04e0c886ab04", "comment": "Malware payload", "value": "c627b225b55d0c211881de222d15d32293e3f258a7bb5ee7c5aa2393303634171def903f0d0788d5edc8f2caa290de58", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769197947, "uuid": "2ad8079c-3730-4440-9aa3-d32eaeec3dff", "value": "T1D6418DBB54E37AA8349A69DEF263822855C0F58C5CE7578C790C6E35B345408F2257EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769197947, "uuid": "d493d13f-d7fc-4a13-b5f1-d9703e58e1d2", "value": "24:o9qMkpnIDd3Eo+h/s54NvIaNHnJl9vYp1MSQ7BVKfWayg2DND7DOcnMjStLkJi5m:o9qMyIB3ETK8VE9cBCsRHEi5m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769197947, "uuid": "d0ce2cdd-c919-422c-942d-e2d1f3079a8a", "value": 1982, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769197947, "uuid": "210d088a-369e-47be-b429-701c01354bff", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769197947, "uuid": "70011092-661d-4170-bda5-e2d07288b79a", "value": "bolts", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bba3538e-f89a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769200390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769200390, "uuid": "f9da9b09-b759-435a-a296-d7f50ff7a707", "comment": "Malware payload", "value": "a4f6c9e5e4365837977b9173f9d654e0", "object_relation": "md5", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769200390, "uuid": "9c351fc8-79c5-4c75-9325-05fd0c1026b0", "comment": "Malware payload", "value": "7154afc5565dbef677de80392a33ec4c5445ddba524f21d25133983639658888", "object_relation": "sha256", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769200390, "uuid": "3fa3a85e-c9ba-4ca6-ab9d-fee8f0bba538", "comment": "Malware payload", "value": "9da7ad04860ab030f53d04c50893061eb6c22cee", "object_relation": "sha1", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769200390, "uuid": "faec4d0a-0d41-4742-81de-d8b2f8561005", "comment": "Malware payload", "value": "209b26ed3c70483f91d04e02674f917d7f3b93643c726b6fb7d44ec15f43b96f0954b2209d0d5d0727b7f1ea89c3b0ac", "object_relation": "sha3-384", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769200390, "uuid": "843bf8b8-5001-49f6-96ee-884d9374869c", "value": "T1EB835B12F241C435F0F700BACBB94B7A9E7CAF11536490DB57D815AA9B31AC1BA31397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769200390, "uuid": "34274337-b816-4331-bc88-cb893dca198b", "value": "6a5a3919d6bebf63a6f776305bb77974", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769200390, "uuid": "73fb01c2-ffe9-40c1-a45c-d168b4781cc7", "value": "768:7LA9fYR8/KXMnNN+B341z+CcMKaHhBwE+u3kkGLEDdEnDAixFi0o3AhRKBBRHSya:7Oy8/KMN+B6zNBUu3kLTLuAhoB2ya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769200390, "uuid": "11a66962-ac2a-457b-a4b7-61692eea789d", "value": 86016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769200390, "uuid": "52db96fc-fb9c-4948-af01-28a61bbd11fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769200390, "uuid": "84131d27-5926-4dd4-b61f-1ef985f7ed84", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae3af6c3-f829-11f0-a129-42010a9c0007", "comment": "Malware payload (BlackMatter)", "timestamp": 1769151834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151834, "uuid": "6dc31093-bba1-4fbc-8956-016660c8ea06", "comment": "Malware payload (BlackMatter)", "value": "f598f1930edc142874aba68b2850a90b", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151834, "uuid": "dbe4ffcf-dbb3-498e-833c-fb1afb85016f", "comment": "Malware payload (BlackMatter)", "value": "71744a88ccca712ad9b74087ba046be05625b4ac83e1c65a1fd5259584aa109d", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151834, "uuid": "13a654bc-90f3-4570-954c-26d7221d60ba", "comment": "Malware payload (BlackMatter)", "value": "d2fcfee764740c59ba1773c81512a304b9f00068", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151834, "uuid": "7e3c4ccc-a764-462c-bbff-bdf78f3ab1ce", "comment": "Malware payload (BlackMatter)", "value": "80aceb257f604c2b7af5e8f5bf43a05b3932a57c3ece39ebbc6c4d24b41feb3e3c516d4eaa46204ac8511864ea09835a", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151834, "uuid": "311aa7bd-b3eb-411c-99ec-21068ff87fac", "value": "T189E36D21F212D0B3C87718F13736B5B2F39E4D2C29A96847EAD80F59BC658136F05A97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151834, "uuid": "80ab3e0e-feff-4e01-b382-dce8ac0b5d3d", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151834, "uuid": "e0cda218-d9aa-4e5c-b411-1c27cda20a83", "value": "3072:a6glyuxE4GsUPnliByocWepKyMDlkqk/Q:a6gDBGpvEByocWec3DFk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769151834, "uuid": "d3a7a385-7d0c-4655-8270-2ba081048174", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769151834, "uuid": "ba30add5-91cc-4c54-a56d-794922088463", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151834, "uuid": "97f7e961-f5af-4dcc-b885-fa86b88d820a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a598262-f83a-11f0-a129-42010a9c0007", "comment": "Malware payload (CastleLoader)", "timestamp": 1769158968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769158968, "uuid": "87b263b6-6a74-4d56-9c49-e647b02864b4", "comment": "Malware payload (CastleLoader)", "value": "313259926f4fa7a9a1df41f3f92c2661", "object_relation": "md5", "Tag": [ { "name": "94-159-113-32", "colour": "#84A36F", "exportable": true, "hide_tag": false }, { "name": "CastleLoader", "colour": "#3A5FB2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769158968, "uuid": "5448475c-b5d3-4787-a6f9-5ec2fbba2b70", "comment": "Malware payload (CastleLoader)", "value": "72367e9b08ef652fb83eff9fa16c980c908c9231ebf52215fdd2494a3ef7d222", "object_relation": "sha256", "Tag": [ { "name": "94-159-113-32", "colour": "#84A36F", "exportable": true, "hide_tag": false }, { "name": "CastleLoader", "colour": "#3A5FB2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769158968, "uuid": "151fc8f9-de9f-49eb-9a2e-749a2654019a", "comment": "Malware payload (CastleLoader)", "value": "06eaa8fe646012f8cb8db408014373375ac6dcac", "object_relation": "sha1", "Tag": [ { "name": "94-159-113-32", "colour": "#84A36F", "exportable": true, "hide_tag": false }, { "name": "CastleLoader", "colour": "#3A5FB2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769158968, "uuid": "5cc3b425-ee15-4e46-8648-ec65d68ba46e", "comment": "Malware payload (CastleLoader)", "value": "6153a4c219dddd33e3e41f36dee3c75a5eacddb74ed21e382a86a8edd1ab77a7112186dedcaf2de992c402a7cb929a06", "object_relation": "sha3-384", "Tag": [ { "name": "94-159-113-32", "colour": "#84A36F", "exportable": true, "hide_tag": false }, { "name": "CastleLoader", "colour": "#3A5FB2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769158968, "uuid": "a0569103-6b10-4230-ac21-19fdaf5116ce", "value": "T1AA247B11BD41C567D4E24AB22529A6724738BD344B241ECBA3C87FBA6E344E2473DE1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769158968, "uuid": "cbdf4827-824d-4ae4-b6d8-9dde2af755d2", "value": "bdf7575fcc0b17ceb288719b350b3b25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769158968, "uuid": "a22b0d39-489a-4059-9ec4-801c32fc86c7", "value": "3072:Y4dl+ijTacAP2umHpcwdYiAbm5U53uQtmfLruVU13hpaZbDwXrTMuXpyU1USEYg:td2cAPhBwd6q5Cq3uK1Rpa4w4g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769158968, "uuid": "eca1b25d-40ac-4117-a0dc-77ee08c8d97c", "value": 227840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769158968, "uuid": "56e75597-6214-40f8-8b1b-446d919d7d85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769158968, "uuid": "24b5fbdf-06bb-47bd-828f-1541ac6b072d", "value": "72367e9b08ef652fb83eff9fa16c980c908c9231ebf52215fdd2494a3ef7d222", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9959e05-f876-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769185032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769185032, "uuid": "5753962c-9172-4b98-b6c3-9c5db5d70061", "comment": "Malware payload (Mirai)", "value": "f514cf69b66dae6acb34a55ab35e386f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769185032, "uuid": "46fda1b5-1930-4a8c-b173-b4db4b1e3d53", "comment": "Malware payload (Mirai)", "value": "74d57c2812f54b076fa92735b289ecbf924ccb8719b0594cb7ee6c4674e48d48", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769185032, "uuid": "f166ad11-9004-46c1-a749-14f9176f708a", "comment": "Malware payload (Mirai)", "value": "7673a32217b7155373b7f753edd86112b3cdcd1b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769185032, "uuid": "af308c55-5b70-420d-819b-fb8196c30853", "comment": "Malware payload (Mirai)", "value": "291fa6bf2a3a0e83b029922253d87e5e352e9099fe9965b30536f2f6e6970aa8fdc5286ec02dbb3caa47f987e83d42a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769185032, "uuid": "fbdb54aa-56a6-4986-a933-eb7d7bbc4701", "value": "T1EE057C07F2F3B5FDC053C130879BCAA2A936F46551226E7B6184CB303E96E641B1EB65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769185032, "uuid": "bf8b1423-0513-4cc5-9357-d21cf9d73db9", "value": "12288:4yKmwg4kKiXYglzz5YRHr8rkk9KlUA5WyEl9G2516+g75sG5Ct:4y/p4kKAYU5Qr8r190UVa+c5sG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769185032, "uuid": "a01f8219-2f5e-44f3-ab0b-e3d066c4b515", "value": 866816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769185032, "uuid": "087a5259-69b9-431d-9b87-3f4f985bd350", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769185032, "uuid": "12a0671e-ab45-474a-a85c-b54dabfbb3d9", "value": "ovh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59bf850a-f87b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769186911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769186911, "uuid": "c21dba16-0860-44b3-93a3-4cb24e287095", "comment": "Malware payload", "value": "104f20366b8050b32a36197c34269e9b", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769186911, "uuid": "5a68d2e6-5f9f-4e9e-8358-c87cdfc4c9a7", "comment": "Malware payload", "value": "74e803de430d8aab3789c918f8b61f89d719bf96afa35e71005047e4d2998c86", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769186911, "uuid": "266d9927-ce8d-47c5-9c07-b9208f1b570b", "comment": "Malware payload", "value": "09b00909f3124e592dae52bf3fae224f5ed23dd3", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769186911, "uuid": "a8f24fac-c0be-4b3b-ab6e-82c8c1caf40f", "comment": "Malware payload", "value": "02e24077d51634f175d65ec862a0794e954d6e2d265514db2a082f1d93f962893fd8a705f5f76c36fde4584f3a72d968", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769186911, "uuid": "8bcc1150-e505-4d01-ba03-6eb74bb20064", "value": "T100B5230A91C908A3FBF46B3041E7D333533536C61B91DAEF52E85D17B016AC27962BDA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769186911, "uuid": "1350342e-5228-4b2b-90bc-6550ff45dddb", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769186911, "uuid": "9f45829a-bbf6-4dae-ad35-d2c12cdfd421", "value": "49152:q5i1NxetzOssksxsDRf6FbosVCYSw6Bcbo7nnlJgM7:qoS7dDRf6y92b2nlJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769186911, "uuid": "463b65cb-d68d-46da-b155-9ac8e5fc3a10", "value": 2357248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769186911, "uuid": "73d4d50f-6507-48b0-a6f4-590a49029944", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769186911, "uuid": "66133565-72d5-4178-a76c-539539bed000", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e08f3883-f8aa-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769207324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769207324, "uuid": "44337d83-b634-4adb-a80e-63771eeae29f", "comment": "Malware payload", "value": "d52d18a29767665ca23b646fb3125c3d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769207324, "uuid": "4d111f85-f50f-4a4b-a109-18d6fc6699a1", "comment": "Malware payload", "value": "76112c7d033b136c5c62f53d9a91158fafe9e12a869f4eb2860a366a0ffc1163", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769207324, "uuid": "5c6a4057-0a08-42b6-82c2-de0850774df8", "comment": "Malware payload", "value": "d3037cd8a8e24b09e73c7cb5a74f9b81e9c2ae78", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769207324, "uuid": "cf5bfd84-b714-4162-9df2-014c586244c0", "comment": "Malware payload", "value": "79aabcf85de742b968c76a0ddac70d44b906d863a068b4363df08d46f5fcd860131feecb4affc12ecc74ded3259dd18a", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769207324, "uuid": "286363db-1493-4339-b85a-1f9a521a3e20", "value": "T1A6767C53EC9585A9C0EDE230C9B29252BA71BC485B3127D76B50F7382F73BD4AA79340", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769207324, "uuid": "78ee004b-ac4a-4a6a-817b-195ddd4b4bc0", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769207324, "uuid": "2b8b7ac7-22cf-4262-9cac-815de0428e6b", "value": "98304:nKj04Ie1fbCoZlE1BsCtWiikWMuaEHd/gL2C97/:nS0ZqfbCoc18ieMufKd97", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769207324, "uuid": "5f053768-61b2-4bc7-a955-1bcf45381449", "value": 7410176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769207324, "uuid": "ae7dd5fc-d57e-43e4-a776-be0a4c12a4be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769207324, "uuid": "b37984a0-17a1-4323-a6ab-9841b49c2569", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52b05198-f821-11f0-a129-42010a9c0007", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1769148245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769148245, "uuid": "fb6bb196-93b7-490c-a853-bf98898b6db0", "comment": "Malware payload (ArkeiStealer)", "value": "7acdb5704013eff10cdd3db1fa41169a", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769148245, "uuid": "3356729f-b1c2-4232-8d2f-f8c856f0576b", "comment": "Malware payload (ArkeiStealer)", "value": "763f815d2fca9acd9266fa0129954a6d219baaf34e447f333d880f5a51521a67", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769148245, "uuid": "81a27c08-c214-4903-99ee-b6192c513b43", "comment": "Malware payload (ArkeiStealer)", "value": "8b07d3faccd16cb801d04f2fcd210f306d7feb5b", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769148245, "uuid": "4c0ea9a3-0473-4657-83fa-661646f94cc0", "comment": "Malware payload (ArkeiStealer)", "value": "c1f27c4c7c634cb871697bf251235b25892abdab74b7102a0c5ebac17ce3d4bde48384b1006068ada2f585bccc6edfa2", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769148245, "uuid": "7c31b4e1-0340-4124-8ada-ce34fe689c6e", "value": "T1D6F5330F602A54ECFD0B8FFEA96913BB9A93F5271214EC7D46E0CE62DE20D51821E05D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769148245, "uuid": "9afc3c2a-1b8b-4088-8be6-f307a1eb6553", "value": "c25f27d433e84e004eba6eba6c3cb034", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769148245, "uuid": "bce1d469-f3a6-4061-8515-b4812b9ff049", "value": "98304:Wf8OlyewWDAnUoAV96OCxyrcqlCY4MjKjQ6EU:48OgjWkBAVkOChYlI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769148245, "uuid": "412ec858-7245-486c-ad07-c3977857715a", "value": 3374080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769148245, "uuid": "97e1e16d-a07c-4470-b9b0-ba6fd997e7b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769148245, "uuid": "d32153fa-76cc-4934-9357-5f0c8484d8f8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49546091-f829-11f0-a129-42010a9c0007", "comment": "Malware payload (BlackMatter)", "timestamp": 1769151665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151665, "uuid": "2f50d8fd-eff2-4e93-9bd2-c8c38deb46f6", "comment": "Malware payload (BlackMatter)", "value": "32b9b42d4e20eb3551663159a926b5cc", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151665, "uuid": "373730ab-cec5-42fd-8c4c-4a1f7c1e0a4f", "comment": "Malware payload (BlackMatter)", "value": "7744909ba1357e348376c7dcd1bc097d63d6d018e6da04287ebb763f073d60f1", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151665, "uuid": "a1238e2b-df4d-445a-a1ca-666e532b2098", "comment": "Malware payload (BlackMatter)", "value": "0d0dcf9a517465e16ef7a15078c85ee0478cc399", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151665, "uuid": "b1575aa1-2f0a-4af2-8a79-aa7a92035684", "comment": "Malware payload (BlackMatter)", "value": "ceb343d6de12b662687e5ee56000cc65f3e7aa200e28f4eb83c1535d5c3b7bf831607fa93fcc6780efe8ea2362b01a70", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151665, "uuid": "3e7ccc20-49be-4aa3-b92a-b98e0f0833e7", "value": "T1C9E36D21F212D073C87718F12736B572F3DE8E6C25A56907EAD80F99BCA48232F45997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151665, "uuid": "7ff89eb6-dc0d-4a94-aea1-ceaaa668f493", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151665, "uuid": "268dd442-4d11-4630-9600-7e9fe955df08", "value": "3072:tR6glyuxE4GsUPnliByocWepwYPCAW1sxvRYUi:tR6gDBGpvEByocWeXPv1Fe9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769151665, "uuid": "9bb233e3-ab77-410c-a246-7b55b757a9bf", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769151665, "uuid": "87f59b28-3cf5-4e3e-83d0-0d3ad4f3079c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151665, "uuid": "664bcbfb-5246-444f-ba62-9d9930bea4e6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d57277bb-f865-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769177670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769177670, "uuid": "3b115011-b706-42dc-a935-00a364150e9c", "comment": "Malware payload (Mirai)", "value": "5d1a1ccf5373a652e821491c750dd510", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769177670, "uuid": "486150af-e03d-433e-b756-5e96de8f9c62", "comment": "Malware payload (Mirai)", "value": "77f90ed6bb0bbc678d01a5140bb4444880425d7667cbdfc6061b1b064dc7ed24", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769177670, "uuid": "79e100a5-4747-406e-8c14-5b27dbcfa490", "comment": "Malware payload (Mirai)", "value": "10dffa465d36f3f6f17792825b75acf4bf582443", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769177670, "uuid": "a0846ccb-3f3f-4f88-bddf-22958b8b4fbb", "comment": "Malware payload (Mirai)", "value": "7c75a144fe4803486f660f12613f2469cb0b9539eb2032d4bc233e50f97d39e1a70139e3735b0868e36c89f7689bae6a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769177670, "uuid": "ca7c7fc6-3ae6-4744-a7d4-fd1a7ea99f37", "value": "T19963F996B991DB11C6D162BAFE0E518D7307077CE2EF73129E246B246B8B46B0F3B405", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769177670, "uuid": "2a7a87c0-7eba-4bc5-bf90-699c1f002899", "value": "1536:z9n2nAUXZ4cwZq+5sBJj34AE7ABZXmd4xUObfMmiXLwK7HWQx7wsYY/bVJ:QAUXZ4cZ+5c4AE7ABZXmdpLwK7HWQx0y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769177670, "uuid": "414b8599-68df-4c56-af83-dda06bf93233", "value": 66764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769177670, "uuid": "9d08b3dd-1ae6-4360-a27b-abc671e9dc73", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769177670, "uuid": "03fe1f95-9a57-4d8b-8a39-c89dba78b59e", "value": "nabarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddb5dd43-f870-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769182408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769182408, "uuid": "6e4ffefa-bce3-4abf-9f2a-cf695170ff19", "comment": "Malware payload", "value": "8743e28d8210950f62f8fad53499aea4", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769182408, "uuid": "aa8f5c5c-da3e-43b5-8980-247180e56757", "comment": "Malware payload", "value": "7855280db4c2edfad06f808e673176270efecf7436d2d081db9af2a6ff8c8af1", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769182408, "uuid": "5cf904fd-ea14-4d36-91f3-b0cd632839bb", "comment": "Malware payload", "value": "6fa86528ac0b97d2ec894284a21a1204f17a6e66", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769182408, "uuid": "d2735757-52c1-41be-89d0-d09fb3b05db4", "comment": "Malware payload", "value": "d7c5277116edff4abd118b7560ebf3aa20556efa2d42849e059a3f9f2ee590613ec763ea883286053812c62cd128c84a", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769182408, "uuid": "4de8428f-3a6b-44f8-ab7f-817a7841a7be", "value": "T1B714F0851A6A887AC7DF7034A10A3D07468D9512126DE9C1FDDEBFCB2B219F4B8793D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769182408, "uuid": "ae5946d9-53fa-4923-8882-f36a057e7492", "value": "6144:K7jDt8zHbVMqMuipCIu0rp1EpjEpHECsSk1woonu:q8zHbVMa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769182408, "uuid": "72258ea6-48d6-4ec7-9c03-d8185f7f803b", "value": 207590, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769182408, "uuid": "9b8e3fb9-aa74-4a74-9111-1b711e6f133d", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769182408, "uuid": "7c258e8e-1d16-41fa-a912-bb885d090ab9", "value": "Backup_Alpha_v1.6.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75b51760-f862-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769176221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176221, "uuid": "4d7376b4-0b67-4c8a-8ece-6d8c7cfe0268", "comment": "Malware payload (Mirai)", "value": "5d9a1b6c2de47f0fc22a88efe992e5f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176221, "uuid": "731017e3-913a-4ee1-8b1d-a34f7bbd5fb4", "comment": "Malware payload (Mirai)", "value": "7a3798b4040955d8c9595196f08061dbce4c8170fecbadd7a8bb6a5080fb49e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176221, "uuid": "eee31f5d-fb11-4eb2-bc36-4ff80c14680b", "comment": "Malware payload (Mirai)", "value": "696c3ed2c15e99e4e30b94f5e55905a50d7f79cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176221, "uuid": "e622bbe5-150a-4e0a-a88f-855aa4bea5dd", "comment": "Malware payload (Mirai)", "value": "9f6ebce245398e0ba453f30f54b394f44f540fd8209e30a5a389b673a3b06512fd809ef345597e67927723892b76604b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176221, "uuid": "6c9d9c3f-8872-4a98-a7db-f7a5e02b569c", "value": "T14183B74E6E939FACF32C87344F739B3BA655278633A0C185D26CD9416D6024E586FFA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176221, "uuid": "bf2a3a14-830f-4854-9651-4b2242388d1f", "value": "1536:ysxCRRmyyH/eN2eNuyNv7zB2OW/+rrprw/ylax5Y:TxY0yAazB2Oty/ycx5Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769176221, "uuid": "61b8be08-fac5-43f9-8768-c73b8afebc7d", "value": 84576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769176221, "uuid": "c1ff2988-de87-4708-872e-71c5cf258662", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176221, "uuid": "925f5f91-a131-4448-a20b-745e0677f68c", "value": "zermips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ff2ec7d-f7fb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769131893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769131893, "uuid": "ad0243d3-7179-4ea4-8b78-d9f4f8c3bf1f", "comment": "Malware payload (Mirai)", "value": "615930b13a0ba8fed23097cc89eaefad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769131893, "uuid": "781647a2-53e9-4a5b-a6ea-1d0b0b259e7a", "comment": "Malware payload (Mirai)", "value": "7a6ee78590313d7bb4d4a874cf76c71634e49939abfacbd34faba205b74e4063", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769131893, "uuid": "c95f7639-2a8a-468b-aab8-da4a5ec20f30", "comment": "Malware payload (Mirai)", "value": "1f8e6b626bf38fa9d07d46c51e99e3aa088a0b99", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769131893, "uuid": "ccb0fadd-9696-4f73-8eb1-8b61cb78fe81", "comment": "Malware payload (Mirai)", "value": "fd831d99e7b2c88469a9a264d990f0f257602f9393eda7c57662dbdeb99deff9a6210eedb0a2b5226f7c87b35ad57d39", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769131893, "uuid": "902285f3-45ea-4eac-b1cb-f8b07e31c3dd", "value": "T1E1434C137881C0FDC589C234577FA61EDA23B07E1236B26A37A07E2B7D4AE311F1A645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769131893, "uuid": "2e81fd5e-c6f4-40a1-8924-ab7fc86db1e0", "value": "1536:PqNVEOcdTRu+Dj1vuAeHx/7/DVuZX/lBavtus:PsVEH1GAeH5RYPlBuu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769131893, "uuid": "19a8d948-1dfb-4ba7-b7aa-2fbc0a28f9dc", "value": 59184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769131893, "uuid": "37a89997-5879-4ae3-a9f0-afb6dcd50a29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769131893, "uuid": "b45655b5-691e-4d5f-81e5-ddd2f9d3d467", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f889ce6-f89c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769201014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769201014, "uuid": "185db687-7027-445b-857e-bad9befaabf2", "comment": "Malware payload (Mirai)", "value": "ed9b0a238a5b3b83a8204a80eaeca718", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769201014, "uuid": "fc9ada16-a008-4f94-8938-f638869bb22b", "comment": "Malware payload (Mirai)", "value": "7b37547aa5bb8491c259fdcabdb1c58529dedc08ce64aae0ab27eebb246bc924", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769201014, "uuid": "57da0d33-c40a-4ce6-9e3f-45daf50e2c80", "comment": "Malware payload (Mirai)", "value": "096067d7be1172f319002a63c8c30f0835ea515b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769201014, "uuid": "74d4b13c-1106-47ca-8a53-f22467b0a9c5", "comment": "Malware payload (Mirai)", "value": "cf32e36f4a26eb91118f552b62ecfd9277110e1677997bb3cb314ae598d46bfc53452a57d0d705e265affd46a94a4c4e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769201014, "uuid": "6c6a4047-5ce3-4ed0-afd5-6a76e4fb2394", "value": "T1E884C6BA7750BB9AD368C23405F357E5A3B2239217A38105E13DCA3C1DA138C59DFEA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769201014, "uuid": "f1b35d46-1887-4b4c-83dc-5e6b3ed19aae", "value": "6144:klFnW5+U22U5xj54ZmieODCNqFQTTCZgu7uk98oNwhWSAMU7Z7:klFM5cj5j2EqGxTphpU7Z7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769201014, "uuid": "cc3e926b-8bc8-430f-b184-836f9ccf2668", "value": 376552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769201014, "uuid": "81a9c5b8-d5a8-4196-828c-bfeb7a5d141a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769201014, "uuid": "ea60121a-da2c-40af-880e-3249923717fd", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59808de2-f829-11f0-a129-42010a9c0007", "comment": "Malware payload (BlackMatter)", "timestamp": 1769151692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151692, "uuid": "ddcdd8ed-5aec-4171-bd28-708be42fc24a", "comment": "Malware payload (BlackMatter)", "value": "6ea802aa073e20f331c6e1e5aef6cf7c", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151692, "uuid": "f4502116-8676-4610-a11d-c1a6308b448a", "comment": "Malware payload (BlackMatter)", "value": "7ba1caff23d3a218037c59ac9ec7228af4a8db03577292404b1cfea6bb79023c", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151692, "uuid": "983b7bd8-d2ff-48b3-bfc1-e2a0d9458b01", "comment": "Malware payload (BlackMatter)", "value": "f1bc04d98b5bc02bf7e65a65d8281057c77a9aaf", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151692, "uuid": "bf939e0b-d822-4356-b728-500d7d7943bd", "comment": "Malware payload (BlackMatter)", "value": "2b1ece2fa9a77631b54f4237d25782683e3968076e0bd1f89ce9243d319999c663035006f0fe05a7f75f437de7174c36", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151692, "uuid": "ca3aa1a4-9665-4596-8a20-16105c281fa4", "value": "T1B8E36D21F212D0B3C87718F1372675B2F3DE4E2C19A96947DAD80F99BCA48232F15597", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151692, "uuid": "7aa11a4a-3801-4b1c-b755-df17c574c2b5", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151692, "uuid": "2b12856f-5967-4571-8907-8b0ed9758bee", "value": "3072:r6glyuxE4GsUPnliByocWep+lWzklDg1dIikbo:r6gDBGpvEByocWeAlAiZE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769151692, "uuid": "cacb9bb8-1128-43a6-993e-b2611296a319", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769151692, "uuid": "9059e08f-7cb4-4aa8-9eb7-e30c6be573ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151692, "uuid": "4329e8f5-0bd6-49a4-b028-7a36bb610ac9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24f5c1d7-f865-11f0-a129-42010a9c0007", "comment": "Malware payload (Expiro)", "timestamp": 1769177374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769177374, "uuid": "0ea4cd43-6e3b-4e17-bfbf-33124a4db2ea", "comment": "Malware payload (Expiro)", "value": "b324945f8fbfad5e06d9d6fff4f53d8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769177374, "uuid": "006a654c-3e08-41d8-941b-5e541117bb48", "comment": "Malware payload (Expiro)", "value": "7d430bdeccbced4e2edfaecf2854fc4a89b6002d8bcc63a0bfab14c0e03b1060", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769177374, "uuid": "08d230b6-b1e6-4652-88a3-e5b5b6d1b35e", "comment": "Malware payload (Expiro)", "value": "143950f90e124fe1a38813480ad2260455c3f9db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769177374, "uuid": "08ed7d64-93cd-4db0-b1e4-31cd060c6776", "comment": "Malware payload (Expiro)", "value": "0710a00dcec3c3b8d4ec5197a103b9e245e9274804ae94eebacd6aa6d9ca415701642311943e6493759737919529d275", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769177374, "uuid": "6fe740d6-db24-49b4-a774-9701fb38473e", "value": "T10E95BE16E660B066E89349707E79A25B38293D3A2980EC0BF78C9F163771593B4F531F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769177374, "uuid": "2002828c-0f9f-405f-9dc1-193951fe5459", "value": "e9f7c6280c4f854c033e86e0ee4cb8ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769177374, "uuid": "0a2f029e-0d34-4527-9e4b-63aa8a1b0650", "value": "24576:QeceqFOIrjaHNQpVg9N9JMlDlfjRiVuVsWt5MJMs:IeqFtrjatQzgFIDRRAubt5M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769177374, "uuid": "ef14bb1e-56f6-460f-a82f-f4656f5ae4ec", "value": 1916928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769177374, "uuid": "70fe1b1c-9d4a-4f9e-bc1b-6cf73ab0dccc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769177374, "uuid": "26f3877b-5c29-472b-9e6a-ec1f8ae038f3", "value": "Cotizacion.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45fc8402-f83a-11f0-a129-42010a9c0007", "comment": "Malware payload (CastleLoader)", "timestamp": 1769158961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769158961, "uuid": "eff9f629-e07d-4444-ada3-b6862bfc1aa4", "comment": "Malware payload (CastleLoader)", "value": "029bebfd30f6e58b0614398879cea4f8", "object_relation": "md5", "Tag": [ { "name": "94-159-113-32", "colour": "#84A36F", "exportable": true, "hide_tag": false }, { "name": "CastleLoader", "colour": "#3A5FB2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769158961, "uuid": "9a18954b-a168-4236-8845-9b21214cafd1", "comment": "Malware payload (CastleLoader)", "value": "7e0f4292f779c40f8f1900d891994541045209c7e465cdb28828f64d2a1c09a7", "object_relation": "sha256", "Tag": [ { "name": "94-159-113-32", "colour": "#84A36F", "exportable": true, "hide_tag": false }, { "name": "CastleLoader", "colour": "#3A5FB2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769158961, "uuid": "4a86b557-bc07-446d-bb01-1af23e51026c", "comment": "Malware payload (CastleLoader)", "value": "d9e940b9fb9e1ccb9c1afc6a59b06a5c83f521f9", "object_relation": "sha1", "Tag": [ { "name": "94-159-113-32", "colour": "#84A36F", "exportable": true, "hide_tag": false }, { "name": "CastleLoader", "colour": "#3A5FB2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769158961, "uuid": "7ceee5e5-fd83-4f34-ab51-dd801d16d3ce", "comment": "Malware payload (CastleLoader)", "value": "315047c8244c40ea608bd94ecdec6980ae9f133470a15491f51dcdea5ff675fdea98d207b5631b64fb134a178cb4d9b0", "object_relation": "sha3-384", "Tag": [ { "name": "94-159-113-32", "colour": "#84A36F", "exportable": true, "hide_tag": false }, { "name": "CastleLoader", "colour": "#3A5FB2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769158961, "uuid": "e5d8b926-b977-4b8c-883d-cb7df257f3ca", "value": "T14A248C217680C57BD4620AB115E8D6F64239BD354B2419CB73C83F7AAE748D2473AE3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769158961, "uuid": "8f4ab1cd-3d17-4e6d-98de-fbe7539a88d5", "value": "bdf7575fcc0b17ceb288719b350b3b25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769158961, "uuid": "32e2e70a-ab58-4065-917a-d6e599bac25e", "value": "3072:lKtlcSDLohnckcHx2wgDAEls/4VA8lmh1PwVwJVTV85YXzwiZk1+1YeEYg:czUhn55wghW/oktwWJdV8KXMMg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769158961, "uuid": "1130e258-b2fd-4a93-9c7d-bac01b380228", "value": 227840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769158961, "uuid": "223e721d-de09-437a-9bd5-9861b323612d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769158961, "uuid": "73ef8fb4-e0ee-4e33-96f1-2e90fd16691b", "value": "7e0f4292f779c40f8f1900d891994541045209c7e465cdb28828f64d2a1c09a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee552bfd-f834-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769156666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769156666, "uuid": "56d47c1e-3456-4316-afe3-e2fab98e8b1c", "comment": "Malware payload", "value": "1cfa9a38056c99c037c42d2cae6c25cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769156666, "uuid": "0245a44c-44a2-40be-9ff8-c6e16cb3a274", "comment": "Malware payload", "value": "7e3ace550996e18a0abf10254842b361f016e8ae1d3c4ec79955f05ca698409a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769156666, "uuid": "e63db1ba-2ca6-4484-9131-730b1f8f8133", "comment": "Malware payload", "value": "254a404c447fd444839a93f4be9f4684e2b0671a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769156666, "uuid": "aac42fef-c738-45a6-af2d-6d228a527846", "comment": "Malware payload", "value": "7e4e910e248df98b92d0b712cd7eb2856efccd75c24499f880d669a5d705d5bb94da2c5b6f9fd14bab1bd4d1ed6d297f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769156666, "uuid": "207ff466-e420-4588-9717-207ea7e07dc6", "value": "T1B95533D2B6C386CFC5F3FB39A418477C752A3D3959071206AA2D83B37A19D684B87D12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769156666, "uuid": "7d8aaf56-4c35-4ad9-aa05-f32cb4ac0df6", "value": "24576:dO7EQb5XgACLCKdjpfYnWN+ZPhTUu5UPsDGyMVYNVZpUR:dOZnWkZP1dUuMVYHwR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769156666, "uuid": "dbaa010c-24b4-49ad-8cc0-6caa56b10c25", "value": 1290496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769156666, "uuid": "350f550e-f968-419a-b4bf-842a035fdb6b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769156666, "uuid": "60076b50-f98e-4fe3-8aaf-81518137974b", "value": "poop", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c5cbecb-f867-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769178326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769178326, "uuid": "3bed6750-7138-4adf-abef-f038c27264a5", "comment": "Malware payload", "value": "ae073bd0e689bea260a7313bde487a55", "object_relation": "md5", "Tag": [ { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769178326, "uuid": "a55de42b-4f50-4334-807d-35add03561af", "comment": "Malware payload", "value": "7ebec64b37ea3d9e00a5ed90720535ec11f76522d7fb0f4420c9e87e3e6bc6a6", "object_relation": "sha256", "Tag": [ { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769178326, "uuid": "af00f9fb-6ace-4aca-9f02-7b3bcd076bbb", "comment": "Malware payload", "value": "93428012cb0be7514c8e6e3bffbcc930b5597d0c", "object_relation": "sha1", "Tag": [ { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769178326, "uuid": "f73fa5ca-301e-4863-8b17-db038c4b22a3", "comment": "Malware payload", "value": "0608dfcc5c8b92bd9510c8babeed70ac5defdaa126a377dbbb28a1a2ec7f68b003a2b27aea6e836f24545bef7fed555e", "object_relation": "sha3-384", "Tag": [ { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769178326, "uuid": "1b65b0c9-a9cd-4f10-88f0-61c1d4808378", "value": "T183273397FC5D8A61F6A74450E5F2811F35F07E4BA370984887C0E5D92E8ECB4A8B632D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769178326, "uuid": "7ee82089-4b50-4a76-8622-1592db01a972", "value": "393216:x0vdxD+kDJ7LvPwVhpIX6Mwin3TPrQZ+Aq1hAo3Hc5svhLCXofNft81mGB8XNYSX:x0vP+kNvPwD63TTQZ+lX8qZxt6mGgtrt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769178326, "uuid": "d66d9bac-881b-4efa-bcd9-4e18c7bc153a", "value": 21826336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769178326, "uuid": "c504f8e2-63d5-4c70-8615-30b5ec6a5366", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769178326, "uuid": "03df563b-31b2-4d60-81af-8d26be344409", "value": "urPty.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "525d8ea4-f861-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769175732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175732, "uuid": "37dd10f5-80d5-4c11-91dc-e9c3c1a53c89", "comment": "Malware payload (Mirai)", "value": "0292958866fd2a094621690214e938d9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175732, "uuid": "c6e03baf-1a3b-43ef-9302-a367e435e275", "comment": "Malware payload (Mirai)", "value": "7fb27a6651bc2a9d70151f867cc72b7529e024db61e4a713a9618cb1b5e508b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175732, "uuid": "8d79c1a3-3b4a-4115-9ec8-abe6873a2d86", "comment": "Malware payload (Mirai)", "value": "a3e078cd7c9774ed74bd38ab946462fc76459bf9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175732, "uuid": "df7ce837-2eb2-4d2e-91ca-811148d14036", "comment": "Malware payload (Mirai)", "value": "0fad15a386e32c578c2a5b4e936b814da342967dbc6e93b9f3c821e44dca0452fe44b91e38a2089ee3c7242905b18bd6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769175732, "uuid": "fcd4263b-a770-4b58-b30e-0a5e03fbe314", "value": "T1B5435C42B30C0A43E1676DF0393F7BE1939FDA9110A4B389750EAB5A8273E325547E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769175732, "uuid": "8510973d-0c6b-4ab8-a76d-f2517f5724a1", "value": "1536:s6pBwj0FevOyDsMEOS9aorZoDkRtcC//bh:s6pij8eS9acZZ/t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769175732, "uuid": "3b7e11df-2adf-4f3f-b3e6-3f26ed01813b", "value": 58680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769175732, "uuid": "478d996e-4381-458d-b456-fdcc50948c73", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769175732, "uuid": "ecca7982-6215-4ab3-8fe7-5597f06dbb1e", "value": "nabppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a5cdc1f-f863-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769176551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176551, "uuid": "f5dfd579-c660-40a9-81b1-843159c52057", "comment": "Malware payload (Mirai)", "value": "cb48cf7add7933c464425d54bcdb206e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176551, "uuid": "872b683d-4385-46cf-9a95-c234642ccb75", "comment": "Malware payload (Mirai)", "value": "7fe3a021c593e3b973e118a90e9866958291cb1aa795ad56c0a888825a78bde6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176551, "uuid": "9533c892-32e3-49d9-bf70-402379182de8", "comment": "Malware payload (Mirai)", "value": "392d674eb22e5e387ba330809db0d3bee29ed7fd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176551, "uuid": "f09aa45c-e753-44af-b613-c7aa982bbf32", "comment": "Malware payload (Mirai)", "value": "37d8df9c2be038c15ee1213f455e6f7b3e5a67511e21209dea0cb9d7fb0912af79e7b04d6c60ce531773fbcffe633ced", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176551, "uuid": "bb7fb346-be41-49cb-bf27-a6050013d32b", "value": "T19F83B91A2B21DFFCF6AD833487B3C6746688329126D1C298E55CD70C2E7424E594F7EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176551, "uuid": "6f8d7db7-2684-4d12-869e-6b7abd8955d3", "value": "1536:Jjes22juECawrpuCGi63kFmzQFCpqu+BcjCb6Z4gfgM0Ezzc9GD7Y9GsPgo11119:Jjes2aHCawB1bIfuh9zB/5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769176551, "uuid": "89fceec1-271a-492e-ac20-6185e81bc660", "value": 83076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769176551, "uuid": "0ec1158c-8f5a-414e-8f0d-8e76686699b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176551, "uuid": "944c4896-c1c6-41ec-afbf-743c0c7fbc23", "value": "n2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f13b957-f829-11f0-a129-42010a9c0007", "comment": "Malware payload (BlackMatter)", "timestamp": 1769151809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151809, "uuid": "0a2f8ee0-98b1-41e0-a4d1-c0c9187a03cc", "comment": "Malware payload (BlackMatter)", "value": "a62594ec30885b40bf55127e1bbb398b", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151809, "uuid": "188f2f6b-9f51-43a9-bc02-02b940512159", "comment": "Malware payload (BlackMatter)", "value": "80d42d9d8d97f4245bf6a279a8f83668385812337d39e0282068c8e344dc755d", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151809, "uuid": "32cba603-5f9c-4db0-a532-049ca81441fa", "comment": "Malware payload (BlackMatter)", "value": "2947494778cfa84e13a9645057e371ea5a8031e5", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151809, "uuid": "b37568de-b3e0-420c-8b94-a0fee87a976f", "comment": "Malware payload (BlackMatter)", "value": "b7264911a92bcb12647dc442b617e6ad754fe69e0a9d2bf6017b7ad309eee8ca915a40fa9870b787a0ec6cedc21775e0", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151809, "uuid": "1b227347-67be-4818-a541-4cd6a0e3a34c", "value": "T1ACE36D21F252D0B3C87718F13736B5B2F39E8D6C19A96407EAD80F59BC648232F45A97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151809, "uuid": "96140a44-e12a-443f-8e76-d855b2216a62", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151809, "uuid": "c930ff6e-0aa9-40fe-9b8d-0a8f8d48cc45", "value": "3072:46glyuxE4GsUPnliByocWepl/A5si7BWtcEO1:46gDBGpvEByocWejERstcE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769151809, "uuid": "33b2332d-8579-413e-a6af-934dde340eff", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769151809, "uuid": "13cd4493-7d94-472a-8fe6-3b919878c6d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151809, "uuid": "5dd61214-aaba-4da5-a09b-569b6c9be1bd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53248eb9-f861-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769175733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175733, "uuid": "e243a576-f55a-4e37-8b01-92f27e95b415", "comment": "Malware payload (Mirai)", "value": "69bda39bbab1fd0203c8ecd45f554ad1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175733, "uuid": "de1f413c-d1f7-4207-980b-ea57a2a0bcfb", "comment": "Malware payload (Mirai)", "value": "80f4e4bc95a2aa70d5a50e438db7fd8b1c9c786ec60476a0a03b24aac08187cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175733, "uuid": "661fdcac-feff-4c78-8314-a70ffd96f916", "comment": "Malware payload (Mirai)", "value": "489158c6f99c78b0f3c93f81bce82dd681b3f7fe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175733, "uuid": "529e315f-5007-48a7-a28c-bb21d8d8305b", "comment": "Malware payload (Mirai)", "value": "c0907d1dfc312986f2ca22d2a4f025af52ee6ea8209f7e4955a5510c0c0fdae01a5410e26ac43b16bcdc6d4427d6c391", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769175733, "uuid": "b78dfe24-c856-401c-9627-2b68878b15fd", "value": "T1F2633A05ED385D27C4D0753A56E34530F6B643A91ABC9A4E3EA32D5CDE14720313FAEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769175733, "uuid": "85dd30c9-6afc-4f36-93f1-aae871c6508f", "value": "1536:ZKhha/GwlQK2cEijMB1Rh4Qz8Pk8SloJR:ohAZlQV8jowGqJR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769175733, "uuid": "ffc4130a-6331-4160-bb57-984f0f461d9d", "value": 67956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769175733, "uuid": "b7a6aed4-0b95-42b6-9ea0-e0e64e8837fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769175733, "uuid": "9588747e-b7bd-4981-b9b1-3d95f607a508", "value": "zerspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a148c14-f829-11f0-a129-42010a9c0007", "comment": "Malware payload (BlackMatter)", "timestamp": 1769151774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151774, "uuid": "d3dbec34-a980-4015-af7b-e288eff833a0", "comment": "Malware payload (BlackMatter)", "value": "21f20a3b9d79750769bed240d415958e", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151774, "uuid": "dd7234f8-44b2-4add-86ca-030bf75f6ff2", "comment": "Malware payload (BlackMatter)", "value": "83313da4c33e6c413933e577f94e86c575b54a4a2480cba90c3407c99c27113f", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151774, "uuid": "415993c8-f959-4c38-b154-0d2ac1b837ae", "comment": "Malware payload (BlackMatter)", "value": "09ab71d0c659a20d1fb32ece243b95369e5d7776", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151774, "uuid": "c4df91e7-9d20-46ac-92ec-4f3a140da684", "comment": "Malware payload (BlackMatter)", "value": "224756e53fbf4409ca377b2472615d7d10e574ceb5c40d4af7fe73a389822d97a2ac34c453db4e3c47f3accb5ed6e7f2", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151774, "uuid": "b2649c8f-67ec-482f-b554-43ec83e97815", "value": "T134E36C21F212D0B3C83718F53B36B5B2F39E4E2C19AA6947DAD80F99BC658132F05597", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151774, "uuid": "2ab855bb-f4d7-43cb-80f4-5ea5d4283cc3", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151774, "uuid": "d723167f-6361-44a9-a5eb-6b5ca56ab8a1", "value": "3072:X6glyuxE4GsUPnliByocWeprlkos7yPR+:X6gDBGpvEByocWeleRy5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769151774, "uuid": "3086fa9b-51db-4a46-9007-fd0a5f88a8de", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769151774, "uuid": "57b95237-e6cd-4f40-87b1-1cfd24868382", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151774, "uuid": "97f77d99-010f-4624-834b-04a7eea2bc20", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12445e7b-f7f4-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1769128809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769128809, "uuid": "fa104a1f-8e52-4284-8911-1a271b8c3ac4", "comment": "Malware payload (ValleyRAT)", "value": "211f77a7cad388dd488c660eeb577327", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769128809, "uuid": "54cc3183-655c-4018-9cc7-9c6eedcf2039", "comment": "Malware payload (ValleyRAT)", "value": "8499fd447499819f00745498b8f38d071906e6b5e5ccb49b1a3d6fc38834418d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769128809, "uuid": "9af901d5-c0ed-4ba0-aa84-3a2bf4f36a58", "comment": "Malware payload (ValleyRAT)", "value": "9445f2b5f85df2e2763d9f6a35b625f44bffc7da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769128809, "uuid": "cfbd7ad3-9823-452e-b776-5ebc38e1b57b", "comment": "Malware payload (ValleyRAT)", "value": "ce86ecf2953fccad1b4245faffc03fd31343afaef7596368b94d9f74e8190494e676de61015fc9b55216fdb759ce520c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769128809, "uuid": "6d0eeb31-6271-4eb5-b7fa-47bf4de7b3a6", "value": "T19DD37D4733A450F9D4A78279C9A25A06E7B374660735A7CF17A086BA2F137D0BD3A331", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769128809, "uuid": "dcebeded-de81-4de9-a7b8-96ad4feeb191", "value": "fb51ede541a9ad63bf23d302e319d2a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769128809, "uuid": "6b6c782c-ee88-4c9d-be42-e24741b0c2ba", "value": "3072:lO55k/y5dAj+BMTYlgEQnB+Y+pek7+3OrFZeUqe6ok:lO5n5d56TYZQnB+Dpekyyqm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769128809, "uuid": "39e8f2a1-f71a-43bb-aedb-95648b7b520a", "value": 133632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769128809, "uuid": "6dfe4b78-7516-48f0-bedd-24aaf0b083d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769128809, "uuid": "15538859-191b-4e26-803a-826ac1f56adf", "value": "211f77a7cad388dd488c660eeb577327.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8de690fa-f829-11f0-a129-42010a9c0007", "comment": "Malware payload (BlackMatter)", "timestamp": 1769151780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151780, "uuid": "45f2d516-5dae-4f40-9df8-ce2b22e7da67", "comment": "Malware payload (BlackMatter)", "value": "5d6de0cf1ebda924ffd04bf1c16db0ea", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151780, "uuid": "f2e574a3-5c94-46db-885b-7065f3cd5bbf", "comment": "Malware payload (BlackMatter)", "value": "8540b955e851488606b3508211167daf280af7b6fc11caea4aa7f4cccda8e307", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151780, "uuid": "eda1348f-6dbc-4e43-9576-eb7b83efb808", "comment": "Malware payload (BlackMatter)", "value": "0e3eb19eb192a980233a48e7d4e67172ee485ccd", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151780, "uuid": "5eeab42d-0552-4f5b-9435-c79eca42ce67", "comment": "Malware payload (BlackMatter)", "value": "b9cfb11361f9811f1804730efbb2d57ef4249fd622cdc9653577bbd40a37367efc5aafce5e6f6287cfb61726a7053940", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151780, "uuid": "e47df238-5947-4131-986b-a061dd989e76", "value": "T1A4E36D21F612D073C87718F13726B572F3DE4D6C1AA96847EAE80F59BCA48236F04997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151780, "uuid": "24583d30-81b5-4724-a33d-17cac0208324", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151780, "uuid": "c7932362-6cbd-421d-8a18-4f84a58f1df1", "value": "3072:J6glyuxE4GsUPnliByocWep7v+J1kOoFMxzc7:J6gDBGpvEByocWe5vnOu8u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769151780, "uuid": "fd58125e-a923-4ceb-8d8a-775e822d8d6b", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769151780, "uuid": "83625c3b-1183-49a4-84e5-5b52c64ff06a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151780, "uuid": "a2cb1b96-a318-4261-bd47-a82d0062b5ab", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "637c84f6-f829-11f0-a129-42010a9c0007", "comment": "Malware payload (BlackMatter)", "timestamp": 1769151709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151709, "uuid": "0c65aca1-9ad2-4ebc-90d4-b2a033de5821", "comment": "Malware payload (BlackMatter)", "value": "b04bf7947543c8d78996323efedc719e", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151709, "uuid": "fc294dd1-7881-464b-907d-56b3d7e3ce84", "comment": "Malware payload (BlackMatter)", "value": "857a902aeaa351e72676fb764543e2e8fc5c332b5881ea8dfe407ff257f913e7", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151709, "uuid": "ca148ac7-79b8-4c24-806b-55fa839228dc", "comment": "Malware payload (BlackMatter)", "value": "90f323fc4a052c2fcb44ca4f0b2429d0a08b9357", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151709, "uuid": "cec32787-5be8-431a-95b8-f54eaa015836", "comment": "Malware payload (BlackMatter)", "value": "7b5c8837eaf3b27825707d7d6f8b0ce06147aa4d4f38ddbef1f13172d2d72cc411b16cf1f74e2d950a9a642f17105e51", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151709, "uuid": "a06bf6d1-1054-4d53-b097-37d6f5cc335b", "value": "T1BCE36D21F212D073C87718F53736B572F39E8E2C19A96817EAD80F59BCA58132F14997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151709, "uuid": "76164d1a-afe8-4f3c-a93a-93bcfa59e8b6", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151709, "uuid": "0cefca8a-110f-4831-9496-c2031583d648", "value": "1536:XzICS4AwwRlcz5AxE4vGP1iU8KnliIs3iocZMgkGJp1kUM/9OmAnhU2MJYezjsVi:o6glyuxE4GsUPnliByocWepSVCezYiG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769151709, "uuid": "a7085717-9c71-44b0-9734-59d16e37e1ac", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769151709, "uuid": "9a5870ed-4e86-4223-9135-21e3e87db615", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151709, "uuid": "e63dfb9d-57f1-465a-a668-06cf3e953412", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "920621fb-f874-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769183999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769183999, "uuid": "50cfeda2-52d8-4971-8c9c-d183b98ea28c", "comment": "Malware payload", "value": "a2e9b5a2001baa03a7dffba71ffdfff8", "object_relation": "md5", "Tag": [ { "name": "9c4517", "colour": "#523FFB", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769183999, "uuid": "6512bf70-9cae-454e-9f85-3610cadba6e1", "comment": "Malware payload", "value": "85cd7a1e24ec449c9bf5f86ffccfa2fb8a684f240ae0e3b492839b4277e59080", "object_relation": "sha256", "Tag": [ { "name": "9c4517", "colour": "#523FFB", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769183999, "uuid": "5b978d63-1b2f-45cc-b003-79841b0a9f4c", "comment": "Malware payload", "value": "ee411d014f9f9d531d17e1937f1c41eac9d12b88", "object_relation": "sha1", "Tag": [ { "name": "9c4517", "colour": "#523FFB", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769183999, "uuid": "0d6e0a53-b0cc-4077-8b20-68a3f957d776", "comment": "Malware payload", "value": "3eefffc560c54de173aaff7c7c6e014afef907fd95508ebd4f6348c1403c36f1312ba2aaece5941147df31d1b6a2c8e8", "object_relation": "sha3-384", "Tag": [ { "name": "9c4517", "colour": "#523FFB", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769183999, "uuid": "28e908b9-e6bc-45ca-ae55-a6f72288e8e6", "value": "T145C3F147FEA0A122FD08A332CE16D77B6F34AC5C5F728252386D721C1EB659A51E79C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769183999, "uuid": "8706877e-b759-4d07-9ca8-5c07903f9221", "value": "1536:lracUK3gqPilbVwkHURD8SbI9nk24C7OTEwufDFf1xJnywD5wyq545if5oms7y:HItbViFE9kDaOTGnyAwyqL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769183999, "uuid": "f837c524-ad10-4024-9058-10d7049cfaae", "value": 122368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769183999, "uuid": "d368f2d6-f099-4c2d-9382-222c720dead4", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769183999, "uuid": "9dacecb9-7989-4e8d-980f-f3abe1c4430e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d685d29-f860-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769175321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175321, "uuid": "f1a386b6-c93f-4ef1-beec-e74972b3b186", "comment": "Malware payload (Mirai)", "value": "f95c122d3c22757f52ee7b888b50405a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175321, "uuid": "ccf4b022-8807-445b-8738-d02c3c36b926", "comment": "Malware payload (Mirai)", "value": "85e8a9edfeb6658e844522b9e4b0beb4fb26868a266b0b2e583ccab0340edd20", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175321, "uuid": "36dd2bf2-d1af-45f1-ae11-f85b980c4692", "comment": "Malware payload (Mirai)", "value": "4399b3199465392d942ca99382e604f71a9f632d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175321, "uuid": "4211c6d4-5f55-4c2c-b407-8956639a1ca9", "comment": "Malware payload (Mirai)", "value": "2f61c05f8c3e3218956fee0f133958eed1f2f12f534823df67cf383c77cc49f6a58c4b8d187277f18f17c01806ccbd06", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769175321, "uuid": "0b6043aa-26c2-4d8f-ab94-618c2ab5c407", "value": "T1CEA34B25ED796E27C5C0723A51D34530F5B643AA25BC990B3EB31D5CEF18320316FAAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769175321, "uuid": "91b48c7b-c3c2-4d24-b237-7da612c1d66a", "value": "1536:COms1+ZD3TqdNDU8sqZHGXHFjm5NAxY7yZ0DIpaUgvQDfbn:xFYL8NJsxk5NACGPdTfj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769175321, "uuid": "d55fe401-520c-4f26-9459-24963d202772", "value": 99548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769175321, "uuid": "32efef98-6c87-4eb7-a871-c93cea1777fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769175321, "uuid": "ecad15c2-5f9b-4dd8-ba40-81ef248bcb7f", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4967d5f-f894-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769197855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769197855, "uuid": "bb228738-0540-4a44-89dc-df0a148a1de7", "comment": "Malware payload", "value": "d8edcc9c68801bafcddf9dbff56e8e3c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769197855, "uuid": "b8c999d2-7e8e-4bc3-9bf0-5f925b5e8602", "comment": "Malware payload", "value": "86f57f0752eab7c13b14c969a9025b96402f49cbca89c453f678045e63ad24ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769197855, "uuid": "50698119-8b85-4b70-a428-b3db29d15a96", "comment": "Malware payload", "value": "da76073bd724a07c283887bfcc4ce6c90f12993d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769197855, "uuid": "6c67ea47-44d4-4042-9e7c-8dc92cc36e58", "comment": "Malware payload", "value": "5292465ceb72c6d03f2e540a01c36537f4b4e4f57f9683cb1d189d0d7fecf43897aadc2052dca3703dc459c1de059151", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769197855, "uuid": "4f46e0fa-50e2-4d82-b3d4-3580be0fd547", "value": "T10F76AE5AF5E314ACC097C8348B6FD1537D35B8A942317D7B37849A702E67E202B6EB21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769197855, "uuid": "f0b72de4-1e38-479f-a488-d6f5a00dc866", "value": "98304:60Mnx/h4B09I9Yz4D6gGHoMW+RRJZMscBMIeDO60p+ZxsUlkvEbr/YsFzathfHx8:6XPlz4U8v1F5vIrzMhHxIh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769197855, "uuid": "becbd151-6140-4603-b86d-664e149212e8", "value": 7321760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769197855, "uuid": "57f4c5c7-4b7f-49b8-863d-bd707fc3c6c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769197855, "uuid": "cb88fb68-b4a5-4a12-b3fb-8b1ae097b01c", "value": "avx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e426f97-f845-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769163834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769163834, "uuid": "bb655d93-f3cd-4352-be54-70439749e8e8", "comment": "Malware payload", "value": "5bd4a05bfe871cae2d373a7421c4ef29", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769163834, "uuid": "f4e65f56-4352-4fc3-b946-2d8ac813b919", "comment": "Malware payload", "value": "870cb25dcb7e83dae251efa18fbcd4c7ed66345596a0b80643d5df816cde7898", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769163834, "uuid": "6f5acc33-c809-4ba7-a9e0-41b7dc226843", "comment": "Malware payload", "value": "ef2e82fbe0728651b31bdf4acbffac9c3d706b9f", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769163834, "uuid": "496756b9-f56f-49fa-8dfb-068f157e8994", "comment": "Malware payload", "value": "24ce6b4ca88b5f1afa925e2d48915c0ec4c12ec25ef25dd89b960819c6b67a457e9cabc9f464cef14fb81b8d43e44c03", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769163834, "uuid": "39749ebf-7377-430c-9c3c-fe13fe870537", "value": "T17CA41ABD9C64E366F60980BAE145E3635E2178010136EEB319EEE31405995B3DB1B3FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769163834, "uuid": "fb950bb5-4759-40b8-97c3-bed53cfc6655", "value": "f943146a3f045dab0e0139d7ebc6c303", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769163834, "uuid": "78363127-5664-4e56-bcc8-1a824b4daec0", "value": "6144:qRMdd/2t5cIjK9/+66BcwQjQ3VmPwWKaFBfiQ5tNMeyxwwc5YC32sTRF094A1o9g:qRMf/e366BKVF6JNAg1mb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769163834, "uuid": "7b6b9da8-f132-44c8-a3f9-f5b4fdc0311e", "value": 449536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769163834, "uuid": "c0050874-836f-4013-89fe-b5ee321b0a7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769163834, "uuid": "d76f07f5-1c39-438a-9325-ec9e3152cbc4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2103ce3a-f899-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769199701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769199701, "uuid": "5f73096a-50c5-4452-9e63-81656004e21b", "comment": "Malware payload", "value": "d0a1802836714f8569c8d86e5fba9b5e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769199701, "uuid": "3fe64088-45f9-4e3d-9189-7fd89960006e", "comment": "Malware payload", "value": "872e6bd67233cacb289e6169e374e91b85974bde4d98b0065d6d7d865811a85d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769199701, "uuid": "32648450-2b08-400c-905c-53d7fea076e9", "comment": "Malware payload", "value": "658f511802a6e394b05871e5b9c07f10d5c95062", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769199701, "uuid": "00087efd-6cf6-422c-a713-ae428f969c01", "comment": "Malware payload", "value": "8c02dbdf53c0e2e7b1ea8dfd08bfbf4c904c38ea2307ec4fb3bb914195e78fffac0e6f521e9320e3bd68a4657710cf67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769199701, "uuid": "795952f0-351c-488d-a575-3854bb781d82", "value": "T160843702A7F91145F2F7ABB66EBA8511893ABC666B72C9DF1081424F0931FC09DB0777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769199701, "uuid": "550dd84b-d2ea-47e8-8611-041fcfc4d5f1", "value": "b10596a614daeaf025ce254fa50b488b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769199701, "uuid": "5e93a696-1dee-4334-ac56-c7a9d92b2e13", "value": "6144:oSaVvkavxPbGPs/tbkisyhJpw7wJ92o0MAS0AulF1QxcMtb+R8:Zahk8N60/tbVhJpwU92oCAEWx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769199701, "uuid": "e5f67bd6-a32f-47a3-a55c-1091c2c5f935", "value": 376832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769199701, "uuid": "e6a14570-e212-431e-98d8-46b070e3d4fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769199701, "uuid": "a86fe1f3-1dff-47c8-9386-8ef8688216ac", "value": "SecuriteInfo.com.Win32.MalwareX-gen.68748741", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fc5a363-f864-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769177097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769177097, "uuid": "11662422-5309-40a2-a760-db9888bd826a", "comment": "Malware payload (Mirai)", "value": "215f883a36103fdaf3595cb2a6b4089c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769177097, "uuid": "9ec5a817-edb6-4b3e-8fd5-cf9946044406", "comment": "Malware payload (Mirai)", "value": "8a620fd9ca2a89a1f5ede265fe065a5b8e670cba751b08d326daf99526bc2b83", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769177097, "uuid": "0fd87c61-eef5-4f0e-a69d-df0f0668190c", "comment": "Malware payload (Mirai)", "value": "161a08a56acfab9c6221fe4ca99f5c13a5c0bdac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769177097, "uuid": "3d4c8b17-9ca2-42cd-98bb-e3511ed88fa5", "comment": "Malware payload (Mirai)", "value": "c061ea340dfcdb34de1ecc994e5158bac0aad4c80fc1609725a325a6daea6ee39b930dddeaf13f86944d0e4a1e3a8b7b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769177097, "uuid": "a38a216c-f5b1-4863-9dd7-a2dcc1626635", "value": "T139633B32BE761D67C4C4703A61E70635F2FA434721BC8A2A7D720D9CAF58644325B7B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769177097, "uuid": "3ae78c2c-d163-42d6-9e1f-f742b235d409", "value": "1536:7aMCR5fWScHJRSNAXYGcyZ07GLomjawA0fb6:WN5JNAIylDi0fO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769177097, "uuid": "7dbdb9b7-db6a-48e3-8308-90e80f48763d", "value": 66780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769177097, "uuid": "c7b3afc4-7ce8-4c50-ba0f-36443b53b4c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769177097, "uuid": "2b3f147b-858e-4470-ac3f-91c4263ac245", "value": "nabspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4b8e268-f86d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769181051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769181051, "uuid": "037ac2d8-40c6-4b09-a832-ebc9416a85cd", "comment": "Malware payload", "value": "efa371d9b2b3abe22cfb9c9025155e00", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769181051, "uuid": "645d9006-db73-4375-99ca-81bf6edc7498", "comment": "Malware payload", "value": "8a8b1c47f9a4ad50b7b8d984f90daf9c0a4f305a418056687e337f2391e89f59", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769181051, "uuid": "fd915ca1-33b8-4f87-973a-869281046cb9", "comment": "Malware payload", "value": "3aa69245194d1ef91db178ea07de1bb25a374d76", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769181051, "uuid": "883ab7bb-a4c8-47f6-b0c0-2415c6b948b5", "comment": "Malware payload", "value": "b0de8f85a75eac77a7bdda340b900e3bc1f4962594057f86a1660c337525c6b030acf66c9b1f4d9ff56d479e0c208332", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769181051, "uuid": "2e696cd2-228a-4d5e-a9e4-5f08a0dc2ba0", "value": "T17161728D14B28E327CD68A12B7B8D04671A0C7A550E95ECB9BF8B8EE704DE5DF005671", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769181051, "uuid": "8259d2ad-75d7-48ea-984a-eda662c25ac6", "value": "24:ItiyfyPsiyP+yPK9iyVyK3iyWyZlOiy4ytsiygyGiyNryNV2JiyUYyUOwiyoykLx:ib5VK9ViUIbwV0uIOw2LpJaGROUF/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769181051, "uuid": "77ff5501-e6cc-454c-a150-50d5c16398c3", "value": 3314, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769181051, "uuid": "455bb399-1ecf-4df1-9d36-58c7eeea8297", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769181051, "uuid": "64e6be05-e6a3-41ba-9a72-5fc67416c858", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "921f79a3-f830-11f0-a129-42010a9c0007", "comment": "Malware payload (STRRAT)", "timestamp": 1769154794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769154794, "uuid": "74b30e57-36bb-45fc-81e3-c8ec329f2e45", "comment": "Malware payload (STRRAT)", "value": "356e063ed68154f94af78af6dd0a7810", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769154794, "uuid": "57379402-1c2e-4e4f-9f37-1c8d6815df49", "comment": "Malware payload (STRRAT)", "value": "8a8e4f19a8961059e294a0c158d0126eca0cb680bab7111c9257616c03716ed3", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769154794, "uuid": "98f072c6-e359-42eb-bcfe-8217feb6b8d0", "comment": "Malware payload (STRRAT)", "value": "19d00da1a1ce4d6f201d738bed1b55deb16c979d", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769154794, "uuid": "2c28f10a-7160-4b38-aed7-447cdf88738f", "comment": "Malware payload (STRRAT)", "value": "842dc8caac9b6cbe7ff002c40e48a72936ce006b6204468812cf392563625a9ff54ff236dcabd0352d1e3c2cb31e9fe5", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769154794, "uuid": "101c9902-6797-410d-98dd-417c20526e36", "value": "T1EF24C0143A80507AE663A1B2785ED32AE471D4FFC24961D70FE3FC2EEC668452E167C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769154794, "uuid": "338b2808-7f5c-4599-9907-7bd144b317c4", "value": "6144:mqL5w72on4Pd/iqeCSeUIC35JJySV/tcQlQZA+OcsC:v2r4VgCCIQB6qdcsC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769154794, "uuid": "5bf133e9-8d37-43fc-9edd-2f5757fa36ab", "value": 211931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769154794, "uuid": "6533a727-d1cd-40d9-91e4-d70bdc9ee6c0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769154794, "uuid": "129462b2-2ca2-4116-afbc-7ef10729b150", "value": "Angebotsanfrage.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0726f209-f86e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769181189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769181189, "uuid": "b42f35df-9e68-4d2d-99ff-cce296517918", "comment": "Malware payload", "value": "77f670b244a8adf52c200986a72d8cd4", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769181189, "uuid": "5a166c45-8e7c-4ff1-b5ea-7d47603be973", "comment": "Malware payload", "value": "8af432d7a2658aeb50f30d2e8a8ec325bb6005e2b198a483d5a3451ef30c9e97", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769181189, "uuid": "bfb83889-241f-4752-bacc-3758b3988fc0", "comment": "Malware payload", "value": "c9e5d95a31801fa1c7113290642576e25e2e509e", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769181189, "uuid": "ee236e23-0be1-4040-bf6d-4573bc48a43a", "comment": "Malware payload", "value": "b285983191246702cdbe08746a43356f2b6800c6524b9bd0af1ed4af24c8796a8a98fbb56b115060a43da0f1d08d54fb", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769181189, "uuid": "c829e6fe-45ed-4f3f-a913-9306503aa316", "value": "T195D55B172D918DA9C0AED234A8B2128677717C080B7277D73B90BB792F377D4987A718", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769181189, "uuid": "ac4209b1-463c-4ec2-878c-9b2fdf79bd78", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769181189, "uuid": "9d972e97-0acc-405f-af1f-883fa109beb6", "value": "49152:S/lFhgRT558Yla2W6iVhfgpQhsFIzC32SdDloJ0wBMH+7qv0u9DFD9EQhsFIzC3R:SNGHla2N4qBY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769181189, "uuid": "1b21d8d2-2697-40a3-bf79-3efa2405679e", "value": 2912472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769181189, "uuid": "a9257c21-c7e5-455e-a470-b7b55f97ba90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769181189, "uuid": "e65cc248-db6d-4694-b9db-ee018a0f2e18", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f54eecb-f867-11f0-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1769178411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769178411, "uuid": "b85747d9-5302-41e9-a2a2-d8b092554fc9", "comment": "Malware payload (GuLoader)", "value": "f44340627736a77a236369e6b1e65543", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769178411, "uuid": "fe044a05-635c-41d4-a61c-b3d88044ffe8", "comment": "Malware payload (GuLoader)", "value": "8b490fc084291f3a7ee098f2621f87c57528294de2101ae1a1ec1a5aba228026", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769178411, "uuid": "406129fd-151c-492d-8c36-e386bc9a1e95", "comment": "Malware payload (GuLoader)", "value": "0cabc9719f3d588bfba162a8f80c5f07202a2572", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769178411, "uuid": "93185390-1a6a-4b87-ad47-90bd90bf85cc", "comment": "Malware payload (GuLoader)", "value": "c89b2fe690002a757902560ed192d21e50d8755c286609a620d769b9786e380858690cf395152f6e70b4a373fd619918", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769178411, "uuid": "2b09be67-952e-4047-bba3-ca6d6fab99ae", "value": "T14AA4E083F580D1D2D91C883699B34731557FBCB92B8D9393A348725135331C76A2BEAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769178411, "uuid": "ea89fa8b-330c-4ae2-8185-c280786e1abf", "value": "ea4e67a31ace1a72683a99b80cf37830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769178411, "uuid": "fd5b08e8-2ba8-41d5-804d-bb0f250dc32c", "value": "12288:XcODb7v0o8JvG5UFP+ibiucOTjjjjcjzjcjcjjYXDVtUp9XtSxA4szN/v7KMm1u+:sO4njjjjcjzjcjcjjghc9XExADNLKMmb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769178411, "uuid": "d7e2f308-4671-41ba-aebc-76ae80a839c7", "value": 488452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769178411, "uuid": "4327dda2-34a3-44c3-80b5-f9cc434e129f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769178411, "uuid": "28a2abac-c2d8-4978-8445-2abd6ee61fd2", "value": "PI-BDUIEWDW USD.bat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3f6040d-f7fb-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769132060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769132060, "uuid": "00a09f96-ae9b-48b8-844b-b3be283fb6b3", "comment": "Malware payload", "value": "22d7278b373116b964b31434e19c4a9b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769132060, "uuid": "c1f7a217-cec6-4058-989b-f438f788ce44", "comment": "Malware payload", "value": "8b68f40b47c8e39aac8eff7e8ea9fb3709b774469455faad2b60a0334b08f0f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769132060, "uuid": "94c2fe74-c155-4059-bb8c-c004c44d3b45", "comment": "Malware payload", "value": "2e4e897594ea14190f8ed78d1131eaee900e83f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769132060, "uuid": "cb02c1a1-9d3a-49cb-9e54-37266f22fcb1", "comment": "Malware payload", "value": "1e42e6e135a8f806ced0ab778cf129ad351579ed15bf0ce9aa1565899420d6606bfe54edf00353419c505301c3a60265", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769132060, "uuid": "77420f2f-213b-4cfc-a69f-2dad2c5bad28", "value": "T123A3825E7A218F7DF6B8C73497FB1B34A77922CA2A91C580D1ACD5012E2434D981FF68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769132060, "uuid": "ee098e53-6e85-4e95-805f-602be9d1dcc8", "value": "1536:fmdurU07J8MtqHxqGPkncW/RVi/wJz8H6xVRFOr4kp6QhIH:fma7JLqHxcncWZViTH6xVRFOR6Qho", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769132060, "uuid": "f83a2c02-d92a-49f5-93f1-039d270c493d", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769132060, "uuid": "31c89a79-7ae4-4ef9-8a6f-8b69c02b8cc1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769132060, "uuid": "89c0e034-6a80-4689-86ab-fb1e0e937bf5", "value": "tftp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae1533b1-f80c-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1769139379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769139379, "uuid": "201af93a-5c9f-4771-87b6-40c2db4eb8bf", "comment": "Malware payload (Formbook)", "value": "4abb1e7daa15535e62c9e2381fd58e5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769139379, "uuid": "03f1beac-b3cf-4e32-bc77-edbb0177a784", "comment": "Malware payload (Formbook)", "value": "8c36017fb562623b423d65c040cf67365367a8b271f375b91e69b4c942cd09da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769139379, "uuid": "7eeb659e-ea1b-43d3-bbcd-9779955f9c52", "comment": "Malware payload (Formbook)", "value": "2e1c22fdaecf728cad4ee00a0317c4c0b97bc3f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769139379, "uuid": "703aa703-44a2-484e-86a8-9fcd7015f726", "comment": "Malware payload (Formbook)", "value": "b5ae28dea35ba1f2e91cfb291ac627337634e2a3a644299a999bd4c453ff9a7f913c0009e1790c2d4feea8706bcdf159", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769139379, "uuid": "37eec5a8-7cb6-42ca-8002-4e51a033a14d", "value": "T13745BF027391C022FF9B92334F5AF6515BBC79260123A61F13981DBABE705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769139379, "uuid": "a1850ac6-4521-4a95-a77d-940e56f8e70a", "value": "279daa640d9140f9842860a738abd363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769139379, "uuid": "3191d149-9163-49d6-a55e-d1dfc9520247", "value": "24576:WqDEvCTbMWu7rQYlBQcBiT6rprG8axtx8KsXIchtS6gr:WTvC/MTQYxsWR7axtxXshtS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769139379, "uuid": "d8a859ff-523e-4e8a-8610-adb4e80b57d2", "value": 1213952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769139379, "uuid": "75383ee5-d01b-4f8f-8158-29f5bdd0a4ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769139379, "uuid": "cab51574-14e9-4d5b-a1cb-2e8b43b2f15d", "value": "PdaCreditStatement4333012.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77e3469b-f83a-11f0-a129-42010a9c0007", "comment": "Malware payload (CastleLoader)", "timestamp": 1769159045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769159045, "uuid": "475b6c66-a12e-4952-99ae-3d9e94064617", "comment": "Malware payload (CastleLoader)", "value": "de6a7813026a9c6cd44bb2504dfe8a30", "object_relation": "md5", "Tag": [ { "name": "94-159-113-32", "colour": "#84A36F", "exportable": true, "hide_tag": false }, { "name": "CastleLoader", "colour": "#3A5FB2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769159045, "uuid": "f412ad12-2c79-481a-a6b5-40c50af94f96", "comment": "Malware payload (CastleLoader)", "value": "8c8495c639d9d49226c6d868641c27bf812f4bac62ade62766c2989dd3b1b8cf", "object_relation": "sha256", "Tag": [ { "name": "94-159-113-32", "colour": "#84A36F", "exportable": true, "hide_tag": false }, { "name": "CastleLoader", "colour": "#3A5FB2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769159045, "uuid": "114b5d54-5336-4838-b56a-f12cc046c936", "comment": "Malware payload (CastleLoader)", "value": "71af2d2e7532f024612637723d39f5b1350430bd", "object_relation": "sha1", "Tag": [ { "name": "94-159-113-32", "colour": "#84A36F", "exportable": true, "hide_tag": false }, { "name": "CastleLoader", "colour": "#3A5FB2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769159045, "uuid": "5d509333-5607-4d47-babd-97100cd7b3a1", "comment": "Malware payload (CastleLoader)", "value": "008eb74d95ecf9faae1040c0c6f0f840789bb880d07e0145a532467c950ec7612317f8cbfefef36abd41cd419a035bf7", "object_relation": "sha3-384", "Tag": [ { "name": "94-159-113-32", "colour": "#84A36F", "exportable": true, "hide_tag": false }, { "name": "CastleLoader", "colour": "#3A5FB2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769159045, "uuid": "75483bed-6941-4e96-ad70-66cf9fb07842", "value": "T16AA6A570C9448374D4A252BBE62BA6CDB0AC7375071F36CB976809994613EECA338777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769159045, "uuid": "834c27d6-c890-4b91-9ddf-37260f8118e4", "value": "68097cb05c16231e5a0303eb481c5cd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769159045, "uuid": "e476d381-2da9-4b9b-bdf6-3685b5db16cb", "value": "98304:rNop7hyh+YED2cMoMjFjNHpzGmoRhlt/lsN3RENv/nVbdcqY6hJzS2iow8:xsi1CMRtYlrlsFelJ9pXioN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769159045, "uuid": "2999bda0-1ff1-4d94-8564-e8af376edcfc", "value": 9896240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769159045, "uuid": "1a6a5ccd-7bcf-475a-9365-0e0bf80b7546", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769159045, "uuid": "4d1dcbd9-8746-4cce-a280-213da9004b29", "value": "8c8495c639d9d49226c6d868641c27bf812f4bac62ade62766c2989dd3b1b8cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0abdb85-f7f4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769129156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769129156, "uuid": "6d56c378-ed6c-4a0a-988c-3606ac4d9853", "comment": "Malware payload", "value": "491eb99507115721134083eb6e214474", "object_relation": "md5", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "coordenacao2026-writesthisblog-com", "colour": "#ED4167", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769129156, "uuid": "378be3f5-00a8-4ecc-b626-24ad62de92b0", "comment": "Malware payload", "value": "8e08b30860ab2a807039ac2d6546e8f9d21455f143ff12e63b34343b1d7bc397", "object_relation": "sha256", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "coordenacao2026-writesthisblog-com", "colour": "#ED4167", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769129156, "uuid": "950bf0f9-2f07-4e15-a8d0-155331b35afe", "comment": "Malware payload", "value": "d24c3b3e342a1f160951d42a2ab1587237cea78d", "object_relation": "sha1", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "coordenacao2026-writesthisblog-com", "colour": "#ED4167", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769129156, "uuid": "d1f03445-50ec-41aa-8f65-6e0c61f650bd", "comment": "Malware payload", "value": "d9d076c39a28bfa4684c05ce06c087051e567e2d737b22296f127f245156a4c3560defe8930d4f6eaae9ac47b7f0aba9", "object_relation": "sha3-384", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "coordenacao2026-writesthisblog-com", "colour": "#ED4167", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769129156, "uuid": "ddd84ce3-09d2-4ee9-bdbc-fcf3b8e507ec", "value": "T1E207332EE03A8FBCD92F5CB8C9144BC95B145E6514870F2FA22074569E32DE935FC8B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769129156, "uuid": "ee4072dc-b90c-4b28-b3c2-73ec0f833575", "value": "393216:3mzuTWZoG6nkNM6qXHJhVncw8WLHmhWZhkgt6MdhdJ1q:3qokNJqXHDVcw7mAZhkPGhvg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769129156, "uuid": "18da591c-a7b3-48e2-95bb-48a1ee82976c", "value": 17244160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769129156, "uuid": "c6885e37-2cda-4583-a156-8757ec7f9283", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769129156, "uuid": "1d38504b-6f39-4b37-ad86-b35efcb31bed", "value": "installer2.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0de4bffc-f864-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769176906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176906, "uuid": "532e0437-53ba-4b41-94e0-75f2ee75c5e7", "comment": "Malware payload (Mirai)", "value": "f44152d444ab0ea36e93289fcbefccc1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176906, "uuid": "5c9d9b8f-5548-49b4-9c53-c37add7aea5d", "comment": "Malware payload (Mirai)", "value": "8ef49840fae854019ea3526b01f28e8d6e263f8cd71867264fe6b21dff139a22", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176906, "uuid": "fcf7f989-c1a2-4a7d-91fc-99e712728fa3", "comment": "Malware payload (Mirai)", "value": "9edbaf9dd114f2decd8a2f9ee6fb38ff708becb5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176906, "uuid": "f2ee6bae-825e-4f9c-b8dd-7c539fa3e7bd", "comment": "Malware payload (Mirai)", "value": "6961381b275ce82ffe773546589b9eb8ecc1edd2353843ed8b1f0733706073c41e25b358ed82e3c0a1bc33a9939338e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176906, "uuid": "f0b7f027-97e3-4285-aba2-1861e7c75a97", "value": "T1BDA3199ABCC1C212C6E0B1B2FB1F51CD375643B8E3E6B1478D19AB29674B8570E3B251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176906, "uuid": "3b8c24f9-06a4-4a2a-9c89-525d04c93a69", "value": "1536:PziyY7HkCF0UVh3p9N4K/cQN7I+4SelxTJyYjqR+u+rvh/b:P+ySEAn3CicQxI5DlxTnjqgLh/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769176906, "uuid": "50620197-406e-4c84-8486-4b67b1ca9224", "value": 98296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769176906, "uuid": "6fef846f-843e-4746-b257-b365a199e501", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176906, "uuid": "191a851a-bc34-4b2a-9642-099acd2ae566", "value": "jklarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb6d008d-f839-11f0-a129-42010a9c0007", "comment": "Malware payload (Loki)", "timestamp": 1769158809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769158809, "uuid": "bc106cf5-4ceb-4b3d-b2f8-1a22488c1c96", "comment": "Malware payload (Loki)", "value": "37f4ed360649161e73d7fe12ec120463", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769158809, "uuid": "a1ed0df9-eb23-403e-8d39-357600347b02", "comment": "Malware payload (Loki)", "value": "8f69af0fce0ccbacb9fac1d2ba551ff3982336700ebb59280c0b1b09a637c4f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769158809, "uuid": "baa7c6a5-f477-4403-88b7-40941dc9884b", "comment": "Malware payload (Loki)", "value": "336e7eac71e9ea293f9ff0c8c4cf890a32be4e28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769158809, "uuid": "c3139c25-ea01-450e-9664-522663a8093b", "comment": "Malware payload (Loki)", "value": "b688336675546c23c192c5b3d98c9014eb8c26dd43aac27fd42595403adfabf0e5c600e582dcb7cf6c1e607d02981d7e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769158809, "uuid": "3af4ce8d-d0bc-4824-b8d0-52e200d4d899", "value": "T148A32942B2A5C030F7B74DB2BB73A5B7857E7C332D22C84E9352459A14215E1EB7AB13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769158809, "uuid": "bdd669dd-0bc4-4f9f-a649-2c1afb0ad235", "value": "0239fd611af3d0e9b0c46c5837c80e09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769158809, "uuid": "c2fe11e9-acef-4df3-b531-7acd966f0f28", "value": "1536:6zvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqAIzmd:hSHIG6mQwGmfOQd8YhY0/EVUG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769158809, "uuid": "65af0b01-a49b-478d-a843-7cb8b5c3c9f3", "value": 98816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769158809, "uuid": "fd0b7368-0a71-483b-97cf-edf8670724e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769158809, "uuid": "d9256e9e-e1f3-42bd-9bc5-cf77888c2b34", "value": "37f4ed360649161e73d7fe12ec120463.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "952f20f7-f829-11f0-a129-42010a9c0007", "comment": "Malware payload (BlackMatter)", "timestamp": 1769151792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151792, "uuid": "36527fd5-9fd9-41ac-8700-ac6717378fd7", "comment": "Malware payload (BlackMatter)", "value": "0bb5cec1d3281876715e59743ee972fb", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151792, "uuid": "152de2d8-68d2-4725-81aa-757c4550ab30", "comment": "Malware payload (BlackMatter)", "value": "8fb06ea350e49fa9ef38c56e731adf6713a47c8de714fe55aee6519cfd6b4da3", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151792, "uuid": "3a5e445d-150c-4636-bcf8-b2023cba3f76", "comment": "Malware payload (BlackMatter)", "value": "86d0094007d38b3e7dd3dd4805690cb4ccdd19f1", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151792, "uuid": "0c03bb45-81a4-4b0c-9b94-5d1b81bf725d", "comment": "Malware payload (BlackMatter)", "value": "525fd21e7d08edd20e4af0594874e99b022ecae431000c125066b4bfebe60dc9767a8a7b4b3b4bda5089bf22026299e6", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151792, "uuid": "13602c2e-b071-486a-b0cb-7e02e59412c2", "value": "T19BE36D21F652D073C87718F12736B572F39E4D2C1AA96807EAD80F59BCA58232F05A97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151792, "uuid": "c7a27b4b-f8f7-4514-99c7-7d5093f30991", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151792, "uuid": "487f7b68-7033-491d-9cfa-f6a81631f749", "value": "3072:Q6glyuxE4GsUPnliByocWepZIoLVlbSkqITDig:Q6gDBGpvEByocWeUoLVZSFITDi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769151792, "uuid": "731bf0ad-2fb8-49c7-b28c-480ab757274e", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769151792, "uuid": "9eff62ee-ad8d-4407-b4bb-2d5c81c75711", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151792, "uuid": "6aba298a-d027-465d-8964-f12549135840", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65c529e4-f860-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769175335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175335, "uuid": "b9641ec2-f7ee-4e87-8cf8-959d5f20eeaf", "comment": "Malware payload (Mirai)", "value": "134ec40c13e202fb02e40a3838e14bdf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175335, "uuid": "098864dd-026b-4f4a-9b31-798e2bc4527f", "comment": "Malware payload (Mirai)", "value": "9085a8f120503029cbf923d9fc0d3791a64c8517bcbb1354f8e1d71e8fcd93ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175335, "uuid": "87c98002-241b-4248-8ed3-4f469d59893e", "comment": "Malware payload (Mirai)", "value": "13524c9f73a3d7c18f6e81bed959cf8cdfa318c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175335, "uuid": "45fea5a2-a8e4-4a53-9749-274b16af7306", "comment": "Malware payload (Mirai)", "value": "ad5e5309ec2c38aa5f54518dce1c2f96063716b3e7fdcab767a96095acab86eea7f1da2cd4f1777c9940f5d84dcd5669", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769175335, "uuid": "98acc74c-178e-4138-af1a-73105c5214ab", "value": "T196C3080ABFB11FBBD46FDD3345A90749289D560621B97B7A7A74D81CF24A28F06D3C20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769175335, "uuid": "cabdd667-ab7d-4600-bb60-c5ddb1692509", "value": "1536:Xr4wLpuvQukgm35/KmovxJJK3aH0UJqhYCRJbRc81OhulO/U+TXDZfqFX39wu7rX:XkCAFxJyEXsoiasM5qUlPRjs5/T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769175335, "uuid": "394bf118-53f2-4508-99eb-71a833b8fa11", "value": 121548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769175335, "uuid": "0320020b-aad7-4276-b982-6c0b032daea6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769175335, "uuid": "31d3e8b5-da25-47c7-8a94-915bd3c4bd1d", "value": "jklmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3568948-f82f-11f0-a129-42010a9c0007", "comment": "Malware payload (CobaltStrike)", "timestamp": 1769154500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769154500, "uuid": "9a6bdd68-e77a-4c65-88a3-43a4886a3f17", "comment": "Malware payload (CobaltStrike)", "value": "50fb325cd1abcd4a9dd6f524231070bc", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769154500, "uuid": "f31c671b-18ea-4c97-be59-16f994ebf254", "comment": "Malware payload (CobaltStrike)", "value": "92a3391aaa92bf4060918d5de3ddb13c863ba62a9db327ca9efdb20ad7b56bcf", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769154500, "uuid": "3757cb47-9210-44ac-97be-7b4aff23aaab", "comment": "Malware payload (CobaltStrike)", "value": "2cf080ac99eb4db984fe6e7a6db7d00d4e34b59f", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769154500, "uuid": "d81a2e9a-176f-4fdb-8907-79c466ed8334", "comment": "Malware payload (CobaltStrike)", "value": "9e5930a2ed479ffe75adfe6c5d40ca058cf6b72acd7e4bf9627a0eb33af521ce4ec64a52e87160d5eafeffa7aff90067", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769154500, "uuid": "7a5d3398-6c13-4878-9667-5fd6c051ce5b", "value": "T1A4161262D8DA44ECC81BE0FE5BDA9E66ECB734560F3457AF43F046362A275D0CEA6101", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769154500, "uuid": "0fc6a89d-afab-4223-8f70-df8fd174cd86", "value": "3d3988c381c216812ceaebe4fb051fc6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769154500, "uuid": "cdd47540-d275-4c58-9ee0-cb00a3435c31", "value": "49152:XUj8Yd1CFWz0iSUNfzzdnWUkz5ZY+D6kRT9dmebKBHyX2o/2HtAM4EjyWnimhvLG:Gui7rfzXklZY8qZJ4B2NAsyWimwyl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769154500, "uuid": "ba3973d0-7dad-417a-8877-c021546a0907", "value": 4252672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769154500, "uuid": "d316d1ae-0eda-4adb-ad71-716dc9b64e88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769154500, "uuid": "4705e520-2024-459b-bc81-de40934d7427", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c84d9818-f835-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769157032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769157032, "uuid": "cfa28183-48e4-4c0c-947e-fd4edce654d5", "comment": "Malware payload", "value": "94b7392133935d2034b8169b9ce50764", "object_relation": "md5", "Tag": [ { "name": "scpt", "colour": "#7EA46D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769157032, "uuid": "c21d162e-74ff-422b-b5f0-425328b4fb25", "comment": "Malware payload", "value": "952d0a1bf4a8e474ad043258e238d47753a5bb8ca138ed79d11e4cbd555d5fec", "object_relation": "sha256", "Tag": [ { "name": "scpt", "colour": "#7EA46D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769157032, "uuid": "c3e4cffe-b66e-43f0-b3fb-647e2bf16b24", "comment": "Malware payload", "value": "66a3ca6f0660d571b8ab2e95141b00a0cc7062f8", "object_relation": "sha1", "Tag": [ { "name": "scpt", "colour": "#7EA46D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769157032, "uuid": "55c7b9f6-b11a-4e80-b126-80e0539bd3f1", "comment": "Malware payload", "value": "a003ea0c713d54dd20a243aea8008176a0d34c91d6726ff7855631e6f2dc3086fa87fc4f606120866871c8f1fcfbf65c", "object_relation": "sha3-384", "Tag": [ { "name": "scpt", "colour": "#7EA46D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769157032, "uuid": "e9bc8aeb-c963-44c8-88f0-bdb3dfbab5cd", "value": "T10ED34B6A23E13628FD57B8F6C2CBDB7573B360245EA748056EC68FF9430C4619BD6224", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769157032, "uuid": "aee81625-d850-40b4-86d8-129e7e3639e4", "value": "1536:2m+f2ClMhQxGPc0C0I3FcAHR/sxC9OB3v5i7CnfCrd2d7LWUP08:wVGQ90w3FNHR/6C9OBo+fwdOWS08", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769157032, "uuid": "45080a92-0b77-4c84-ab2f-b750e5719067", "value": 136158, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769157032, "uuid": "b374a44f-8a09-4e74-8d8b-8371632100c7", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769157032, "uuid": "47eac4d1-3ca0-4bb0-a9c8-90d87a2679f0", "value": "EDD_Questionnaire_Individual_Blank_Form.docx.scpt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cebf093-f865-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769177468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769177468, "uuid": "6bc5b624-e903-47d9-9775-30532f03754d", "comment": "Malware payload", "value": "961260c84c160be2a8ea803f7f17c2a8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769177468, "uuid": "9836384e-69e0-41bc-9b37-518a2dd945ef", "comment": "Malware payload", "value": "972752b7d964009404f3c66662c31802f595b68bd1ced3dc462eb7fa110a2c1a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769177468, "uuid": "f0bde42d-ae04-40f6-9ab8-78e7a7a7b271", "comment": "Malware payload", "value": "2495134a4aebf374df9f03b67df6a4d55dc7997f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769177468, "uuid": "b86e576b-1f03-4158-96f3-8d120ca9a4e2", "comment": "Malware payload", "value": "311bd1d611a05f982f64748833a06fbeef0479f6518bc362dbdb498546265ccc2b30cada122a7999e513cf7962892d14", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769177468, "uuid": "77240cf0-a266-4102-9b4f-2f48e6785189", "value": "T1B0931856BD829B1695D556BFFE4E528E33032B6CE3EE7203DE145F2427CA91B0E3A401", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769177468, "uuid": "59c001b0-3f15-4582-803f-38706f1a81a6", "value": "1536:pqnShc1Osbxu403NCltyIBdLRx8Fc0v3eScxlVUEqKio3DRRaUVak41oRoQBd/2Q:5h6ru40d8tJLRYv3eHxPUENieRaUVakL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769177468, "uuid": "7de37fe4-5b75-40e0-ab93-17cb29ff057c", "value": 89384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769177468, "uuid": "1fb234cd-240f-4a30-aecf-138b1041d422", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769177468, "uuid": "7713084e-c54e-4be5-9ce3-af598b887e77", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c41d4f1b-f7fe-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769133403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769133403, "uuid": "f8b1c6da-f221-4477-b4ce-e488b80a02dd", "comment": "Malware payload (Mirai)", "value": "ef8e3e18aa6bdaa675b443dde6437f75", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769133403, "uuid": "bd8b368b-2763-4724-80ed-11b5b0685752", "comment": "Malware payload (Mirai)", "value": "974dfaab25bc4d94c689627e71183c128e6480f7cf1de13da329d4286a459dd9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769133403, "uuid": "9ecba12d-27ca-454e-acff-c1f0deb59436", "comment": "Malware payload (Mirai)", "value": "b1dbfa04db355cc5b3639d548dc8c92a838da932", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769133403, "uuid": "181e6714-884d-40a9-8199-f9dc31c5fd76", "comment": "Malware payload (Mirai)", "value": "106d70b0d284852f8a2055b8b80331861c4918c6b1923b2606a8bc51e9e90ff638b94f4f245cd6e1dd4012007be1c62c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769133403, "uuid": "bf801e86-1f67-4232-ac10-e2e17137b493", "value": "T1D1531985BD82DA13CAC4537BFA5E42CD3726279CE2EE3213DE155F6032CA82B0D7A551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769133403, "uuid": "800b0ec3-47d8-42a6-a1c1-5882b3afd9b8", "value": "1536:tXU9w5YknCF8CLCLWXS1n9f/JPz/rQsBF:mOnCjU93VPQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769133403, "uuid": "304248ca-8254-4482-97b9-338d4961e453", "value": 64296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769133403, "uuid": "77898ea4-f898-4a0a-9d56-9b99d2b7d54f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769133403, "uuid": "88d4d6fc-e0d2-4d4b-9a51-f08e24db0076", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fc11d7b-f864-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769176909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176909, "uuid": "350e0d00-01ac-4fc3-83bd-10f6b72cf370", "comment": "Malware payload (Mirai)", "value": "c4e0a87b7e6559d78d474d55a566729b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176909, "uuid": "9ed59508-662c-42f7-8603-1d78bdb301f5", "comment": "Malware payload (Mirai)", "value": "9965150270d520b55bd17882fe39997bc5365b150667ba664662a5a50732a310", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176909, "uuid": "629cf5a8-59bd-4c89-accf-7e3b375d3c79", "comment": "Malware payload (Mirai)", "value": "68fea84e9b7452dddc141f61df5df7631c50c356", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176909, "uuid": "b1189f97-c052-4655-ad48-e4d89ef60cc9", "comment": "Malware payload (Mirai)", "value": "7a7ea20a68ab180ef98c518e42f25fe0980670323e79fad12c5b522a55f34ca73a2016e93d4a7334d18cdc87e799b137", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176909, "uuid": "feeef52e-8da1-4946-b237-f64a0e973317", "value": "T15E93390273694447F7A70DB1283FBFF157AED5A121A0A285685FDB0F8135A32158BFCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176909, "uuid": "ce6b07af-adfd-4a53-9ba8-2a0d6db60faa", "value": "1536:yPhFH5OjRy/6oSGkrLYIHiv21mCs7mn9czJLdCdgS9pwd01GLsJj5bE:iOjw/UeCs7EUJ0uS9ah654", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769176909, "uuid": "672276da-f255-462a-870e-8f3b3a03e8e7", "value": 89080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769176909, "uuid": "5f15eb80-d87c-4870-9391-7a0595bf7cb4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176909, "uuid": "62834280-3dcd-47b2-9e98-5d59f0ca8230", "value": "nklppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74e220c8-f829-11f0-a129-42010a9c0007", "comment": "Malware payload (BlackMatter)", "timestamp": 1769151738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151738, "uuid": "a1bff07e-0303-4df5-9fb8-e0af53842632", "comment": "Malware payload (BlackMatter)", "value": "85f0d5bfbad1d8aaf48b90a19bd8794a", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151738, "uuid": "1c5f8918-51b8-43fe-aa66-24aba3f87e0b", "comment": "Malware payload (BlackMatter)", "value": "99ac02e76e50e0a053e19611e97965105796f0da7fa1959e59d7b5327869e19d", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151738, "uuid": "ab02e796-a924-4669-880b-35c0a302c970", "comment": "Malware payload (BlackMatter)", "value": "4cc311086e6d9a925c04cd28d0791af709368ae4", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151738, "uuid": "071d03d3-376e-4217-b3e1-2c4b8bf2fbe4", "comment": "Malware payload (BlackMatter)", "value": "1717a89da7722c171b013ca0623bac9831324799d5b915384ec29774608dd6a96216ea3b14bbc4644fa542486b944b9f", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151738, "uuid": "99c62d6e-82c3-441e-8a92-e151f9b906e7", "value": "T114E37F21F212D0B3C83718F53736B571F39E4D6C29A96847EAE80F99BC648232F45997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151738, "uuid": "47704f22-5b88-4de8-b8fa-e8811dfdb018", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151738, "uuid": "d18a0c9b-02c5-4d9c-b054-79c85c1fcb29", "value": "3072:16glyuxE4GsUPnliByocWepWRhc1aJS6t0:16gDBGpvEByocWewRhc1aJb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769151738, "uuid": "1c53ecfa-38b5-42aa-9b19-98c89380b4b1", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769151738, "uuid": "381aa2be-33a5-4fe8-92a2-18a5212e48e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151738, "uuid": "d8c1c33d-8468-40b0-9d9b-24b933cac7a0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caf0d7da-f855-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769170780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769170780, "uuid": "530e62e0-c17c-4adc-a9d3-d50ad9231c61", "comment": "Malware payload (Mirai)", "value": "9cd2f18097c599ac4b0ca1757b774112", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769170780, "uuid": "1f8da108-f857-4502-8ba6-0ecfbec84098", "comment": "Malware payload (Mirai)", "value": "9e273b9c028bbb7ac356293f29fbd69f65785404aeed6cf53a11d172801577fb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769170780, "uuid": "913764ce-fc45-4c1e-8f36-faa4a1333c7e", "comment": "Malware payload (Mirai)", "value": "69f7c3f896ee623d065b7fbcbb1a80fd0e42fb64", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769170780, "uuid": "f2de2e83-a137-457d-93d6-6c775cdbd057", "comment": "Malware payload (Mirai)", "value": "68151bc14e1c775bc3b0873eb4ede98d44d82dab2af9cb49b2f021d73dad66f7cf8bda22a221bc9d1ae56c3e9c39f745", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769170780, "uuid": "74152ec6-ebfc-43db-85ba-a67fff122a3e", "value": "T15B939D11CCA55EE8F03AAD3020FADABB4317E445A90B6CB73C4686655057E8CF4B7BB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769170780, "uuid": "a23719a8-60bd-48c1-833e-954a933ffa7a", "value": "1536:gB4sGuJEEU+otrkUyEhGEmtZKJIYLVoR+7iO3E2qC2dYQJ/b:gB3GO++otrTyE9mIJIL2qTyK/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769170780, "uuid": "75fb383d-14de-4abf-bc64-2cd134daa174", "value": 91344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769170780, "uuid": "35e2c499-2670-44d9-ae36-ba269eaf919d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769170780, "uuid": "d5113572-b311-4106-9220-070c399f06b2", "value": "jklsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8273bb6a-f846-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1769164216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769164216, "uuid": "12882cdc-cc7c-4193-bc84-3199dac26a93", "comment": "Malware payload (Stealc)", "value": "5c533aae3a56d6854f50d652dc1abff9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769164216, "uuid": "aa1b2ae8-8e85-4808-b006-8b24eabed8af", "comment": "Malware payload (Stealc)", "value": "9f0567bea2a5fa3c9d15755c0edfd78e5eccddd1e0a7bd43df11a0ce9862e1cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769164216, "uuid": "5e58ef62-8dbd-4195-adfd-1732100a89de", "comment": "Malware payload (Stealc)", "value": "4543b4e464819dbcf39059950c4da5f7a8a4f2ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769164216, "uuid": "2801131f-8c57-42d9-bc69-5e426d609ab5", "comment": "Malware payload (Stealc)", "value": "573628dc5b23067647f8655a1d5924cf11b3e5fd1a0ae14932a2e0dbed920afa7a8b0cd7ac18c9e4a5872612f219a351", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769164216, "uuid": "d541762b-9e3b-4959-84cd-de52032eaaa0", "value": "T1C6C66A47B89115B9D0AED2328A6692527B70BC990F3163DB3A60B3F82F737D45E35318", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769164216, "uuid": "f6c457cf-c565-4514-bfc9-4a7fbd60ebab", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769164216, "uuid": "a0a08623-76eb-45b8-b022-aa6e0863294c", "value": "49152:y7sR5lKve3uurb/TMvO90d7HjmAFd4A64nsfJ+/udfCpGd/X8mMyHxoloYg15Q6o:C23uvGd/X8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769164216, "uuid": "0fcbe2d0-e62e-41cc-9a25-601bd0d76abe", "value": 12000000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769164216, "uuid": "b2a263bf-e4c7-4782-ab31-1bffa8964dc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769164216, "uuid": "f37a1bc1-04cd-40e5-ba7a-570923fd0219", "value": "InstagramBot2025.109INSTALL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "414b37de-f89a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769200185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769200185, "uuid": "92a2273d-aaa7-4f48-b617-f594ce1ca06e", "comment": "Malware payload (Mirai)", "value": "9cf4afd0f45cdd3d359bcd2d64d80ab4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769200185, "uuid": "32134c68-9905-4dae-a9ef-3ca0344d9abe", "comment": "Malware payload (Mirai)", "value": "9f6262cc6c12b65155a6a0849581b286042d63030f8988b1e415c8db67f46f83", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769200185, "uuid": "224dc420-9bd9-4f46-ac9c-defd72b2479f", "comment": "Malware payload (Mirai)", "value": "61350d630052c177d7a5a5b42913e11f63053a80", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769200185, "uuid": "b8ec87e5-9a53-4fd0-bba6-ab4727a98791", "comment": "Malware payload (Mirai)", "value": "d9a3c59c06f4d41c1bd7ddfd460d2730b7cb2a39ba58e3eb33a372bdcb8f6d4d303a63eeda6e3133b9636276b01065e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769200185, "uuid": "9e832bf1-7fc1-42ae-8439-f1587c4c92bb", "value": "T10D142A26ED91C0AAD497D1B86BEAC0A2F330F8F40321764F33A969352E75F545B19387", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769200185, "uuid": "7072acef-aeae-4b86-93fb-804075b55269", "value": "3072:3l6T27w1JtH2ouEmxPuevQBOSWhXgnClUMC+EbTus/jyFEmMAM1wKj5zG7bJ:3gTIYetPFaOSWeCW+EbKomMAM257bJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769200185, "uuid": "d93c7b6b-4e07-4924-a4c8-22381260da0c", "value": 204824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769200185, "uuid": "d2d32888-1358-4019-bf3d-13cb0add243c", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769200185, "uuid": "a78177d6-a032-4d88-b4f9-5fcf9cc7ff5d", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c34fd91d-f860-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769175492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175492, "uuid": "a517af71-e4e8-464c-85d8-0b9bc4ed16cb", "comment": "Malware payload (Mirai)", "value": "6dee06cb749ec2de813bd2fa35573a6d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175492, "uuid": "eeb3ba72-cae6-463f-bec0-5ca14f016b7a", "comment": "Malware payload (Mirai)", "value": "a0b7ffaf3735bee44b4ebe927e18768a8a7d32696a1657b46fcbcb56a2c508f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175492, "uuid": "5c20a5b4-b361-4d79-a140-cd71c313b7fe", "comment": "Malware payload (Mirai)", "value": "8a0ecdc7dcbb0fc5530a2e792e61a2a812374ed2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175492, "uuid": "34e86ca6-21a2-4427-836f-9107ce009ae8", "comment": "Malware payload (Mirai)", "value": "093ec7e035fe011e02f08efbded9247340bfcf5925c411116ae2db8cab7d3295f4c538cf7863cb917e75d3991ab7c1bf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769175492, "uuid": "896e963a-90f6-49f7-8291-2bfa9f162990", "value": "T12FA31CDABC818B11D6C166B6FE0E518D33134F78E3FA7213CE185B2D674A86B0A3B545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769175492, "uuid": "6d8924be-6627-45bc-8304-8196ed100774", "value": "3072:7HTrSBxz+r+EeBfM2PbhlK1YICyH4Asm8fqNmMz067ant58gR/:I+8PPjK1YICy/smfNme06GnHb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769175492, "uuid": "49c664c5-10d5-4973-b452-59617d83dadb", "value": 100788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769175492, "uuid": "8f3c0716-63a1-4ad5-941d-74b5870d1a04", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769175492, "uuid": "8b822993-d3f3-476c-8508-e42167932c33", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "645ed18a-f860-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769175333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175333, "uuid": "65e381de-3831-47fb-aa1a-daad40e64884", "comment": "Malware payload (Mirai)", "value": "607336f2ab873bd36d0373c179b12297", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175333, "uuid": "9c046ebe-a4c4-4d50-9477-6dac754713e7", "comment": "Malware payload (Mirai)", "value": "a119646dc1aba58da5e34dc54280e56b19ce1a7439dc5c65d031fdbedc1e1b1c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175333, "uuid": "a4264633-5b28-4a54-95c8-1f0feb1c6623", "comment": "Malware payload (Mirai)", "value": "c80abdba641aee486fb0ee0571bf17dc9b32fe53", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175333, "uuid": "7f38e398-9304-4e6b-b9d9-93eeb2549930", "comment": "Malware payload (Mirai)", "value": "6b507ca71e431ac449ae7fe907679a85d9497146a379494e3c0add446e95b53542996228a49201ebdc7f8ae45f6aaf02", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769175333, "uuid": "0c5df404-7e7e-47e4-ba9c-4615ec6bff4a", "value": "T17D432A85B991C612CAC46677FF0E42DD771B03ACE2EE73039919AF64279B81B0E3B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769175333, "uuid": "94c55501-3264-4d9f-ab32-09bf713adc1e", "value": "768:r0PSkoH4fPYa6dbu6Qk3FuYSsbjQ3t6NO6jlQhsWI7ashZixUDS6lcgkFjxmkvRD:aHYxdbB6YQ3t6gK3Bb99kOkvR/b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769175333, "uuid": "1a64a08f-bd03-456f-adba-79bb786d1a34", "value": 58580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769175333, "uuid": "63353a92-d674-48be-bf56-1699f7865b7e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769175333, "uuid": "91c0c07d-691b-422c-8dd5-2055897e75ab", "value": "nabarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94d12db0-f86e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769181427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769181427, "uuid": "6eaad830-4d21-4e51-851f-0b4ea7bf24ac", "comment": "Malware payload (Mirai)", "value": "5d0c7d6906ad5956b88a7bce15f86797", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769181427, "uuid": "57118a21-cc4a-41be-9315-115bd084d732", "comment": "Malware payload (Mirai)", "value": "a1bb2a66ee3cea8a67837b69739b28b29053e46c48b0511ea437b0ae4fd8f40a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769181427, "uuid": "769687f3-1589-44ee-8c7d-b3dd247ff72a", "comment": "Malware payload (Mirai)", "value": "ccc8ca7d675c7522d1bd6a836fec9ba8d13d775b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769181427, "uuid": "bebb0c9b-fe5d-4616-ad00-1d89f49142a5", "comment": "Malware payload (Mirai)", "value": "65b2f623c08d9511cee95943962b875cb754533edc0547dde595ce86fe1b7502faa31bf92f0be98e05c7f88f85087cb2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769181427, "uuid": "3bdc004d-3e42-41d5-a940-55f3ea56bbb9", "value": "T1FA042A45EA404B13C0D627B5FADF42453333ABA497EB73069528ABF43F8679E4F22905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769181427, "uuid": "50d26115-74cb-4f09-bab0-27877d2a3d07", "value": "3072:jr/ds0izlfERak4abYFyiskN2vXCUBpxY/hJjogM/RIWqiF:jr/alf894abYFybk4NBTY/XMgM/RIWqO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769181427, "uuid": "1ca245b7-94ed-41ba-a505-bb6f738eaff1", "value": 179813, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769181427, "uuid": "9140f02b-73e4-4839-bfc8-69e19c3fb21a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769181427, "uuid": "ec1d4024-d038-4994-82bb-1c69fdf50905", "value": "bot.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77a180e2-f862-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769176224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176224, "uuid": "db5aa8ae-eb52-4918-a172-8570a9b92e66", "comment": "Malware payload (Mirai)", "value": "bbcbc7e040d1f8f60a7deba31926041d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176224, "uuid": "947667a8-9377-4428-9c20-dfc45c29ce0f", "comment": "Malware payload (Mirai)", "value": "a258215ef6aeb452aab3bef0cc7650f8f0905e80f68a3b5b439a105ca43cdeb8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176224, "uuid": "ba88b316-c9c4-44d7-a948-81fd86093460", "comment": "Malware payload (Mirai)", "value": "46d6b5929c7d71e874c80a0bf17d65012f30af7f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176224, "uuid": "bee6d692-3b6c-4b70-9b9f-d22bbef500dc", "comment": "Malware payload (Mirai)", "value": "bb25ae2c24652d6be36f92864e66111b435a0b37aa2cc4b6b3b1003c784885c8c134d2063ae5492b194c11188f1cd37f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176224, "uuid": "cdcb718d-96f4-4cd3-b02f-de89a11500d5", "value": "T1DEC3080ABFB11FBBD46FDD3345A90749289D560621B97B7A3A74D81CF24A28F06D3C20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176224, "uuid": "e5485ad5-17aa-4f98-ae3e-58df87360fc7", "value": "1536:Xr4wLpuvQukgm35/KmovxJJK3aH0UJqhYCRJbRc81OhulO/U+TXDZfqFX39wu7rC:XkCAFxJyEXsoiasM5qU6PRjs5/T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769176224, "uuid": "2bf677e4-6401-4c23-88af-f8a47450967a", "value": 121548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769176224, "uuid": "f801ca4d-cb93-4c64-a4db-3eaca8db35cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176224, "uuid": "83f88999-d552-43af-af5c-9770e4452877", "value": "splmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e844a29-f829-11f0-a129-42010a9c0007", "comment": "Malware payload (BlackMatter)", "timestamp": 1769151674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151674, "uuid": "f38e73ab-62e9-4e1a-9c9e-05c97fdb55f8", "comment": "Malware payload (BlackMatter)", "value": "062c17287630f6ebaf5fdfc4119a82ee", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151674, "uuid": "348a6299-5ffc-42a8-b2f5-46948d1b1bcc", "comment": "Malware payload (BlackMatter)", "value": "a28e55a948927ae556de391674d88cde33a4ad9700f7e5e21a94d8d3755ebe70", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151674, "uuid": "96a5b450-6195-4542-9e3d-370759da6c81", "comment": "Malware payload (BlackMatter)", "value": "3f1b554aa8e43c122e5cac556225f5ad379cbfc2", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151674, "uuid": "60dff889-0075-42d3-9790-2be12876c578", "comment": "Malware payload (BlackMatter)", "value": "230c385370a283bff64c4f793c6f2a2e018eb947682827c54433f6ee55a8364828bd5ae2efb28eb8e3647ac18be12a11", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151674, "uuid": "5e865985-b6fa-4e43-a06f-dbd7b7f45a77", "value": "T127E38E21F213D073C83718F12736B572F39E8E2C19996947EAD80F99BCA48136F45597", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151674, "uuid": "7fafcbc3-e776-4d45-acb7-ca26a16c35d8", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151674, "uuid": "4d9d9f90-5285-44a7-b23a-fad723ee099d", "value": "3072:m6glyuxE4GsUPnliByocWep3TkRhtN5mv0ABLunq:m6gDBGpvEByocWeZARTm8Ad", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769151674, "uuid": "39eeee18-18ba-401b-ada7-ccec7486a8c3", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769151674, "uuid": "ce53575a-8df3-4ab8-aa90-36539f1e09ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151674, "uuid": "e59fb774-94d6-408b-9af3-c57d54dc3025", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d74bd99-f863-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769176556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176556, "uuid": "18e90eed-daf0-4a50-a2d1-bd42f2a01e7a", "comment": "Malware payload (Mirai)", "value": "78cbc635fcff7f86dd390ba0226be016", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176556, "uuid": "c2f8cfa3-b0c0-47fe-a761-1cf82f95dc9d", "comment": "Malware payload (Mirai)", "value": "a30667d7e0767a6ddd21bcb4e6e367d243c5dd03cfd9fe0e7c34e0b80a2d38e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176556, "uuid": "74cd6eed-be32-4f2d-bc85-f36be59ccb76", "comment": "Malware payload (Mirai)", "value": "05c3b081061c988f30d01169409fa30fb28614cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176556, "uuid": "516bfc7d-b3e7-44e2-8f89-ae1304d7d282", "comment": "Malware payload (Mirai)", "value": "0190ba30d266b057e33a9495ea8db90d84fc0e8d474ce8e1ffea9cefc533f229c295fe1b18bf3cfe1bc6478db1c3edc0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176556, "uuid": "77bdc207-49b9-45c2-8105-3c4b7dac31f9", "value": "T15A833AA6B400DC7EF85BE2F380470B15B324B7E54E52AB277627FD27DA2D1681C16C82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176556, "uuid": "e22a6ddf-3c79-48e7-9111-d053d6f10065", "value": "1536:0SZp5GJPX8uv/hEyv2OSRfb2spMKuIRakPe4tJL89WTNS8c8HUGuSy:0SZp5Oss/hncyuRlVLKWTNSZGux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769176556, "uuid": "6a355f75-9906-4062-8766-69d51012ea57", "value": 87240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769176556, "uuid": "5a4f1914-e83b-4b02-98b8-8c99fb1f8504", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176556, "uuid": "16becf79-804a-42f6-ab72-74de5ae2da56", "value": "nklm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aa0b068-f844-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769163344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769163344, "uuid": "a081c621-22fc-4b10-9b0e-19485ce1ddf4", "comment": "Malware payload", "value": "4d4220a0f130330bf218e0c84bc85664", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769163344, "uuid": "b2409721-d9a0-40be-877d-49cf7e782809", "comment": "Malware payload", "value": "a331642ac4a27b9d52ba2af71302a9b5dfa11f665625826c3fc1110c1b8cded0", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769163344, "uuid": "488960d9-39ab-4b04-8701-a62e55d47b26", "comment": "Malware payload", "value": "9dac1918054f61805f1c558a2d81ee56e51be846", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769163344, "uuid": "4f63e472-b27f-4198-9ce5-65071b6dde31", "comment": "Malware payload", "value": "a6b03451d701e2b40a532f2bda588eda45a46b8048ad5eccdcb09beadd434c7023f50bac6497159321efa57fdc4920a7", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769163344, "uuid": "fc506611-60ba-4c4d-b6ed-a51c098ff095", "value": "T132E29D78735059F1266703ADCCAEE8AD277617738887A88CB0EC2BC61F63339DA55841", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769163344, "uuid": "ca031f5d-9b4d-44e1-9cc5-94bfbe422405", "value": "768:zOzJc/EPjhvstkWl54XUdo629CN08G+zyAmB3ZtnZb3iCbEDx:zOmELhvstB540o62gl4Amb+Fx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769163344, "uuid": "5cfe3a35-e5c8-4042-b12b-28c9d7cce91f", "value": 31722, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769163344, "uuid": "558c7843-2d2b-4e5b-85a1-15ea35d73d8f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769163344, "uuid": "c20c3050-3c64-47bd-bf6b-10f0ac24f30e", "value": "ssd.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65531c7f-f86b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769180059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769180059, "uuid": "e58f9bac-2040-4b36-bda6-a621ba96fec7", "comment": "Malware payload (Mirai)", "value": "0a38175408d81f57aa80dca2b6f8b545", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769180059, "uuid": "9e576259-e8ee-4580-be4c-006eadc8f7e2", "comment": "Malware payload (Mirai)", "value": "a3956bc5193f534001d1dc105d8ff4344e2b0c20a143d70083f2ea8077029787", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769180059, "uuid": "2abb0991-1c4a-43c5-a590-17ad7d24cb2d", "comment": "Malware payload (Mirai)", "value": "8ca441510ae08137b3b94ce54d9f6c7f1d5af7c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769180059, "uuid": "e8e21681-6d5e-4820-a1d1-40d81c45b820", "comment": "Malware payload (Mirai)", "value": "b32ad908a786131f639c2bb028b9edb3a3f5bcb9e23aab6917ae829a9fe51b8ff33b7b3ba7b021ec653cc71db99ce42c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769180059, "uuid": "819a0639-3be6-4be0-a0bc-d4a292758f4d", "value": "T18B935B92B400DC7EF81BE2B780530B65B224B7E55F426F277627FD63EB2A1681816D43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769180059, "uuid": "c9f8aa64-b75b-45cb-b4d8-419d4015001a", "value": "1536:g5IfhJ3bcd8pAddavFflBVhkHSvlmtgkeHF9XBmxwYa1OYKX6eZTx0udFkPh7yJQ:g5IfPuMAdQvNpCyDgx18WMtQj4rGuuC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769180059, "uuid": "2ddfa1f1-4e01-4006-b234-a588ccc4add3", "value": 91952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769180059, "uuid": "b14802cb-1a5a-4bc8-89aa-94ebc35ced35", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769180059, "uuid": "dc6a5f70-4d6d-458c-8db8-4ac87859692a", "value": "splm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a24c5ee7-f863-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769176725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176725, "uuid": "1d3fcccb-9ca5-4a03-978e-e817ccadaa1b", "comment": "Malware payload (Mirai)", "value": "a9c8e1aa2907dc36e3669a7b32afd9e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176725, "uuid": "8560604c-73dc-4ddd-b579-abe89dc53e97", "comment": "Malware payload (Mirai)", "value": "a50c71757f65544bfd75080610572672faa4d47e89c1ef2eb91c107f3b7044c7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176725, "uuid": "0888b3c5-b357-4217-b8d0-27d9e5b0e79c", "comment": "Malware payload (Mirai)", "value": "25ecc75a5f671acba1703de5a3ce2a7e2f4f6ef3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176725, "uuid": "b9b3e5b8-3ea6-44f6-b3dd-2e96f13dc7b9", "comment": "Malware payload (Mirai)", "value": "9b494b520c73d56e2026d7c546017b17d9fc3ba048b419b5380bf625f1b7e1ca0cf0ee127cb5b054b41af8383579b0a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176725, "uuid": "63b3579d-8e99-400a-bddc-f413d9e292fa", "value": "T1E2838D12CCB99DA8F07A3D7010B9CABB5753E549A90B6CB73C4782650017E98F4A7BF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176725, "uuid": "43b87592-60a5-4b8a-b5a7-59bcefc3f5d6", "value": "1536:I24NeYIKvEd+L//rkZVAhJJsI8JtLuYPhHuKqBC/HFlN5b:I2KeZV+L//rOVAz6vt3xqBOlr5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769176725, "uuid": "2a833306-85d4-42b0-821b-5cf44b227b6f", "value": 84756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769176725, "uuid": "3f1734c2-0a8c-468d-ad52-f18a72557951", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176725, "uuid": "ff485c2a-5ba2-4093-952d-82342ee61b06", "value": "nklsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40f8c150-f85c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769173555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769173555, "uuid": "9aedaaff-80d6-4bc3-a44b-0bde0c9ec84f", "comment": "Malware payload", "value": "d79af5a32626f2f746affba43c4ff72f", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769173555, "uuid": "59fa7381-b39c-4a9b-8374-e20acaad9fc7", "comment": "Malware payload", "value": "a518c38dbd7c4e546db22707970c534d78daff8bd30852eeb8650398d7da1f3e", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769173555, "uuid": "21af4bba-0de3-4b42-8c53-e57f9433d3a6", "comment": "Malware payload", "value": "78624814ac9b9dc8ea6c75bd43be47fba38d123b", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769173555, "uuid": "1acaa423-7013-46bb-a1c9-9c3923684980", "comment": "Malware payload", "value": "ac01c784daa648a68b2eecee1ffdf8bd09e536533936792bd366d92d8f8145bbfa6931c52f351a4d28a28de58844bf42", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769173555, "uuid": "f01f9cc6-abe3-4a07-adc2-36fef377b964", "value": "T19BD56B132DE5886AC86ED238E8E24186B770BC080F7273D36E907A792F737C45576B59", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769173555, "uuid": "4f1d4003-09d4-467c-a87a-7ea96f87d21d", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769173555, "uuid": "1d8728c9-42bf-490b-929a-7d1db42e66d7", "value": "49152:9w3fU1aTLHj0C6uKZMLdj/RyYvZUUiScBQulwXq0:9uQ3kt60", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769173555, "uuid": "e49e666c-e0dd-41bc-a7f2-dd268e3d872f", "value": 2834648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769173555, "uuid": "8bca17e2-4050-4461-b745-d5d5266991bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769173555, "uuid": "85e1c6f4-5d8c-4719-8b50-7f63a25fcc13", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c57c8351-f895-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769198259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769198259, "uuid": "d8d6ab86-7bf6-4928-9da9-e6d2f927960e", "comment": "Malware payload (Mirai)", "value": "e6a4b2ef3754ad1d66660e96db67f31c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769198259, "uuid": "b695dbf6-8454-4e38-b5ea-0b4bf0af8118", "comment": "Malware payload (Mirai)", "value": "a5313fd8042da2e3e9a9c63a3bfeca153116d9e4ceff2e055beeb7f931a36644", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769198259, "uuid": "1668b9ac-deac-44c2-b35a-44813e62ba5a", "comment": "Malware payload (Mirai)", "value": "41fab3b3405809bc27f12dfc2c84817009e6565d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769198259, "uuid": "a5c56ca5-2966-4d9c-8309-74fab4825564", "comment": "Malware payload (Mirai)", "value": "a39719ffdb9d8e2e481f6c2af7736e4085ab1e59c990faf911649cf6343b920cd73b7a4fdf51d225646aac9fed774a61", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769198259, "uuid": "e7bc89d2-b1f2-4c76-bd27-6c2f84d422c9", "value": "T1D6A31300A165FCF8FE019E7766BB50B5A217F949502BBAC7F109A78C1ECD2786326D42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769198259, "uuid": "3d46e0b0-d607-4e60-9dfe-de5422776cda", "value": "3072:O5zPSZRN6RKkZtcyrPv8e1LaXvLhygoSR:+z4K3BUR/Ik", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769198259, "uuid": "dbd61346-f0d1-4bb5-8e03-8bd10ccd5e6e", "value": 103740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769198259, "uuid": "de21ace5-aef8-4ba5-88b7-4f03d8605eb1", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769198259, "uuid": "ab6dcc47-88b6-4b12-a9e2-7421b9029e08", "value": "armv6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a8434fb-f82d-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1769153412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769153412, "uuid": "3840900c-ccd8-401e-8fc3-56322052fb6c", "comment": "Malware payload (Stealc)", "value": "18976f34847b41b204d1ea6019dad165", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769153412, "uuid": "e1045f25-a0a0-4d84-830e-0b183e9dc203", "comment": "Malware payload (Stealc)", "value": "a5870b765c6fc83f992d149e0f9acabc4fa8e66f23d6820f3ac46e9b9b4738c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769153412, "uuid": "2d77c132-9a9e-4f64-b336-71e74d6b05ee", "comment": "Malware payload (Stealc)", "value": "081b2d022e16b8da009cf5462a738b44ea1f5e80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769153412, "uuid": "4b6fc22e-00d6-477c-b71d-0d31961973d3", "comment": "Malware payload (Stealc)", "value": "14bee1f6e99759a42d77bc3fd48474e864f5407c22e3ac0d78f6791214a049269bcea019478cde8b00b04f43b79466ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769153412, "uuid": "acacd4f6-6b0c-4ba5-b3b2-35f6879d80ba", "value": "T158B56A47B89115B9D0AED2328A6692527B70BC990F3163DB3A60B3F82F737D45E35318", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769153412, "uuid": "260e8134-48ad-4376-9832-e8a995454c4d", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769153412, "uuid": "1b0cbedb-5baf-4d4f-bdcb-84eb4ec02116", "value": "49152:y7sR5lKve3uurb/TMvO90d7HjmAFd4A64nsfJ+/udfCpGd/X8mMyHxoloYg15Q6o:C23uvGd/X8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769153412, "uuid": "37706143-fe94-47d0-b1db-dd8a76972c10", "value": 2293760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769153412, "uuid": "bb5a113b-f3e2-4ed3-9933-4e7b82e05bf5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769153412, "uuid": "d5dd0fa4-9d39-47df-a6a2-e18b75e46f82", "value": "a5870b765c6fc83f992d149e0f9acabc4fa8e66f23d68.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45c6897a-f82b-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1769152518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769152518, "uuid": "3419f0d7-fcc2-47db-bb02-0cee8eeca182", "comment": "Malware payload (Stealc)", "value": "31d5dabf2040669581e6c27268c278c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769152518, "uuid": "df6ca481-6510-4a00-af8a-bdd755632c9b", "comment": "Malware payload (Stealc)", "value": "a69a5586f44e36c4ad7f1c64c8157934c7b02bde63a59fa2f337b64b13a6b26b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769152518, "uuid": "83dfd8c7-5e8f-452e-947f-465869292b2c", "comment": "Malware payload (Stealc)", "value": "3dabd3c7f4be26bf77d41bd1e16d805942274f1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769152518, "uuid": "0807d841-aab0-4e7e-90fe-5a793416492a", "comment": "Malware payload (Stealc)", "value": "4842661260a2281a47fb5b6484b85bd625933185d8d8e8e47a1db451a100e146c60bc2d325b3b46cec6234d0cc79be1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769152518, "uuid": "3ce48785-a648-47ed-92f4-650b312a3ee5", "value": "T1D5834A11F252C035F0F700BACBB54BBE9EAC6F10636850DF53D815A99B61AD2BA32357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769152518, "uuid": "2aa6c2a3-ceb2-4581-a866-041ad335b640", "value": "6a5a3919d6bebf63a6f776305bb77974", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769152518, "uuid": "59e9096e-72ed-42f4-a941-601ba6dacc7d", "value": "768:IlAZpYb8H106bHN+B3ez3n9lIyaD4hf+aFJkk4LEDRSn/AiVFi0o3AhRKBBRHSyp:IAS8HNN+BuX9MUXFJkNV7uAhoB2yH2U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769152518, "uuid": "2afb51ce-62a7-4c1b-82f5-50ef7a50ff7f", "value": 82432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769152518, "uuid": "2a1b77d2-af3e-4f82-b4aa-63c4c6eae565", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769152518, "uuid": "b45ed24f-c697-40f9-b836-e4a9fc0694f5", "value": "31D5DABF2040669581E6C27268C278C4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1912006d-f832-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769155450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769155450, "uuid": "eb1ef2b8-9164-4bc8-9128-e81503de3bbe", "comment": "Malware payload (Mirai)", "value": "355798272407e5ce39f309cad96b996d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769155450, "uuid": "e74a3a42-683e-4c85-a954-863ea38cc78e", "comment": "Malware payload (Mirai)", "value": "a7b90ff4efcfd8c971f1cfc07528b2c84e3d1021796cb9239d4a593634cd672b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769155450, "uuid": "0a4268f2-81a5-4778-af54-61d770ae0f1a", "comment": "Malware payload (Mirai)", "value": "1ca947ca46134a20a66999aa8d8deb07b244c6db", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769155450, "uuid": "fe1ed2d7-e10e-4ac5-b079-7ed1ca0f6fad", "comment": "Malware payload (Mirai)", "value": "f77d05a74b8f41a21c5740b4bec040856630cd76d9d06aa65716efd6ad4b2ba291b7637ef2b40009953c3294dce8b0fc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769155450, "uuid": "ea1c517c-5c73-413f-9047-6562d7cc6228", "value": "T1E9633C32BA764D2BC4C4657661F38735F2F6878724AC891E3EA10E8CAF6565032877E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769155450, "uuid": "32546692-5212-40d6-b4af-0e66d5e96836", "value": "1536:7eq3WoMTMdhGw3M94y2tmxGYW55GmBD7txB5x:N3XMTccVGI4YwGmBn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769155450, "uuid": "eb817cbb-f2d2-4281-8111-d8f484ec551c", "value": 70056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769155450, "uuid": "afa8de50-c230-4cff-8815-04ddc59ed2f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769155450, "uuid": "c4314308-9f61-453e-a0e9-57f19a2df6a7", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0abac059-f864-11f0-a129-42010a9c0007", "comment": "Malware payload (Hajime)", "timestamp": 1769176900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176900, "uuid": "85e43e42-c53c-4251-b597-0eece95120c3", "comment": "Malware payload (Hajime)", "value": "5bc8bc84f885c9b4900d168bfb9903bb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176900, "uuid": "333a00a0-13b6-4dfa-9d93-c79d959ef31e", "comment": "Malware payload (Hajime)", "value": "a8026d55d63e81be3a406171523230a83b2d301f79ef3d35ab3084906e782da7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176900, "uuid": "95ab4618-6e41-45f0-9c3d-a1e46b33499a", "comment": "Malware payload (Hajime)", "value": "ba423474ce5677b84348de8a3be3b594c68fe000", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176900, "uuid": "3420a684-6ada-485d-8eac-73e5a15b0029", "comment": "Malware payload (Hajime)", "value": "1dca4b979013c734abefeecf9d05593487a0e9124d7a8704f893e81d1aaef2db0af8947b103117b01ce231bd93f1b0f7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176900, "uuid": "1a365441-9880-43ba-8134-c2a9f7d54dff", "value": "T154C2F18323883743A1635AF4E27DAE8A72167D689FBE543B81543123607311E5649C7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176900, "uuid": "d8200c77-1bd6-4ed3-9fad-79cc2c21a98e", "value": "384:YTYXvQDuYY2xZ6VTgDK4mpwTl5yejHSDeWBbo7hcXBOo3g1qs9LrEQSXm/:YTYIDfYG6ZmewZ59+Nw1qsREH2/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769176900, "uuid": "77fec3e9-34af-407b-9d4b-3dc755e54f72", "value": 25960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769176900, "uuid": "65a90de3-88e9-4715-857c-22fe2677b49a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176900, "uuid": "7356da82-da66-4782-990a-6adc365719ff", "value": ".i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05858506-f856-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769170879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769170879, "uuid": "b2eec3aa-bc1a-4a63-99ac-5738568fe58a", "comment": "Malware payload", "value": "d3b9624e954d7da78cee2619431b0665", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769170879, "uuid": "016decef-5132-4a67-8cd0-0030b57b5035", "comment": "Malware payload", "value": "a90ad95d4584ec3f5d432ac0b075ee80ba485dfb6ed5360c0d9909069b353680", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769170879, "uuid": "e2f2280d-ca06-40a0-8e10-829f92882951", "comment": "Malware payload", "value": "d152f2ba454cc8a0f33ec151d6ab805763d07662", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769170879, "uuid": "69939f2a-54b6-4a97-ba56-ee10b7293f36", "comment": "Malware payload", "value": "9981e0ad805e24259bb59e946d9626256d7e8e4337116fc4de8f0b924f1a8cc65793f66bddb9a2324516ecbddb69b2c4", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769170879, "uuid": "50d65d31-9e75-4c48-96ff-c8b82548ce0d", "value": "T1CFE4C687F1208AC7F84FDABF149142106EF0E4704607F2561B6E985A2FEB9C89F553E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769170879, "uuid": "b82ccb6f-7efd-48ce-a9dc-e3b99367cf56", "value": "6144:51eMX5Uh/W94gpr2TcPjhMoYIguZOe61XehygGG9DBY341U6Npce/1op3x1Z+F:51wVgRtfP/1uK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769170879, "uuid": "8652db1e-e4d8-45ff-825f-63fa7eb506f0", "value": 688783, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769170879, "uuid": "4af28d65-5c4f-4541-9666-134a4d5d1bd0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769170879, "uuid": "e290b98c-9efe-40a8-bc7c-fa4daf5c012a", "value": "dupe-v2-stormdiupe.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20b68394-f89a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769200130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769200130, "uuid": "3797e721-df6e-47c9-acb8-0f7a6c7051a8", "comment": "Malware payload (Mirai)", "value": "3a46b6f11ba5a8469a593ca9dd5881d3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769200130, "uuid": "b86ae5d7-60ba-414d-acf3-670c585f8855", "comment": "Malware payload (Mirai)", "value": "abdea3b6f8208a8b3d8de0152677fb5b3aac306812d17d2b0c7280002a1f7f3a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769200130, "uuid": "f321025f-1891-43d4-9ea5-ba253c4f9a4b", "comment": "Malware payload (Mirai)", "value": "c399f06784f81ed84548a274b68a414e61183a6d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769200130, "uuid": "f0204d63-05d6-479f-a0aa-146c4d29af43", "comment": "Malware payload (Mirai)", "value": "f204f59091e0c313838c2e228f474778632b81b500378be7908754f99c065d523a021751147dc6693c932202e6f29132", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769200130, "uuid": "bff86d0c-49f3-43a8-ab0c-f0f6d2289d23", "value": "T12E8302FD5611434FD32D993EA080AA26F63295BABF3C2D6AD42EC00744DC64E6D04EC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769200130, "uuid": "34988a8b-342f-4888-bb56-add18ccce99c", "value": "1536:/P/ld+e5CIeWhdSRI8JADDaDx1i9PJ2++5hnoEvBWetBrd0l65r:/1cuCI6RUDc1D5hnXEA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769200130, "uuid": "628ca776-f289-49d0-afd5-4b977b773d44", "value": 87760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769200130, "uuid": "fb4ac229-a5ed-4122-a081-ef3805931356", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769200130, "uuid": "bd04b39b-9c76-4d11-ab15-9ecb44060379", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a3023f0-f898-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769199341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769199341, "uuid": "c6b92704-d3da-46f6-bb5b-e5a301f4c960", "comment": "Malware payload (Mirai)", "value": "a7ffd60f387a9756ac2b1ecf7a33cb18", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769199341, "uuid": "9282be11-fc9b-4b55-b4e7-67f8998bd6ba", "comment": "Malware payload (Mirai)", "value": "ac236882abf6bfdb0f4a821ea0f907d92c35d2fa3e3362e8736e968ad528ea30", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769199341, "uuid": "69c0ff50-1d70-4c4c-a315-76c28a69ef23", "comment": "Malware payload (Mirai)", "value": "689d9198cf27c40614be4af6d39802ff147de8ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769199341, "uuid": "5f1f393d-f9f8-42f3-92e2-a11c058b7d37", "comment": "Malware payload (Mirai)", "value": "c86de1cb49bd0090dc86272aac994852c602cd5e75d804f84f49a3e0b1eb73e05217d34cc4e14817df59cf57fb54c67b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769199341, "uuid": "1960ab87-ecb9-417c-a8e6-c51bd5167a1f", "value": "T128C423B747B74D4AA2AC87FD381C2987D5C87038DF805582BF90D50A6C9E2463DE3E66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769199341, "uuid": "4aebceb7-4511-49a0-bd35-b4b7a41d3603", "value": "12288:4wtchXYX1trP5+qtNYYzIUDrO90vR07WOIS9M48ly+t0xgtX:Nmhutromz5DTpexKyG0AX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769199341, "uuid": "1b2d9c91-0657-48bf-838a-795e998ef148", "value": 546592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769199341, "uuid": "04bcf30f-1453-4702-bc94-ac40d92dbfb5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769199341, "uuid": "c50d7e32-af99-4838-8191-7db77528cb19", "value": "bot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3332e5f1-f846-11f0-a129-42010a9c0007", "comment": "Malware payload (XorDDoS)", "timestamp": 1769164083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769164083, "uuid": "5f0ce888-9030-4f55-a12b-05c8b3c8136c", "comment": "Malware payload (XorDDoS)", "value": "03a1fb595430dd607bde61e4a9424030", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769164083, "uuid": "dbbae1c8-f9b3-415d-ae62-59a262f8fc60", "comment": "Malware payload (XorDDoS)", "value": "acced0abfe7763c3eff473af94288d0d154a0ce5773284c1492aa0ddc670d44b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769164083, "uuid": "63f9d599-b51a-4dc5-96d9-8240610257fb", "comment": "Malware payload (XorDDoS)", "value": "0a3f4065c0d633cea0bcab56adce87226264e018", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769164083, "uuid": "f60ec4cc-d5fd-430e-926e-dbf35b878ee5", "comment": "Malware payload (XorDDoS)", "value": "993c44e36f2e0fb1f69ea87671bd02c50ccacb8db4cb3790738103577416a6d4cd2cfd682af0f8535c91ab35039fdd2d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769164083, "uuid": "3f1da997-4a18-4766-bf96-b6b2f040d6b9", "value": "T174944B56E243D0F7D82704B02347F7FF4620A235D421DD8AEB94AE5AB9338E2664D763", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769164083, "uuid": "6cc2949e-80c6-44e1-b6c4-fb67ed41deb0", "value": "6144:axnm9lfABacn+mKwrXW52+ipNTJVP3nWydo4tdZ9XpCz16MwYPFM5FgjTcxpQyV+:4Ufrcn+vwK5ripVU4tdZ1pNL/pVbz+X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769164083, "uuid": "b7a095ff-1075-4c3f-9a62-b49dbcecd254", "value": 435598, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769164083, "uuid": "e22e69f6-1b2e-49f2-b752-ba59a611d16e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769164083, "uuid": "0702ee73-0039-4998-9b40-f8e355fc319d", "value": "p.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1fb08de-f84f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769168135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769168135, "uuid": "d49731cd-814b-4a65-a169-99d3883d4f9e", "comment": "Malware payload (Mirai)", "value": "d8d6e1f9edba6c9372a4c50037b5f1f9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769168135, "uuid": "1334ce2f-f5a5-4596-9aef-51f04f674848", "comment": "Malware payload (Mirai)", "value": "ad2a9ee1c109c05164e75e77ebd86c48d7dfceb2905614ce895f2147a9ef3ac1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769168135, "uuid": "0bf16ff8-c700-48e4-a7a7-513d5204d2b1", "comment": "Malware payload (Mirai)", "value": "a2335aae9c1197d958bf95b207250ddeeb3881e3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769168135, "uuid": "da55e801-7f34-40d7-9aa8-f9f2440d2f14", "comment": "Malware payload (Mirai)", "value": "c084905fc62f8984cbaa2c58942d3be2b280900060b297513669e2b1e30b5e37f1e8a60c561c3b7d06555c5d62a1afa1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769168135, "uuid": "21bb4e4f-16af-433d-ada1-2c3a857d898b", "value": "T1C1533907B990C0FCC099C1745B6FB63AD933757E0238B2AA37D8FA236D49E215E5E850", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769168135, "uuid": "3e5c68e6-c60f-452f-8acb-da3bb8cd0e3d", "value": "1536:AdjjnP81NXoIsbbJTDXyuirO+yYCv9mDVIviFxu:gjPmN4NbJTB7+yjVmDVIaY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769168135, "uuid": "3e4c3455-1819-4b57-bd79-123bdcfe1533", "value": 63360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769168135, "uuid": "c5b1ac2e-1833-4bce-80b9-80897af40d05", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769168135, "uuid": "b9a6067c-c10e-40c4-b1e5-39983b5a75e0", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e74820f0-f8a9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769206906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769206906, "uuid": "1216f9d0-5a43-4c69-8c7d-b201e90fc5d6", "comment": "Malware payload", "value": "11a5a09e4a7f39f2b58de877bb27b27c", "object_relation": "md5", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769206906, "uuid": "dd15b0c0-9548-4b05-9e89-30315ee78650", "comment": "Malware payload", "value": "ad4079f54127195a5794ae7cdf74d2b06861f0a8cf75ef8404025b79111a6730", "object_relation": "sha256", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769206906, "uuid": "8f8ec3b9-773c-49db-985c-7a8428250965", "comment": "Malware payload", "value": "86cc6d92c43345b795180a5acd8c329a454b3e19", "object_relation": "sha1", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769206906, "uuid": "dd8bb000-d877-4833-90b3-a2ec1bf1bbe0", "comment": "Malware payload", "value": "8a6867b1482df33916de5deb8b29ce67d226d580137a88d5d5e4ef067f392e8a04340b0d2003576261569943bb533da3", "object_relation": "sha3-384", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769206906, "uuid": "07cb117b-6b15-4f03-8720-ffad8fc1e268", "value": "T170A1720763E72FFBAA464DE85398620724F6C07B38117ABDF7E51193742AA42BC31234", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769206906, "uuid": "2894a900-6228-4d0a-a846-52bcfbdda1bc", "value": "48:CzOpruiLiGS0KmpqGSaXBYGSaaZK0Q4GSasEGSaaq5KJDEGSaTv5GSaac:Cap6C515vt5oKY352d0Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769206906, "uuid": "6617955c-e917-4280-8cfb-517aed551425", "value": 4890, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769206906, "uuid": "f2385cc9-a7b1-4e61-b38b-3641690e589b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769206906, "uuid": "02143b4c-3f51-4f4a-a442-6a8e3b81f179", "value": "confirm@195.85.114.118", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24cd93ca-f867-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769178233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769178233, "uuid": "7f53a245-32da-4115-a046-fcdb53392107", "comment": "Malware payload (Mirai)", "value": "fc59e3ac40e178be84aa0d887c83e445", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769178233, "uuid": "736116b0-e0a5-4edc-a070-18ef847e97f7", "comment": "Malware payload (Mirai)", "value": "ae8d44dd25beaf5b5d8ff89de3d7c95ed977644e38215e9a38ace1ffae8fec39", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769178233, "uuid": "c0e0f4cc-bcfc-4f5d-b9e8-5f6d23619aca", "comment": "Malware payload (Mirai)", "value": "74a6ece60a04af8907f97eef8a4c9eaed3850064", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769178233, "uuid": "a09145ac-205d-426e-83b0-80d21eb75e75", "comment": "Malware payload (Mirai)", "value": "0a60ec22c90f9b9f52a28622aa0f64a134f39bcf38e2a216bebb362c93aff05f9b2e2f918ddec987fea8c57b4752cda8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769178233, "uuid": "4e4a4e69-9851-4982-8fc0-fa82991737e3", "value": "T1C773078AFD819B11D6D565BAFE0F518933534B6CE3FA72029E245B2427CB92B0F3B501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769178233, "uuid": "36222c16-913b-4a0a-8f23-9087c7e8ad27", "value": "1536:OJnGxzU4JtwImGswjPot3UH8/qBeoPmdFX7O9w8rERXqlr3ijzxVMsZXYmiv/bD4:TzU4Jt9mGMUH8iBeoPcFX7O9wTR+Czxv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769178233, "uuid": "700cc33e-8038-417b-8364-e26b75091796", "value": 79580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769178233, "uuid": "46f7986c-e8b2-408b-a333-78563b6b0193", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769178233, "uuid": "0f773429-127d-46c4-9e2c-14e68aac4e56", "value": "nabarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e1542ab-f865-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769177470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769177470, "uuid": "993f837a-efa1-41d2-a3f7-81e18f316b5f", "comment": "Malware payload (Mirai)", "value": "151f12c1d09c88d6eaea00a22ca0dbb8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769177470, "uuid": "c16008d1-0857-47dd-88a1-7864b96dc500", "comment": "Malware payload (Mirai)", "value": "b20db714bbdb236c1ca04b8e335bfaec9b43119e7a2d58939fe2b26808e0479b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769177470, "uuid": "16f510ba-338d-45d2-aa94-3787ed986214", "comment": "Malware payload (Mirai)", "value": "fed1cebfce847804818734165ee7dd337245a4a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769177470, "uuid": "d63cea13-d13f-496e-a69c-9750ba2c6ebb", "comment": "Malware payload (Mirai)", "value": "8b5c0c37dff61e8749bc8942b42f9212d1f0cd9694899bc456f50540949dc23ea8be8153e7f2ad69e21e03f849c75a7b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769177470, "uuid": "c5be7716-4d98-428e-afa1-80f58f65fcae", "value": "T13693B60ABF550FFBDC6FCD3706A9170535CC650A22A93B3A7534D828F64A64B49E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769177470, "uuid": "42eb22ba-d4a2-440d-9b36-33c0e21187a8", "value": "1536:O6MHCD9rnYyor6UQTtbXPvczrd/iHZQ7OOXQGKCnStf7bmsm:O66CD9rYyOzrVgCSdfXf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769177470, "uuid": "b8eb06f7-175c-49c4-8100-0af581745d41", "value": 88820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769177470, "uuid": "ebcd06b7-4053-417c-be80-ba8c5b6f7341", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769177470, "uuid": "cab9390c-3bbc-40cb-a3a6-cb15ac8d198b", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4d23f9b-f803-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769135605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769135605, "uuid": "f4b5de6e-7c01-4059-b8d8-7c231e9a84ea", "comment": "Malware payload", "value": "0977250e9480b76a1b175d79a4800961", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769135605, "uuid": "53b1f968-f143-42ec-b844-4e311cabfd72", "comment": "Malware payload", "value": "b3fa2e6dfee9d9ab9ddd0f5ee6f177f25d38ef63740d024506dc68c28413be2d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769135605, "uuid": "620ef6b6-a20b-48ba-9ff1-cdfc7d79879e", "comment": "Malware payload", "value": "c27b034154e9c06ecf92dbf6a6d325b5a1d9f686", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769135605, "uuid": "46fd3790-70f4-4354-83b9-46a9a4c11e1c", "comment": "Malware payload", "value": "4f6e4263419fe3a3f3de9fd681e30ca748bf3fd9efaa52ddeb6cbe67f524475ad10cbab43217228ec268517c1b65ce96", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769135605, "uuid": "213416ce-73c0-4aa9-aec4-5179cb4739ff", "value": "T17683965E6E21DFADF7A882354BB74E31979833D623D1C685E26CD5002F6034E641FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769135605, "uuid": "56b35741-bb3c-415b-b306-b9b81598e493", "value": "1536:usDu+f6u6vMJmAHsb36Qkh1Mhe+BEmbF5ruK:1y3db3I1M9bFBuK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769135605, "uuid": "3a3ea1c2-5583-4285-8934-03ac8e22bfd8", "value": 86232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769135605, "uuid": "6a0c58b0-07b0-4edc-b791-c6969a45b778", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769135605, "uuid": "74210663-db60-4539-a49e-ae7a26904276", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7bfa05d-f863-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1769176815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176815, "uuid": "9ac24021-9cac-464d-b7da-bebffc366af9", "comment": "Malware payload (AgentTesla)", "value": "c8cd2523ebca489bf165b4d0454d0385", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176815, "uuid": "076a5d2f-885d-42ef-9735-a8432b872f74", "comment": "Malware payload (AgentTesla)", "value": "b515361e5b4bb621380627046a5559ad338f91f48ecd1fe08d84bde36f5bdfc1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176815, "uuid": "4745b2ee-689e-4aef-bdaf-14081a65f64b", "comment": "Malware payload (AgentTesla)", "value": "5711b5c5f430f634591b505446a356c0572eddea", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176815, "uuid": "a9e327c4-4a8b-453b-a1b2-235b6b601cf8", "comment": "Malware payload (AgentTesla)", "value": "402a8b27a5bedee07879d75d60d06d4d4295b3423c41cf55a86ee65138a359f156a1e3519551cd9a534f4e1a719da862", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176815, "uuid": "2f1ee52f-4637-4f1f-8df4-ebce1f9303d5", "value": "T10845BF027391C062FFAB96334F56F6115BBC79260127AA2F13981D79BD701B1463E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176815, "uuid": "e0869150-608b-4082-a0e0-0179d6dc01eb", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176815, "uuid": "04cd8cd2-80ee-48b8-ad01-9568772ecff7", "value": "24576:u5EmXFtKaL4/oFe5T9yyXYfP1ijXdaYM7Ev3sbLLQhuQsq:uPVt/LZeJbInQRaYM7EvsbL8hX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769176815, "uuid": "0d254398-4d7e-4488-8fa9-e59a3361c7f9", "value": 1238016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769176815, "uuid": "05abed59-07e0-4c93-b132-0628d4cb909c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176815, "uuid": "ca481d66-f36f-440b-92ba-31035cf0eea2", "value": "z21file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ce104ce-f829-11f0-a129-42010a9c0007", "comment": "Malware payload (BlackMatter)", "timestamp": 1769151698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151698, "uuid": "ef958f63-fa57-43d1-8932-881d4796b0c5", "comment": "Malware payload (BlackMatter)", "value": "2cb123411f4c396bb4bf09e2a5ef06b5", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151698, "uuid": "65e6f5a1-0cb5-4b51-b190-1b9696ea1823", "comment": "Malware payload (BlackMatter)", "value": "b67e5f6e9fb2273ac8ae5dd3b49c7695bc680686cf93a729bbdef2669f18d429", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151698, "uuid": "6cb5bc25-6dd4-4e77-8f50-d4d867c62d28", "comment": "Malware payload (BlackMatter)", "value": "1fee7a9033b0a1be061d72200b6445e261cb3c2c", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151698, "uuid": "3c1eeda9-81fa-492e-99a1-a5a5786d39a6", "comment": "Malware payload (BlackMatter)", "value": "a634f10faff6ee1a7c04ff26efc8a407a94a4ae188c4e7cbc3bb152ee6e272b1774ef7a43c3a72914d46dbe1cae466e2", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151698, "uuid": "3ff5e6bb-4d27-4cf8-a979-0826dff1a43a", "value": "T1FCE36D21F213D0B3C83718F1273675B2F3DE8D2C19A56957EA980F99BC658232F44997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151698, "uuid": "a75595fc-2837-4b97-9184-93c2093d7f26", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151698, "uuid": "9ce5e482-f3ef-4263-9873-70e53091b5bb", "value": "3072:66glyuxE4GsUPnliByocWepPYW4pIIWWNHxgBW4Z:66gDBGpvEByocWegpIIW0xg04", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769151698, "uuid": "54cc0a45-8e7b-4a30-ae00-2d8c4f74b22d", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769151698, "uuid": "4b9a010f-437f-4551-8c5d-43b417a7d67e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151698, "uuid": "2744bc3c-6672-4a84-857e-9dae24f54ed1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91df1c1e-f829-11f0-a129-42010a9c0007", "comment": "Malware payload (BlackMatter)", "timestamp": 1769151787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151787, "uuid": "a26d6bb9-c2e9-4b87-8895-1a97823224ca", "comment": "Malware payload (BlackMatter)", "value": "3c6edd9bc75a5956209060e817384992", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151787, "uuid": "1092404a-7f8f-49f3-8422-7bd87c7a7fc4", "comment": "Malware payload (BlackMatter)", "value": "b6ffdb84f61503fa0b8cead54a5479af317d3adec7fd375f3df2337575981b6f", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151787, "uuid": "6c20620f-118f-4cff-9131-ebfe4043aa52", "comment": "Malware payload (BlackMatter)", "value": "9dfebe07452530d402dc84a1c08095186f0d8cb5", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151787, "uuid": "fa8ec2dc-f100-40fc-bd36-bed007a32e28", "comment": "Malware payload (BlackMatter)", "value": "831044a118b985f216c875367d180c0682122f79b422ed8ffa458e9879c9b5065b5b9a127e1d0b2f5aa5fdb0852694f7", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151787, "uuid": "12d78c5c-537f-4a27-950f-a4e828fc3444", "value": "T1BBE37E21F112D0B3C83718F13736B5B2F39E8E6C19996507EAD80F99BCA48232F55997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151787, "uuid": "05ef1893-972c-4f38-b6de-c56ce6af7e38", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151787, "uuid": "74ffd059-47fd-4343-832d-f335e7480b28", "value": "3072:A6glyuxE4GsUPnliByocWepnGYt5w+CA:A6gDBGpvEByocWeVo+C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769151787, "uuid": "28d6d1f4-8c0e-4db5-8f16-b546e54bf28b", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769151787, "uuid": "bd1dd136-c3a3-4e20-bb32-dd27e8bb2118", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151787, "uuid": "855867e5-b6db-4a80-b6dc-c47fe0eebc6d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85172aee-f883-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769190420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769190420, "uuid": "e2186b40-9b32-4dac-acd3-25a533b68c1a", "comment": "Malware payload", "value": "ff3c54c908b3301295e28d5ae72ccd05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769190420, "uuid": "30c95946-e5f3-4c54-a69d-13d4c0c4ad5d", "comment": "Malware payload", "value": "b822c9e159542db0992fd2bab1fdf9a1da56c33f065b1825705ba5a32dbbe4f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769190420, "uuid": "7c4660ba-7632-4221-9633-57b8cafc8f7b", "comment": "Malware payload", "value": "d277e5fbe522d5a979323067f0c1c5c15a1a206c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769190420, "uuid": "e357979d-d66f-47d9-8dc3-2099b3f19c24", "comment": "Malware payload", "value": "b89cc4188ddaa83caeebd2fd522797dda8e113a485502d2d565acad3fdab8f2794374771acb8c6e7fd5ae034d301982e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769190420, "uuid": "3c7b9d3c-df67-46da-8b65-2905d8bf93d5", "value": "T193D56B07BCA08864C4EAD134AD7261467B747C091B3133D72A92BB792FF7BD461BA718", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769190420, "uuid": "fa968a4b-cc81-4e69-b897-c906c25ea93f", "value": "0951d9f67c9a9e1b6ea746ed01bccc26", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769190420, "uuid": "de9f4d34-1f41-4d52-84ca-6ea08f3a04e6", "value": "49152:sBlXkK0DUk4XGfVyj/iCYpA9xgVat2Nv7M:sjIVm/mpK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769190420, "uuid": "2cb7f79f-c584-44cb-8855-d3181c622d5a", "value": 2758360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769190420, "uuid": "ee708ed4-f1b3-4e76-bc04-9c4064577ddc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769190420, "uuid": "6731beeb-7110-4b69-a83e-79a9c3a0a21a", "value": "b822c9e159542db0992fd2bab1fdf9a1da56c33f065b1825705ba5a32dbbe4f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0ccb311-f893-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769197473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769197473, "uuid": "6a64c88a-3231-40fb-8d3f-38202d7c79c6", "comment": "Malware payload (Mirai)", "value": "a29c7058d64cb4a3a4d623be5d595b0c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769197473, "uuid": "d7f10833-60d5-4c92-a026-3ecd59e23d4d", "comment": "Malware payload (Mirai)", "value": "b9e319e3232e9fc7239575ccc69ed25cb5d629da702acca0174013fa198060c5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769197473, "uuid": "f4348902-fb1e-4bf9-9813-854339fea18c", "comment": "Malware payload (Mirai)", "value": "7fe331bc11111d82ee51448c532d499b5a21943e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769197473, "uuid": "b5090bc1-2e95-410f-bcdb-d0f925d6155d", "comment": "Malware payload (Mirai)", "value": "f30d845b078b8db7457a7492c0e49f80977a7cdc2305e2c0c63c3187f4c7245c019a7c149ed520298e6a0c9bb70f46a4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769197473, "uuid": "5ca07b2a-f84e-4029-a9f0-59e3e78b0762", "value": "T1DA84C486EB412EBBC40EDE31011F4BC5119D849953EB576BB278C45EBF8EA0E29CBD44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769197473, "uuid": "b00f84ca-f31e-4b97-93d2-098141c65930", "value": "6144:XFNSH10ZqdfOiPuFSaaS09ZQn2lH0krP3gWBpQfdIISW6KfLKxNpq54yr8HbU2nU:XFNYdTLCrrQbU2nh6U7Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769197473, "uuid": "579ef6cf-9eef-426c-b052-5dac22b04a83", "value": 376692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769197473, "uuid": "a10be3a8-c264-4c49-b40e-65d7e05cb532", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769197473, "uuid": "39e70699-712c-4233-9c93-40540e936525", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd31c0c8-f893-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769197413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769197413, "uuid": "7c944e81-ef9d-452c-a59d-6c62d2a9969f", "comment": "Malware payload (Mirai)", "value": "b3783562f87d4c4c33411782889a416b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769197413, "uuid": "75c9a092-75ca-4669-888c-d959aaf4df6a", "comment": "Malware payload (Mirai)", "value": "bacf00f80f81ab0629cc2800f3541e4f7d9adfa36e8bd905edf4d32d00758e60", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769197413, "uuid": "4035b026-2c7c-46b8-b2f0-f30392767af4", "comment": "Malware payload (Mirai)", "value": "0bc1457a63eca88aa8f278f5304b0ea20f3bd95e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769197413, "uuid": "81c6c940-debd-4abb-bc32-9b555aa762d4", "comment": "Malware payload (Mirai)", "value": "257ba3f2b74744895aa1c74e2d13fcf1b2146587d16cb92e1fbf72d68946a9d1c2fd5a7c7f315b4925b5eedae13cdff8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769197413, "uuid": "284f9ed0-2cab-4d01-9ae8-ba31f96e1710", "value": "T143D312943A9C9BA1D3CE3536E63772F7A9572D948EA6A041D083B75085E3DCA0346F0F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769197413, "uuid": "f6357e03-e87c-4da9-908b-012b1aef4ba4", "value": "3072:mCWOyrXE8cH30xYmWUP9QY8s+xmVdjYHzKXAyfvGB1MVP:kXVE3m3XP9QCVdcTKwyfT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769197413, "uuid": "c22da9fb-84fe-484b-877a-605451729f9c", "value": 136188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769197413, "uuid": "21733f24-56d2-4b82-977d-2be69c158e05", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769197413, "uuid": "e8013125-3f4e-4af5-a20e-8fccd4dbbc9f", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5f6660d-f83d-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1769160437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769160437, "uuid": "01e46b68-188d-45b2-bb6c-637ebb8e0ed5", "comment": "Malware payload (AsyncRAT)", "value": "a93ca13dea58c374a7360a76b5d5744c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "credential-theft", "colour": "#31B091", "exportable": true, "hide_tag": false }, { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "keylogger", "colour": "#66C828", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769160437, "uuid": "7e43a465-72fd-4555-81cb-bbc82c9b2b60", "comment": "Malware payload (AsyncRAT)", "value": "bb8038a596128b0daa1c260d4d803c2435bad8df0ce4c458aa3d8b244d47fcf1", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "credential-theft", "colour": "#31B091", "exportable": true, "hide_tag": false }, { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "keylogger", "colour": "#66C828", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769160437, "uuid": "3dec8e4f-83a5-4a89-9faf-4522f3ebec1f", "comment": "Malware payload (AsyncRAT)", "value": "9d9e02c9972df40dc932ca2e071d638c3c589dac", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "credential-theft", "colour": "#31B091", "exportable": true, "hide_tag": false }, { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "keylogger", "colour": "#66C828", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769160437, "uuid": "a60d51ae-b059-488e-99be-52a6837dfe27", "comment": "Malware payload (AsyncRAT)", "value": "f8ccc2a016bec80fd36e5b5e031af3ec88bdca69c6820dac72c694d6325118c802fc543e1d412bb336fbc166baee069a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "credential-theft", "colour": "#31B091", "exportable": true, "hide_tag": false }, { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "keylogger", "colour": "#66C828", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769160437, "uuid": "7262331d-22a4-4ce0-a839-ee109d85e0b8", "value": "T1F0535B002798C925E2AD4AB8ACF2550146B9D6772102DA5E7CC404DF6BAFFC64A133FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769160437, "uuid": "b7fc6ddc-7113-4297-aeac-bb9de9b99767", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769160437, "uuid": "00830d8b-b8a0-4230-bcaf-d16d58dfe7b9", "value": "1536:+7I6uXQIjotF2wZ/YTGbb0wo7uzzcEGzpVclN:+2XQIjot80/6Gbb0V7uzzcvDY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769160437, "uuid": "134fc19e-9706-4940-8df0-69ca74bf86e2", "value": 66048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769160437, "uuid": "687d3402-d7fa-4692-a741-4ae694d77208", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769160437, "uuid": "683c15e3-666b-46a3-829b-c716deaa21aa", "value": "BPD_login.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a6d421c-f859-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769172175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769172175, "uuid": "d2d6d3ec-00c3-44b5-8e6f-1fe3fe49f341", "comment": "Malware payload", "value": "63c24b037ffc2e3f20faefd281975ed5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769172175, "uuid": "bdc2037e-5e0d-44c0-b7bd-def05fcba714", "comment": "Malware payload", "value": "bb8a91614a15966f101f95a2657003bac8cf760603c221ed747a76e2fa0db635", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769172175, "uuid": "ca0ebe51-d1c2-42c1-bbd7-71b80aba7c9a", "comment": "Malware payload", "value": "8aad34163bd7256762b4f2c89ab1cf2bd690112c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769172175, "uuid": "7928b571-b9a4-4460-9534-e33a6f4b2f17", "comment": "Malware payload", "value": "cdd10e71ce906b6b41c94472c91321b928edc8ee624f72674674950698b9a76c7e0557c87b523d729451b6ef83972c51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769172175, "uuid": "5d889e29-cc36-442e-a5c8-8b006756affb", "value": "T12C66C0CAD16B40D6CC067FF598142BC39B3056324A34047836ABBE585F779FA811EEB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769172175, "uuid": "49927505-0b69-4da5-906c-90501be00ba0", "value": "09bf3c2c0d1e1c721043f5ca267758f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769172175, "uuid": "ca2152e6-7d8f-4a1c-8a6e-1d1f9682e899", "value": "24576:WSny1aE4AywrNmUf16+xbxOaoOi5eF7xYGG48edYku9Rm4aFawVfsE3XEc8cls6H:oRf9YNmEZ7o3iZAdCNBVo8xw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769172175, "uuid": "d933cf35-639c-4659-b088-672cce1f6519", "value": 6882816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769172175, "uuid": "563334eb-d19f-4284-b395-0a084d49e11d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769172175, "uuid": "ba184b94-291a-43f7-bdc7-e36a22980dc8", "value": "xLauncher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e1e272f-f891-11f0-a129-42010a9c0007", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1769196448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769196448, "uuid": "52dc8a3f-e1a5-420b-b26c-877c1f028fd3", "comment": "Malware payload (Socks5Systemz)", "value": "d322fa92baea3f2925c65815463b4c4b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769196448, "uuid": "a272d60f-4737-40fa-acfe-26d0b3d8e605", "comment": "Malware payload (Socks5Systemz)", "value": "bbbf1dc521112787b751a8a1b1d214c84d6dbd674153ea89ec7ed71b6c1065d6", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769196448, "uuid": "b077fc79-2354-4492-8eba-d09a785c3f3c", "comment": "Malware payload (Socks5Systemz)", "value": "b22818fd5e0026c38732e87122d8ae0f0a647798", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769196448, "uuid": "08687627-e0be-4f77-825c-7397276286ed", "comment": "Malware payload (Socks5Systemz)", "value": "cbb6ccfd5d3132018cb7c27d93bb641cb5b12e1fe4ba7ea79e5587e198744ca9746992b39211c79e04e94200f39c9d5d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769196448, "uuid": "6e4f2aed-7ff4-4804-bed0-acd090c0ecb8", "value": "T1DFF533C79A83E837F25A98BC6931E73255F6FE543CB4C484730CA1CC8B976641D2A672", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769196448, "uuid": "a512ae40-d108-4151-9dd6-506d0299f821", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769196448, "uuid": "8046095a-d4e8-48c0-b68c-bde9147b572d", "value": "98304:MkUODVOl+WlhnolxrJFJ77Ft+KWzi2bF4RM4gn:RTIwWTnONVFt+Kx2bF4K4a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769196448, "uuid": "c881ae39-51ab-4824-a29b-fe481a4a05fa", "value": 3357027, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769196448, "uuid": "e323ce36-5974-4a66-b175-9a8d154f5fa1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769196448, "uuid": "51d845aa-a9fb-45d8-87ff-90af55f870dd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c86b77c4-f83a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769159180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769159180, "uuid": "790639d1-ac3c-465c-9df6-8341ae4adb82", "comment": "Malware payload", "value": "d4960e7100aac598ee03b4f718b6c0a1", "object_relation": "md5", "Tag": [ { "name": "94-159-113-32", "colour": "#84A36F", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769159180, "uuid": "ff1b8329-11fa-4cd3-86ad-dff5fc9c27a6", "comment": "Malware payload", "value": "bbf3f5d2fedf0bd5183ddb7c841b82d92af34ba2d48a31e161fe1adcc6491cab", "object_relation": "sha256", "Tag": [ { "name": "94-159-113-32", "colour": "#84A36F", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769159180, "uuid": "f923171a-81f1-4621-aabc-70d344e98870", "comment": "Malware payload", "value": "e7cd87e6305b90acb867612a1b99e65c871c32c3", "object_relation": "sha1", "Tag": [ { "name": "94-159-113-32", "colour": "#84A36F", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769159180, "uuid": "af54b9a0-0a77-4644-b6ef-d83460e35533", "comment": "Malware payload", "value": "e0cd20b375c4f74e5dfbc5139a9d41e0c1b2d3e1544380de5cd6dcdf50b4719d2bf52b3a646ca89c7510e76d7ec46982", "object_relation": "sha3-384", "Tag": [ { "name": "94-159-113-32", "colour": "#84A36F", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769159180, "uuid": "3c0a2147-3067-468e-b21b-fc323af0c21f", "value": "T16A15334F2A9E5A972379DC49ED188A549180F42858A54E62F0C9FA2FF0277D0351BFF3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769159180, "uuid": "7a52d74e-e1b3-494f-8437-667f76824a47", "value": "24576:e5oJRN737uXUGsGUBYph/ITaYrjZwjjhSi+2X5Yr:TJHkUVyph/IWYr9cSb2er", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769159180, "uuid": "94a44a0e-9369-4f47-bb95-90d41df4c61f", "value": 930298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769159180, "uuid": "adf12b72-f8f5-4550-bb1f-b0295f1560e5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769159180, "uuid": "ce50c778-bca0-44be-b52b-cefa2adf91e2", "value": "freely.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23439bd5-f867-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769178230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769178230, "uuid": "b2f5e2c1-c3c4-4a77-9675-4c5e81c13951", "comment": "Malware payload (Mirai)", "value": "a48d285205dbed369bc8571145de51bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769178230, "uuid": "6403e020-4237-410a-beb0-fa97df16f6d4", "comment": "Malware payload (Mirai)", "value": "bcf99cd96eb169c78d7826a86279d780f7141c5ea0f4fe35d1c62d4f53c6b140", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769178230, "uuid": "ca8a4a1a-6276-4d23-923e-6a1a97366c7c", "comment": "Malware payload (Mirai)", "value": "9ebd1402f943df40d3843d300a37595d818cad02", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769178230, "uuid": "26766449-2253-4828-9d4c-662905de4055", "comment": "Malware payload (Mirai)", "value": "bff0904e1759f8b6227b3a30ae1f39df44f43787dbda749d6e17937937d0d15cc6f4d35f6fc9952ab47c461a42bdc128", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769178230, "uuid": "f5d00cf7-88fa-41d8-a630-ddd86a3d93ef", "value": "T1D773A74A6E619FBDF668833147F74E30A75933D233E1C685E66CE5000E6034E686FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769178230, "uuid": "94e40af0-6712-4f62-9be0-18b5f253aa7f", "value": "1536:cem1emVzmgp1LDmYbf88VtNc2Kni2YvgodTHZB/bx:m1HmYL1tNc2KYvLHZB/1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769178230, "uuid": "3356c176-96b2-4e14-bf03-2ff85fe117a4", "value": 76500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769178230, "uuid": "204019e7-20ed-4201-84e8-ab7e67d09fcd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769178230, "uuid": "c0e7b6de-03e3-4a34-84e2-a20411f7c9cf", "value": "nabmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "566ac7ac-f7fc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769132360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769132360, "uuid": "1dd73b32-ba0a-4e29-aebf-6f24427bdf8d", "comment": "Malware payload (Mirai)", "value": "15dc9655c73c0dc67ce4b1f03e88932e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769132360, "uuid": "f3c60915-37cb-4051-adb6-6a6effc5c640", "comment": "Malware payload (Mirai)", "value": "bda8da9591a4cddac8c94a60a84c012f7686855b8444465ec9b43a1b5b17eac1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769132360, "uuid": "bd037b3f-9c4e-4535-9cc7-c18a1885b8b3", "comment": "Malware payload (Mirai)", "value": "4512d5fc3c3063e52d2512868a55d9d71dde9a4d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769132360, "uuid": "52da0e53-d8e3-41fc-bcf3-501697023f0b", "comment": "Malware payload (Mirai)", "value": "fa7b98cfa35ec41850d5afe590d81878fe6cf5765533dd8ad4257634d815600b7f2cf22dffa6d1fbca1eddcd9c7d5cf7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769132360, "uuid": "c5c1a8da-b52f-45a6-a164-56477885c148", "value": "T10F531985BD82DA13CAC4537BFA5E42CD3726279CE2EE3213DE155F6032CA82B0D7A551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769132360, "uuid": "50dc1f70-a399-4544-a26b-dbe51798faee", "value": "1536:PXU9w5YknCF8CLCLWXS1n9f/JPz/rQsBF:MOnCjU93VPQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769132360, "uuid": "4f6c8df0-9d94-4a81-a8d5-cd16bd93616f", "value": 64296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769132360, "uuid": "736b8feb-2b9c-4fdd-b2c2-5aa2a96ef150", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769132360, "uuid": "d9f73c4b-5da0-497f-9b75-60967277b452", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "391632c5-f81a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769145195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769145195, "uuid": "64c56c37-a0be-40ed-a913-73e9365b1683", "comment": "Malware payload", "value": "b4029b9aa94a7a49a0af31d1a76ab25b", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769145195, "uuid": "2f68b3cc-818f-4976-8ef5-6ccc4677e1cd", "comment": "Malware payload", "value": "bdad4f72e3ad6ff02f006a2f2f0a0bd69add7e41346b7a21785fcb10dc86fca3", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769145195, "uuid": "b169aae2-ff03-4a5e-b6ee-31598ff60ae5", "comment": "Malware payload", "value": "5f3ab770ed7129939ea5faea263b2962cce4de12", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769145195, "uuid": "3743d74b-9834-4612-90e6-88a381700544", "comment": "Malware payload", "value": "e14b1cc9781e1a3334bd6633985d28c84e1fa9ba6f3ffe437013132af5019938df29b7471134015a5debc16ed5809c5e", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769145195, "uuid": "128ba65a-4647-499c-a8ec-0ad9a323b5eb", "value": "T1F5657EC380DB5E58E939727B96E0EF34FAC7A0DB0659985AC05010DC630B576F6BB1E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769145195, "uuid": "ef4b0c4d-7183-4a97-a2fd-38a897ae4e24", "value": "768:AwWfEW0yWpWf+W01WYEfmW0EWnUfLW0EWuWW+W4WW5UfhWlYWBGf9W0uW2UfhW0y:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769145195, "uuid": "bb21e820-04ed-419b-b2c7-62567d5e6ce7", "value": 1497088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769145195, "uuid": "ee90477b-f9a4-43e0-bc12-66e3813ca138", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769145195, "uuid": "739f8069-f8b3-44a7-83be-02b0aa43b4c9", "value": "PPC SA 4300742619_pdf .img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7ac8f09-f895-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769198316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769198316, "uuid": "b9557c68-21ae-4bbe-922a-e8752eb73252", "comment": "Malware payload (Mirai)", "value": "2677bdea77542a88eece17e36510d255", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769198316, "uuid": "e3524ad2-bfd4-4d15-baed-2525d3473d4e", "comment": "Malware payload (Mirai)", "value": "beb8209b06e8bbe2825da7b580809ee4312d4bb173899041fe9cc5d9aef67597", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769198316, "uuid": "56c012ea-e596-4701-bb09-5751cbba125c", "comment": "Malware payload (Mirai)", "value": "3883586bf29f35250f4273af30af182c8da74028", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769198316, "uuid": "6c8c9fd6-f920-4ea1-9b2f-614e8c57cfae", "comment": "Malware payload (Mirai)", "value": "beaf761afd00ac2b0ead4f3b2f08014150c764f28223d37d009f79e630522dc14614d4b86fb4838feea0266b1bcc9ee3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769198316, "uuid": "3e8e56bf-b698-40f7-bce5-2f4ed3cf860f", "value": "T17044F75CF880D779CBD0217AFA5642CD33731F64EBEE320589356B3837E6A25993A241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769198316, "uuid": "6ec4f332-69f4-461d-a0ee-cac640f20727", "value": "6144:pxCbaxCXF1S06j13uZ89Ryma112/2NPseMmID+RGWbmU+zuBqMjBTdik:G+s112/1UbmREZdik", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769198316, "uuid": "8916d376-8a01-4661-8ba6-dba8e949d577", "value": 261236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769198316, "uuid": "03725ac1-4df8-4caa-b126-23f29596c850", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769198316, "uuid": "ba55b501-4492-4e4e-aad4-7d58b7f180d0", "value": "armv6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a35ba4a7-f878-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769185746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769185746, "uuid": "f4d24627-4aab-4399-a2c0-cdec4744364b", "comment": "Malware payload", "value": "20e64f50f4375a9be12bcb0cf6708b80", "object_relation": "md5", "Tag": [ { "name": "07072f", "colour": "#19557B", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769185746, "uuid": "81e51a84-aff9-41d0-9db8-bf008732656f", "comment": "Malware payload", "value": "bec29053637e2f2f4ebbbde9c54d97ba2fb966d87ff2b9c0341b9e99050cd98f", "object_relation": "sha256", "Tag": [ { "name": "07072f", "colour": "#19557B", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769185746, "uuid": "75929674-12b0-428e-87ee-289a47cf9ad5", "comment": "Malware payload", "value": "2e5228808f22e29281c149db8e6cd29d2d779c66", "object_relation": "sha1", "Tag": [ { "name": "07072f", "colour": "#19557B", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769185746, "uuid": "0d2826b9-a557-404f-b9b7-c9d8cc366b59", "comment": "Malware payload", "value": "0e5e75901cdada6e16ab3db972c1526f84b732453fe57337ab12dcae0a379abc8540aa9aed1135f0b871b7fd6c1e3eff", "object_relation": "sha3-384", "Tag": [ { "name": "07072f", "colour": "#19557B", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769185746, "uuid": "18f87133-6eb5-4bc2-85c6-f14f08ccb781", "value": "T1DA129372A964DC324543C969B4E1FF1D30BED32E87044E8CBABC1556A7DBC850A309AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769185746, "uuid": "c9028d7f-76b1-4a43-8840-678d00eed8dc", "value": "192:r3+KUgJarRG0G8MiFmqvBZQpJMmPJW2OtfyX:ThJa0MmCoMmPJ1OtaX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769185746, "uuid": "7e826bbd-4ceb-4712-b557-86248638f96f", "value": 9878, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769185746, "uuid": "3e1d8c61-b485-4aac-8fe9-8832fe42390f", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769185746, "uuid": "8b2f534b-1a78-44f2-9fd8-0b5e677688de", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cec281d-f8af-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1769209277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769209277, "uuid": "34f35f3b-6f7c-4465-a9ad-a3aadbb8a37d", "comment": "Malware payload (Stealc)", "value": "6c51c7f102b70b3ca95760dec94e027d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "zobpx", "colour": "#1278FD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769209277, "uuid": "9c2fa25c-b55b-4f27-81ac-8aa371858a06", "comment": "Malware payload (Stealc)", "value": "bed6af9ba6758303763a09b019dee3c61dcc3a5bbd3af631bcdbcf74b63f23c0", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "zobpx", "colour": "#1278FD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769209277, "uuid": "0def68a8-c34d-424e-9065-b7351cda2592", "comment": "Malware payload (Stealc)", "value": "a5f16d4f8811065659adc3e78e558033c0ee22e9", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "zobpx", "colour": "#1278FD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769209277, "uuid": "40b43f9b-2347-489e-952a-54446f7b4292", "comment": "Malware payload (Stealc)", "value": "195800861a3b2c80eeff505e3885b4ab6eb0f105685b7e3839f9634a5530cf38fa1a5b353a5da8d818b4079bd0d0cbf5", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "zobpx", "colour": "#1278FD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769209277, "uuid": "08a9a9a7-8e00-43c8-93f8-75270a5dd4bc", "value": "T14A759E55B2B400FCD167C178C9475A0BEBB278061770EADF57908A6A6F23FE11A7E324", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769209277, "uuid": "4c53bae0-35bc-4b19-92a4-3adfa7c26e6c", "value": "14c00cd98c6c67089f15befbbc9b5dc3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769209277, "uuid": "43eee992-44e3-486d-9b08-3b2ed4a0b58f", "value": "24576:102+h4Q8qAjv6qfjq1nJAfPVHDClF7rDheENnlBtSq1OqrXtd0RlgbCpS:BQ8FDjWJAfPVHCpheENndr5r03gb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769209277, "uuid": "a1098919-e9af-4032-a40a-e2ab792697cf", "value": 1665536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769209277, "uuid": "0ad19344-6976-44a7-92bb-45382983f0f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769209277, "uuid": "48ae82bc-fa4a-4ac0-b0a7-c3467ba4cde8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c845cd74-f866-11f0-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1769178077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769178077, "uuid": "94ef44ad-8cde-494a-910d-1f5b4c161619", "comment": "Malware payload (SnakeKeylogger)", "value": "474bd70f36a4f87502f21b5d3f5b47aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769178077, "uuid": "971982a1-ac47-4556-bf7c-5e0e45662dc7", "comment": "Malware payload (SnakeKeylogger)", "value": "bedc78d97f795d218b247e923f1e7b671543c471b29387805040c1676f6a2115", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769178077, "uuid": "c8602bed-fb58-4294-817a-0dc392a1593b", "comment": "Malware payload (SnakeKeylogger)", "value": "498cb179e7382d86905e6051065be1d9211f091e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769178077, "uuid": "3a936667-b6db-4851-9147-d4bc0dfbac1e", "comment": "Malware payload (SnakeKeylogger)", "value": "1fbe93c0b26dadd88049d83fad02fc6f67651eac8d3cef828c0ffed8461342c8278049266c680363d4575e7d8bbc8f6d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769178077, "uuid": "1ecc07c3-3d7e-456a-97a1-943ada9de9a0", "value": "T1C755AE15E3D812A8E627D634CB926632E6B574560751A9CF0B9CC3152FB3ED0AB3F312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769178077, "uuid": "062f1695-5354-46d6-9a6e-b43f0be6f7a2", "value": "209af022651db410186719002f7b1b8a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769178077, "uuid": "543c17d2-6358-4e83-9cf0-0710aadc35d2", "value": "24576:B6vP1MMG6FAfS0lbX6qnmOKfBQf4vegzaMR:B6KMG63qnFKp84Fz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769178077, "uuid": "6d395626-d20e-4403-a172-f7d36f752f1b", "value": 1328128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769178077, "uuid": "3107c5cf-a12c-46df-b58d-ccd3e4bdf19f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769178077, "uuid": "30d0eba9-b48a-4c12-a3b4-7e3106ce438a", "value": "edit.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78674bb7-f829-11f0-a129-42010a9c0007", "comment": "Malware payload (BlackMatter)", "timestamp": 1769151744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151744, "uuid": "f2f2a298-91b3-4c66-86bd-fe4f7fe55cc7", "comment": "Malware payload (BlackMatter)", "value": "c4769bd7f6171a9eee43dac802590fdf", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151744, "uuid": "6ccd1f9c-0807-402e-a38e-43bc221249ee", "comment": "Malware payload (BlackMatter)", "value": "c2e8cdd98f0d5c1882920816ff19adaaf0961462d117ca47ea0cd00545dd3ad9", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151744, "uuid": "16deaf36-8d53-4a46-a242-fba5b80274aa", "comment": "Malware payload (BlackMatter)", "value": "0b777032dae92569dd132eecb6c2532d82141a8c", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151744, "uuid": "297100f4-2f98-414e-8455-7b5f6638bf12", "comment": "Malware payload (BlackMatter)", "value": "d584a931f68143423a7e874d486583d94ad8ca7c686c56d88a0f53fc4204ccfb226e3af0c40a60e4191411a10f9ef003", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151744, "uuid": "2c114046-85b2-466a-b85d-27a596ba9649", "value": "T1E6E37E21F522D073C87718F13736B572F39E4E6C19996847EAE80F99BCA58232F04997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151744, "uuid": "baf07548-1cad-455f-84b8-6d5d383bba9d", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151744, "uuid": "cb98fd03-c485-4d0b-b75b-dd84a12d9ed9", "value": "3072:u6glyuxE4GsUPnliByocWep046zyyYanL3h4HwV:u6gDBGpvEByocWeOdWKn1owV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769151744, "uuid": "0d167892-307b-4fc2-8729-adccda272bf6", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769151744, "uuid": "6362319b-6842-4b87-aab5-09efe6480c40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151744, "uuid": "69ecbcae-139f-47a1-a05d-425e1dd2902b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2f11e17-f8a0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769202952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769202952, "uuid": "6707a1d5-e922-46ae-af8c-1cecf11c75eb", "comment": "Malware payload", "value": "8b7ab75e98ab3d70624e19306a3e73db", "object_relation": "md5", "Tag": [ { "name": "BRAT", "colour": "#9366DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769202952, "uuid": "3670d1c5-ea01-4f01-8e49-c5b7e947d26a", "comment": "Malware payload", "value": "c3c5c914f28e29d9df082774fe16d57f58d97fbab474f5afdac35eaecd3c0b4a", "object_relation": "sha256", "Tag": [ { "name": "BRAT", "colour": "#9366DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769202952, "uuid": "0e6ad2e8-69ab-4c34-bcae-e4862f2fe9a3", "comment": "Malware payload", "value": "c17a01110ade2c80fe4b7812d4820c2dfe2779f6", "object_relation": "sha1", "Tag": [ { "name": "BRAT", "colour": "#9366DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769202952, "uuid": "5a964172-6372-4799-921c-20a11b7e55fb", "comment": "Malware payload", "value": "c983cb1e1f462d09e45bd1d2bb571b3d148b713f0b0f6990a6d1f7635ee6d8b75bd3fdc445af02e89d27f6034c920b50", "object_relation": "sha3-384", "Tag": [ { "name": "BRAT", "colour": "#9366DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769202952, "uuid": "6d671b6a-4ad4-4c37-aec1-592d9cb61ca6", "value": "T14466D0CAD16B40D6CC067FF598142BC39B3096324A34046836ABBD585F779FAC11EEB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769202952, "uuid": "3b0dba7f-65d6-462f-b9a4-e6aa1b325c17", "value": "09bf3c2c0d1e1c721043f5ca267758f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769202952, "uuid": "0c8493ec-273d-4579-8cf1-81d89e66e0d2", "value": "24576:+x6aUzIs4nj7ZXcW9Nk/bJCIc0FkBt7sK/wl2xKcLt3h9/22+ap4/4uFTTlgebz4:+bpDl2NfhMeTD4rjsgXU4kBo8xw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769202952, "uuid": "f6542975-4115-47fd-b960-b28294aa6395", "value": 7014912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769202952, "uuid": "fc0612af-3a44-4aba-8a01-b7a635f999c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769202952, "uuid": "a51dc060-6215-42d7-99b5-6005315186f4", "value": "c3c5c914f28e29d9df082774fe16d57f58d97fbab474f5afdac35eaecd3c0b4a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20fa6607-f846-11f0-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1769164053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769164053, "uuid": "7b514c44-d287-4c69-a1b4-bfb6ec1f6823", "comment": "Malware payload (PhantomStealer)", "value": "8e886f9575d01d81dcb3fc1d757a7764", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769164053, "uuid": "a54ec9b6-bd3d-4da4-86c0-27f2bbc43bcf", "comment": "Malware payload (PhantomStealer)", "value": "c5b19f04f5eadd03d2f8487c69a6006c39f3160ca225c8b293f35d836810c50c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769164053, "uuid": "19fdf381-3640-4b41-b033-b0fed1d023f8", "comment": "Malware payload (PhantomStealer)", "value": "3aa2232f826cb458165cd3c5b0710056c131460e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769164053, "uuid": "276c899b-30d0-4f1e-97fd-f09224cc968d", "comment": "Malware payload (PhantomStealer)", "value": "a7f146a72c5dc9fc4f10cd91c173717fb130d1ee7777fc1ad05dc0791baea37b670a0c0e932714c0c0e7be2397192781", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769164053, "uuid": "4186c9e0-45db-4750-bb01-43e810c8b6ce", "value": "T12FA4D087F980D5C2D818483699739730127F7C79AA8D87D3A34872523A731D7663BEA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769164053, "uuid": "395bbd43-418c-4456-818a-955d1c6931f0", "value": "ea4e67a31ace1a72683a99b80cf37830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769164053, "uuid": "1076e4fe-b507-4fc9-b989-68c4cd6ac0ec", "value": "12288:XcODb7v0o8JvG5UFP+ibiucOTjjjjcjzjcjcjjYXo/+rfk1E4R/VBupQLw4aK:sO4njjjjcjzjcjcjjgo/Cs1E4R/VBups", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769164053, "uuid": "2d90e77a-a604-4472-97d4-9f79dbdf7eec", "value": 468222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769164053, "uuid": "a1bfac20-f0eb-4a55-8cba-cfea83f36da3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769164053, "uuid": "b1f01046-9212-458c-99a0-80f286166bd0", "value": "Purchase Order.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb549d73-f830-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769154863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769154863, "uuid": "0a30fdf9-9567-4df4-80f8-75946f079494", "comment": "Malware payload (Mirai)", "value": "37fd22a315246b9d78354e7e5d7db97f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769154863, "uuid": "40ebef5f-dd7b-4c32-9be9-8e7877e82148", "comment": "Malware payload (Mirai)", "value": "c5dd0aa5237192f9f7ca53d0742e2668f7794e8a1e20df5dfae8ee86638a069d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769154863, "uuid": "809433ac-f169-4126-8698-1e186893abe2", "comment": "Malware payload (Mirai)", "value": "de1f10ef4879138fdeec972c30adfceb203907c2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769154863, "uuid": "fc21df37-2eaa-45f2-bfe6-a798a1c4e462", "comment": "Malware payload (Mirai)", "value": "fb32deb8bbd654bf09969071bb6a31155c6a5ab84c77a9a7de008bb36bcba010df806441e7f8583124ca7f3a16b6b2a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769154863, "uuid": "5e330ee0-c564-4439-bc65-8c2cbd94e14a", "value": "T10B936CC5F683D4F5EC9705B1113BAB375B33F0B52029EA43C769A932ECA1510EA16B9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769154863, "uuid": "b530a039-22e1-4dff-9bd8-838c7b5acba8", "value": "1536:xpG2cWAcCghsZcWU3S8HsStOU1gQI68jne8Fs8ZyYDdw8SAwHEoSrtAjm0xZ:xpG3WrCEjWUigLl98FgY+8SFk1Im0x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769154863, "uuid": "c5895c6b-465d-446b-822f-50e72ecdf3af", "value": 89608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769154863, "uuid": "91f65375-0ec6-44ad-a61a-7c50bae96e85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769154863, "uuid": "01ceb2ff-e7a6-4911-b6f2-05889f9e8ec4", "value": "bot.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6068ac92-f860-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769175326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175326, "uuid": "bf328217-4a87-4c00-8d5c-090ba4d4e20e", "comment": "Malware payload (Mirai)", "value": "b086e7b0fd69ba5cf942562b4a7afda0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175326, "uuid": "1b5fef27-b9ec-464f-a2fb-b77871040bbe", "comment": "Malware payload (Mirai)", "value": "c751ddc7fbfc0144120d12e76f921671883c8f531abe162884c4dcbe15f599a2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175326, "uuid": "521b40e2-3a38-4586-9b98-d5d4fd768f78", "comment": "Malware payload (Mirai)", "value": "af285715eb67e743bac3af8f8b789678e81761b5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175326, "uuid": "882a186d-a3cc-4ec9-ba26-a264aab8aa63", "comment": "Malware payload (Mirai)", "value": "855c77c5e2a18e0e1aa1a5bdd8d4402584109c5041856f6b151b5601d5d3199be9eab893d7a1db1e8081bb4a86a552ae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769175326, "uuid": "2a27e44d-6e5c-48e4-89ad-8c32e80a50b6", "value": "T166934992B810DC7EF81BE6B680570B16B224B7E15E426F277527FD23EA6D1682812D43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769175326, "uuid": "f6875776-a22f-47c2-a6c8-45adc0cb4e95", "value": "1536:SH4byJ9/xnWOsaMLZJHoaC6DR103XKrj7uZZkPJjeJYyconc/V8VpWuSV:SH4bMZJsJvHoyOnkOAaYJonc/yWuG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769175326, "uuid": "02ade844-e25a-433b-8689-0a014afc7df8", "value": 91956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769175326, "uuid": "d6d22c0b-e4c4-4e39-8b2b-37cb60f89f3a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769175326, "uuid": "32ab79b9-d6b2-4c1e-936c-9e72a2943a1b", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "919acedc-f851-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769168966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769168966, "uuid": "e8b10447-94bb-43b3-9d46-8d9343502a61", "comment": "Malware payload", "value": "e6f76a438cd97013b58aacaf14ba0972", "object_relation": "md5", "Tag": [ { "name": "77872549", "colour": "#402254", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769168966, "uuid": "8bbcd7e8-5f0c-41ad-8a58-5554ff706ede", "comment": "Malware payload", "value": "c7a55cd3d49647085f86f45f24ff0c08e27489427ff836f9b75225753d14f859", "object_relation": "sha256", "Tag": [ { "name": "77872549", "colour": "#402254", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769168966, "uuid": "7f416292-99fd-4659-92ff-388cd27a76bb", "comment": "Malware payload", "value": "748c3895fa7973181f33a8ae5582aa26fee80a5f", "object_relation": "sha1", "Tag": [ { "name": "77872549", "colour": "#402254", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769168966, "uuid": "9a09c3b1-4e78-4bca-8b23-232e6ef1f7bf", "comment": "Malware payload", "value": "09bc0be6a056ac1abc8f32a8899737da400f801416e3bbc1d373529e9ef616bbd4d999fab3431dfe3c47770421563593", "object_relation": "sha3-384", "Tag": [ { "name": "77872549", "colour": "#402254", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769168966, "uuid": "5f30a50b-de69-47d8-8aad-793a264bf92a", "value": "T13852C0D8081A1CCAD558BE76B47EB35E9A6407A4847D5B8EFF8083C04CBA6379D707E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769168966, "uuid": "292f4761-702f-4784-a277-7f615ed92cdf", "value": "384:GV5qrKTlVIglpntqa39FLGbzqHBXKX5K9JoSDv8ZWK:GV5qUlugll2bzgBXA5K7v8t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769168966, "uuid": "b5a49284-d5f0-4db5-9e00-54b4bebd5513", "value": 14420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769168966, "uuid": "69b1ca0a-e633-4ac8-906f-522bcd11a902", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769168966, "uuid": "51287759-5dbd-4642-81d5-e2534368912b", "value": "skstealer.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2ed862b-f843-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769163117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769163117, "uuid": "1d22ff2a-0c17-4b85-8e41-21c6b02d48c3", "comment": "Malware payload", "value": "da835e52b344c72ca5d2b64f77c512af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769163117, "uuid": "a07c7509-1c7d-4cb9-8b03-f21e1d0f4b2c", "comment": "Malware payload", "value": "c7af907f85140bab90d131a2a0152eed646dd73304f5d0b0bd8dffd9008aef59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769163117, "uuid": "a1a525ed-76e5-4901-854d-05f5ffa126ca", "comment": "Malware payload", "value": "d339e557ef85394d4d8ae0f0211abc1b972380af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769163117, "uuid": "319e5b3a-8f9a-41ae-b4c2-5e40d8f422be", "comment": "Malware payload", "value": "643e40ed4a4d03197f346dcd6208bbc9ee731878e5907daaaf7eef99ff06faf4d06455a1315049fe761bc18e79568ec5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769163117, "uuid": "0df273bc-5f90-43e2-b886-adaa673dee4a", "value": "T1C98633923992F875C4791734ACA6DC536F4E2691570188F3B035AA1ECF943F8EDA22CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769163117, "uuid": "6a2690fe-103d-4c42-96ad-4a250666830f", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769163117, "uuid": "e6f44713-be82-4e71-9a48-e1a91d6ea386", "value": "196608:5RVXSRp2lEgYAp7vOiR7g37lIjP8uwzJLswBuf:VXY2yap7vUrm78uwz7m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769163117, "uuid": "f7be76c5-e608-4b9b-aa8f-f08dd7c9382a", "value": 8524288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769163117, "uuid": "17a37056-e4f9-4609-a1c5-14d491a42116", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769163117, "uuid": "724ffefb-b13b-4bd8-87a0-69ca68c0b58f", "value": "c7af907f85140bab90d131a2a0152eed646dd73304f5d0b0bd8dffd9008aef59", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eab4b058-f863-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769176847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176847, "uuid": "7bb4d483-3173-4ee4-a70d-e5b40fc47859", "comment": "Malware payload", "value": "475d8a19aba468d5fe577bba57495d9d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176847, "uuid": "4932ca51-2baf-47c6-8b82-79fec4deed6c", "comment": "Malware payload", "value": "c8097f357cce587584328eec1140c39c9432c15e81ae53805659178d061209e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176847, "uuid": "fd696ee8-2b2b-479d-bb5d-4163e023c0c4", "comment": "Malware payload", "value": "1869a8faebc811d69b38e9b46429b676a2b63811", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176847, "uuid": "f4b3894c-c193-469e-a2fe-d351dd92e92c", "comment": "Malware payload", "value": "4ac5ec6b690668a4ec4b2b4904647d0c4daec7d5a991750b553599e42218be132be85453ff5aab966d30b551e45642ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176847, "uuid": "cfbdf834-07c9-47ee-8ffb-061625404079", "value": "T1ED433A80BFDA5411F3BE0A7C6471250447B2B9176D35CBAE0DDD00A92A63BC4A7A47FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176847, "uuid": "0c0f0984-d90d-4b27-9a00-641fb02a675a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176847, "uuid": "7967b830-03af-4442-aab8-9108e5159677", "value": "1536:SmzZSIXxpCVdkj34b+RmqJsTOWWEQX8s5JlG:S1amdkj34bGmqJsTOWWEQnJw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769176847, "uuid": "117e74e3-b8df-4427-9523-9e150c64523a", "value": 56320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769176847, "uuid": "6f8c9023-3f98-4253-a0de-055cf9a31224", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176847, "uuid": "8745926e-147d-4b09-b542-34d2e38ab0f4", "value": "loader_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fff860e-f867-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1769178251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769178251, "uuid": "df69850d-627c-42a8-a764-7ea26677dd9c", "comment": "Malware payload (AgentTesla)", "value": "5459843728e0ba6c680e27c2e8b1e8d3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769178251, "uuid": "4a4a40b2-4b80-41ef-945d-999b454edfcd", "comment": "Malware payload (AgentTesla)", "value": "c858553c76d245bc3716404a7af7892aa8357dcd61bd9578a0dcc743fbae0d0f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769178251, "uuid": "884efabd-f891-4f45-a902-fdb6f295fe57", "comment": "Malware payload (AgentTesla)", "value": "28d7d1f04aa7bf46ed5d71ae423de876825bbb13", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769178251, "uuid": "50a46f64-f54b-455b-ab82-396e08672d6c", "comment": "Malware payload (AgentTesla)", "value": "a4d0b04c49a602380b740828805c40009265f5032055d8b962cfac60cf20743891f262b5e643cea559ecdc96c738fee4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769178251, "uuid": "13308534-d0c4-4981-81d9-3848e510ed4d", "value": "T1FEA3B7C977C9B03807673827776FB09AE52FDF91614D4060E28A9D98BE21309EE7953C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769178251, "uuid": "f79944cd-64df-46d3-a431-735f942ad703", "value": "1536:WfaSqgntF1Mon0Aj9j/59GbEmGWmAED/pM3nNHlwcNfy1:WfQghM0jR9MEbWmAEDhSnNH+cN61", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769178251, "uuid": "975a36f2-f306-4913-90d1-d0d585935ab4", "value": 106107, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769178251, "uuid": "e5aa62bc-b8a3-44cc-beb9-6f7b9a6c5f58", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769178251, "uuid": "884d3f01-6b94-4ed8-8e2d-b459c15a23be", "value": "Requesting For Quotation.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d373500f-f892-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769196994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769196994, "uuid": "856762c4-e3f7-4a2a-a56c-4ff5d39afe24", "comment": "Malware payload (Mirai)", "value": "9357ae324057a7e1b1864636d53004d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769196994, "uuid": "c6eb93ce-cd83-4dbc-849f-6199099270ef", "comment": "Malware payload (Mirai)", "value": "c89b12bf0b7149795df0077e37f9c1daf7df6bd63e59aa00a09d1907c3a78b7e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769196994, "uuid": "a68d8763-bae5-41e0-8587-d944345ea3da", "comment": "Malware payload (Mirai)", "value": "35ed9cb961b4567048dc0d18bf6b4963ef4a9160", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769196994, "uuid": "fbaf022a-2781-4579-ae14-35efa7f5d251", "comment": "Malware payload (Mirai)", "value": "d9b20acebbb4391572ead901abd025f16dd64724252606aa0c600153a6f20c3cd00c6055b1cda3e0551857174005ed3b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769196994, "uuid": "94937893-4a69-42c2-9c4a-17b639d60a93", "value": "T167643A23FB0C1432C8A29E712D7B2BE6A339D9E16575E10954096F2D2F32BB0598777C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769196994, "uuid": "33444c96-3cf2-4341-935f-c3a562233868", "value": "6144:yqYfb+SGmydHzl2DiB7wt28cJ5tMlrW4IrbR8ttQ:y/G1NVbprbR8ttQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769196994, "uuid": "e389e6f4-00ed-49be-9799-4647dfd61b59", "value": 313072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769196994, "uuid": "a36f2d83-76f9-490a-a6ec-6b26086a32af", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769196994, "uuid": "e7355dc4-b5e2-47bd-85eb-9bf59da612e1", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8880bee5-f899-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769199875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769199875, "uuid": "2cf131d8-9212-4242-b9aa-9606f318a270", "comment": "Malware payload (Mirai)", "value": "27da4245602852285ec042e717a591e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769199875, "uuid": "4a270923-0e40-454f-b1ec-4919c62930d2", "comment": "Malware payload (Mirai)", "value": "ca992f2e9111102e4994ed33b54340f034905edb830f3aa767bbe84aed757c25", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769199875, "uuid": "b8f713af-a9b2-4994-8b97-f8de35ec7034", "comment": "Malware payload (Mirai)", "value": "c8bdb2eb5d384f402646925d2c2a81c2f056b6c3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769199875, "uuid": "7d568673-83e0-4c0e-9d99-487d25b98e4d", "comment": "Malware payload (Mirai)", "value": "1182e024aa29dcad312432de9ccf0f66641e11ad120b9e90a62c6dfd57f470f9d42023b588d9507c2e282e46ddb46443", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769199875, "uuid": "e5c1a2c5-73fb-47b4-85f1-aebc01b730b1", "value": "T123B312BEFF12F71CDEA9F2BB752284D302249236521B420D94063708177DA7D87EA917", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769199875, "uuid": "66cf1e8f-c29a-45a8-b642-af0c7702e422", "value": "1536:P0rRFX2eaEgRN/GdhrzVnIuGEwOjC186pyEZqpoT4U8zM3Q7cIqO4Ng+vmMh35gc:QRMeGv/Gd9GgEYeqpk8ziQ7cIq72MhZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769199875, "uuid": "29cfaaf9-d6bc-4b0a-b0e2-a45e35e3e29d", "value": 108476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769199875, "uuid": "1273d571-b801-4158-8b16-6a07fcf23f87", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769199875, "uuid": "6b8af23f-0db6-416a-8b3a-511fc278c451", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53f2e068-f861-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769175735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175735, "uuid": "4d62e338-5131-4c4e-8acb-b9b417c65682", "comment": "Malware payload (Mirai)", "value": "a87429342f4af8da8320620da56bcb70", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175735, "uuid": "59cf0908-f9df-434c-a93c-c839b88f8275", "comment": "Malware payload (Mirai)", "value": "cb389bbeb9a072ca962220a325a7289eb5d87ececb7bd458ef10c5bb3730ce15", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175735, "uuid": "7c68806f-266c-45c3-889d-6bc11c0c6887", "comment": "Malware payload (Mirai)", "value": "d602b0857c98a4929dae7548464bc1727e247599", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175735, "uuid": "02d39032-f835-4076-a754-03e9d94627d4", "comment": "Malware payload (Mirai)", "value": "a0425b4ad6badf36404e87e91dec3faf1c5f3d9dd4b7149cba6caeaaef58a2d4e633a22f9761c4dd57eacb10a56a3071", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769175735, "uuid": "ef2ecfec-524f-4bf2-a419-dffa5e173ba4", "value": "T1BE736AC08942F4F1E819017561AAF3336577CDB901A8FDF7F7A45732A42AAA0728774E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769175735, "uuid": "9f925839-56bf-45a3-8382-d34724198c97", "value": "1536:7VWo+Mi/FpAvD3928OirT8+iqxK2z6fyhZLFU28iNhzh+spz6Gwb2ldbiNb6uBE:7VWpjtp+r92/M1xZ6f2ZLFeiXh7z6GIJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769175735, "uuid": "c2beacaa-a039-489c-b18f-346c1ff6929d", "value": 78932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769175735, "uuid": "f6fb2cd7-31f1-4859-9114-dc236f70b69a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769175735, "uuid": "56808f27-b35f-449c-9600-1faa0ea62afc", "value": "nklx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a182b513-f863-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769176724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176724, "uuid": "fcafdadb-734e-4c41-9f9e-0a107b67765c", "comment": "Malware payload (Mirai)", "value": "328b1cae7253495e76fe0389895f9a36", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176724, "uuid": "1438bb14-ad51-43e7-a591-96d20ea9ef62", "comment": "Malware payload (Mirai)", "value": "cb50b25b6f92409f629ffec8c4284fca41509f5c93b960ea1e85af41964c175f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176724, "uuid": "aa12ca94-1ec6-4274-9d38-3e4e8753061c", "comment": "Malware payload (Mirai)", "value": "92c787bed54806c69b119fe9f601bfa17202c458", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176724, "uuid": "b0801945-ef89-4d8a-a42a-c21be905139e", "comment": "Malware payload (Mirai)", "value": "46d241ade6adb1a2453b9b4e6e977b1aecd5b4d56a8b40db11bb1ff7271cff340f7abddc485ae61a80ce86406eab1496", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176724, "uuid": "d0c8dff8-bfb1-4ad4-ba4b-00e87505c1cd", "value": "T140835AC14242E5F1E919017CA17BF337A532C97802A8FDF7F7546A32B825960B18B75E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176724, "uuid": "eef3d7f0-5750-4b29-97b8-c4e4f7e2d6f2", "value": "1536:L4COPqifHf/SL4E8+6adUCsmTz2Hb72PB06onBLrBzvWnVWoBcxxHLme0NfOedsE:LJOiQ/KsEbpTTOb72POdtczjavBI2u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769176724, "uuid": "fafe3ae9-84df-4489-a05b-a84703703dea", "value": 84308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769176724, "uuid": "e1e63ed3-ba61-497c-8f77-9e5ff45c9dac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176724, "uuid": "a2353dc4-4397-4665-aaef-147ec0e1c407", "value": "splx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74e4756e-f7ff-11f0-a129-42010a9c0007", "comment": "Malware payload (Phorpiex)", "timestamp": 1769133699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769133699, "uuid": "0177f3e3-64ca-4bb4-8638-bf87f131655c", "comment": "Malware payload (Phorpiex)", "value": "cf9a4239b1087b75ff146a2ea9d56932", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769133699, "uuid": "6bac3783-7111-45e4-a2ee-fa35d35c1b1f", "comment": "Malware payload (Phorpiex)", "value": "cc57c7cfed94cb9e9a894e236cab91920c80a3d91631e87803aebf71538e7cd4", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769133699, "uuid": "49605747-4bde-4821-ba43-66e818ee7108", "comment": "Malware payload (Phorpiex)", "value": "7108e2e51f2b9258dad6c454b514235de315bd3c", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769133699, "uuid": "4289b935-7102-46c5-aa53-d821ef425eed", "comment": "Malware payload (Phorpiex)", "value": "e330c71fe2bffcf27cb5ce6b0e84017b01a1291be638384e161e39267e225cb8a2019dc38d62fe6a5114dbd86fa9beb9", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769133699, "uuid": "e2fab99e-008c-4176-b371-1930af623567", "value": "T102B37D2030C1C432E566117688AAC7B59A6EFC310F75ABD7BFC406BD4F266D19A36387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769133699, "uuid": "d2e024dd-9c25-4c23-88e2-4506d62a6e93", "value": "c6cbbdd643acf2dc6daa2bfb97e98d80", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769133699, "uuid": "a96851bc-7d6f-449c-861b-b4e11300ca25", "value": "1536:dF2SamUOgdus61Mzmx0CH6FIlL7MdcsKPJvYZNm0WJc5mmQm:D2S9UOQVe0CaFkL0cG1WW5mmQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769133699, "uuid": "f7e6ee05-425c-4a62-b0e4-2eb0aa3e0295", "value": 114176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769133699, "uuid": "321685d6-66f8-4845-a8d6-30a91a73ba28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769133699, "uuid": "2308558c-f69c-452f-b51d-d398a0501b3c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce20f5c7-f83a-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1769159189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769159189, "uuid": "b2503329-95b7-4299-972c-9f9a31338f43", "comment": "Malware payload (QuasarRAT)", "value": "279338cdf8f6f48f2e76eeaa6b772951", "object_relation": "md5", "Tag": [ { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remote-access", "colour": "#FEC683", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769159189, "uuid": "650921e4-42db-4697-9119-28904f50038f", "comment": "Malware payload (QuasarRAT)", "value": "d0af519d6768c37dd91b94ed06f078ce39e3fa5b5c8a241cbd2f9cdd2d2e4c24", "object_relation": "sha256", "Tag": [ { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remote-access", "colour": "#FEC683", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769159189, "uuid": "abedfd95-f8d0-41e2-90c8-a7f6148049ae", "comment": "Malware payload (QuasarRAT)", "value": "e3e40595f4385dcb0aba56251675b827483a4185", "object_relation": "sha1", "Tag": [ { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remote-access", "colour": "#FEC683", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769159189, "uuid": "571f7210-24b6-4a6b-823f-8476e65074d6", "comment": "Malware payload (QuasarRAT)", "value": "89e88bbfc64eb87446cb9b269cb46604aedd6701785b49977da7f2e34dbbe587cf7ddb02cb7ce57fe87136747799b825", "object_relation": "sha3-384", "Tag": [ { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remote-access", "colour": "#FEC683", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769159189, "uuid": "70d7b9b7-edec-4d34-9ca1-ccbb2cebdc45", "value": "T124E56B143BF85E27E1BBE277E5B0041267F0FC1AB363EB0B6581677A1C53B5098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769159189, "uuid": "9b0c3e6d-de1a-4ba5-a501-92ea09732dbd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769159189, "uuid": "e73c0530-495f-4bc7-aa16-b4a49734a4a7", "value": "49152:Qv69a2VoaSCKAPol5uFrvtph+hMOVRJ67bR3LoGdG9THHB72eh2NT:QvWa2VoaSCKAPol5uFztph+KOVRJ6N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769159189, "uuid": "660338a5-24b3-49bf-a583-c837d7838a63", "value": 3267072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769159189, "uuid": "ee7dc718-26f5-45f8-967b-19a451bcbd89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769159189, "uuid": "82af17af-46c8-459a-8ee6-ae61fd2254d4", "value": "BPDNetworkCitadel.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2744d58d-f883-11f0-a129-42010a9c0007", "comment": "Malware payload (TinyNuke)", "timestamp": 1769190263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769190263, "uuid": "c6f27849-ec29-4f8b-8059-abc16644380d", "comment": "Malware payload (TinyNuke)", "value": "7ca2e5f229fcbfe99ae59c0ea55e95c3", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TinyNuke", "colour": "#A399D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769190263, "uuid": "a28a6175-42be-4ded-a459-dcacd0c23e86", "comment": "Malware payload (TinyNuke)", "value": "d22d60c754eb0bd1625d28dd7efaf4ca85fc034132831e9ece586f6c67bb5989", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TinyNuke", "colour": "#A399D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769190263, "uuid": "e084a1f9-eae1-40d8-9230-38178ab7d0e7", "comment": "Malware payload (TinyNuke)", "value": "9fc1c04a996c7f7bbc8aeebf8fdc8971d1aead2e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TinyNuke", "colour": "#A399D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769190263, "uuid": "a283718a-1a4d-4fa4-823e-cb01234d7a41", "comment": "Malware payload (TinyNuke)", "value": "c44e63f38237c6ea47cfbd528d6bb47bf29ab88a2df07b40bb3e5a4f1b02c0678f81d40e905fdd41b4ab56933eda9fc5", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TinyNuke", "colour": "#A399D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769190263, "uuid": "f6789623-fb88-4e46-b960-97090da9ffb9", "value": "T172E2385F5DD0D8A9C8C346F96D0C672CDF9AAA7725D0932B8F6012A4E365266EC1C0CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769190263, "uuid": "d54f0c10-a63c-46b3-8494-f46addb6490b", "value": "16dd26b41c61918a10215696235d9e9f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769190263, "uuid": "03f4cae1-038c-4c50-af97-991698880a0f", "value": "384:a8Uv1sfdj0W0Cy471+GWxktv+DqrKMp0i5u/Gkr8iH7gUutz7jBus6QosqSwGiD1:a8CCBTMvdUzu/GkYikT5lp0SwZ/tOZg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769190263, "uuid": "fbd02483-54ec-4315-b073-bd89a8f98217", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769190263, "uuid": "61c03e75-3ab8-4bb2-b4dc-71113bf81211", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769190263, "uuid": "2d5ecc44-c3ac-431d-a4ce-d616c36abd11", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74d77ec3-f862-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769176219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176219, "uuid": "c5a5d49b-b0f7-43aa-855a-7dd3e6c6f3b6", "comment": "Malware payload (Mirai)", "value": "2e9bb71a0a2cd6786eb44764eac4a049", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176219, "uuid": "6cb41c29-654e-44bc-9360-eb1542d93767", "comment": "Malware payload (Mirai)", "value": "d4a7ab256aab8449b3da1e658dc9c50ad3b9401e858642c7c4d54750724c6127", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176219, "uuid": "e216f5c1-3678-4d8a-b8cb-aba96479e1d0", "comment": "Malware payload (Mirai)", "value": "d2dcdc56548fa24dea7f385ea847be8d79eb1c7a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176219, "uuid": "542e17d9-3afd-4ad4-b2ce-2bba20afb234", "comment": "Malware payload (Mirai)", "value": "e9352efc8184efe1fcb34c2c8372b9862bb471e9b35f8746a9f7f2e762901a949fd01e1634a57895531752934123f710", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176219, "uuid": "49b5e16a-97c1-4be0-831a-f4b8ef79f2a5", "value": "T17E836AC14242E9F1E919017CA17BF337A532C97802A8FDF7F7546A32B825960B18B75E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176219, "uuid": "66d028b0-77c9-49e0-85e8-bb2b4736d2c8", "value": "1536:L4COPqifHf/SL4E8+6adUCsmTz2Hb72PB06onBLrBzvWnVWoBcxxHLme0NfOedsR:LJOiQ/KsEbpTTOb72POdtbzjavBI2u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769176219, "uuid": "2dbc309f-6a0f-4119-b557-35dd98bbba13", "value": 84308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769176219, "uuid": "3742edf5-1a42-48de-b1c6-0ea7799e705e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176219, "uuid": "0c852c21-99f5-4dd4-b117-cb81c3e78aa7", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adc00625-f8ac-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769208098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769208098, "uuid": "b0cbcef3-ad02-4366-b891-504273ea7d2c", "comment": "Malware payload", "value": "d0ca35bf6013205425848922957941bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769208098, "uuid": "4b14ee03-7e56-4ba1-bed4-632f26ea0772", "comment": "Malware payload", "value": "d61098f9461e825c611ed01f5f7f78a24102f7ccc84b725746134968c3c7adfb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769208098, "uuid": "b99956c4-0ebc-43bf-b8c1-1864ea80bf2b", "comment": "Malware payload", "value": "01d7aa3d63e0cec9b66d73bc7c0430d5f9483153", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769208098, "uuid": "ea57d43a-f5bc-4532-b173-aee95b767c73", "comment": "Malware payload", "value": "ac7e9b6c707a5f81aefff895ec61869fa15dbc61ed7c2675dbba37e8dd380e08a90a4ad8e2c857ca3321d636ec4359cd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769208098, "uuid": "9059e07a-82d3-44f8-90c1-e0b4a21cc67c", "value": "T140F4F7117D7EB453EACDF6347722A2D9301F7684D5E59036DEA0CA9986F4B68CE23032", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769208098, "uuid": "b7539ef3-543a-4fdd-8de0-fac55523589c", "value": "12288:Sld0eWZ3vWpZPXBQSHka4yegeNMok2/saPS/9HIBirkh7pNCDhGtrGGNy8uCg9UQ:Sld0B3vWrPXBQSH14vgeNMok2/saPS/L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769208098, "uuid": "021797df-d2e9-4056-8f17-6ad7c550cec7", "value": 723733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769208098, "uuid": "6e23ff31-4126-4049-af99-7586a750536d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769208098, "uuid": "eb0ea123-dc4a-41d7-98a6-eeb1b409743e", "value": "kinsing_aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fb10c9a-f83f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769161259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769161259, "uuid": "dfc45ac7-6871-4732-91f9-931413748b11", "comment": "Malware payload", "value": "a5d97b2941a85834474e50b02d0fe79b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769161259, "uuid": "573202a9-9911-4bbc-a40a-a9801f2c3560", "comment": "Malware payload", "value": "d693656654bbc5e11dc0bc8138edc9df3406bfb438c5096127bb149e22d8d67f", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769161259, "uuid": "1b60ed2c-e0ca-4d8d-ba3e-d475d60d4e15", "comment": "Malware payload", "value": "45f296651e27eead0cf608741d9d3863e43e2ca6", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769161259, "uuid": "03532ac4-7e22-482d-8a22-1759e95b2a33", "comment": "Malware payload", "value": "57394303c157b6e27ba0fecc9dde7d2336361ed831112e69a0ceb52cf0a1f7756fb55712d4d12867062d97c4ffbbd54f", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769161259, "uuid": "4dea85dd-dfbc-42d7-9575-78dd5456587c", "value": "T18305236846DDD4CDCB7B6D33D5206F255763203BECBBE91B5A7D808B90A43C021A52AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769161259, "uuid": "6f6d87f4-6fca-4812-b0e2-48c03a64362d", "value": "24576:8wjDvkV2SlvBNsAIu4Wo/P5JT8bax4ev5zLQ:PkV2SlvB2AvS3DQbfeu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769161259, "uuid": "c5e195f6-d508-4fa0-8497-b4008880d89e", "value": 860603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769161259, "uuid": "a5356b4c-9fc7-4e80-bcf6-08bd55f1320a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769161259, "uuid": "98411899-32d7-4abe-80fd-c536486a2a80", "value": "Nextier_Equipment_Project_Files.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70dbc816-f862-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769176213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176213, "uuid": "fa9a24d4-dfb7-4c39-a9ea-3eb92cc226a5", "comment": "Malware payload (Mirai)", "value": "c14461f9b0184ec4fbd5f31cabcddde5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176213, "uuid": "8655fa7f-9017-4424-ad8b-6ee3f44a7447", "comment": "Malware payload (Mirai)", "value": "d793a70419c23f60a095946235db264c70a5606d8cd8c62ed2f6d8967efe0105", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176213, "uuid": "69b073d1-b75e-433a-8cb3-939a08624ad2", "comment": "Malware payload (Mirai)", "value": "678a43badf0fa0d0f0f29d0636e30532cb5dc3df", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176213, "uuid": "971d91a0-f706-40dc-9d57-0cd3926207f4", "comment": "Malware payload (Mirai)", "value": "eaf89908fef5672d758e7f9a4163f1985b7d5a21a940f35b4943988a614b10a6584edc70f00e863896dbf1cf0874d20e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176213, "uuid": "e87acb67-0707-4723-8ec7-d0cc4b35140c", "value": "T11F931CD6BC81CB11C6C166BAFE0E518D33174B78E3FA7213CE185B2E674A8670A3B545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176213, "uuid": "99f4942b-41c1-488f-aa95-e9be493aa862", "value": "1536:f9n/GxuHji9jpt9YbFAh5oEDTYfo/Nssm/pQ34K7sJLpjMWsA/5blMliTwMg7tC9:kuDALqbKh5oED8fKsu4KULpjMW/wMg7+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769176213, "uuid": "6fc6c1f0-81e7-41fc-8f0b-d9e23b17a953", "value": 95472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769176213, "uuid": "4603865a-e5b3-4108-a704-7098e2759dcf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176213, "uuid": "2d210af6-10e2-48ec-9158-a3ae3a18a644", "value": "nklarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b25f3abf-f899-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769199945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769199945, "uuid": "313400f5-cdb8-4ea3-8128-70ea0e2b0725", "comment": "Malware payload (Mirai)", "value": "efe9a8cd77e04b135a292a7895ee00a9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769199945, "uuid": "d96ea279-10ff-4e3d-9021-4a75e03a3a16", "comment": "Malware payload (Mirai)", "value": "d79cb8b5d4ecca7397a9ca2fab067bc204832cc12bfb806946e3067ba8645b0b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769199945, "uuid": "5ecf1a9b-83d6-4920-943a-0112323239a4", "comment": "Malware payload (Mirai)", "value": "d59440619e2e9861a122adcec5426849c0769fee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769199945, "uuid": "1fe6eee1-d2f7-4956-b6b5-4e30d0d4d9d7", "comment": "Malware payload (Mirai)", "value": "c3147d820c2305eef50b056484b1ba226ededd325461f32f463758c7e7d1eefd3ded6ee6bc157bf258d8931915e372a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769199945, "uuid": "6125dea9-1079-47bc-9210-b869f197d11f", "value": "T1E344F85DF890977ACBD1217EFB9502CD33330F68EBDE320589356A3837D6A25993A241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769199945, "uuid": "a4ea4355-6a45-4f3e-be86-b1cc226c2bc5", "value": "6144:4+U+XMdZ88ppgbSfEw6OHGfTrfP60Y+atsVlfWfVnnJNolrCeTt1hssdmTaB3I8b:KDdU60Y+adJNepPnKaxXd0E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769199945, "uuid": "72529b69-98e5-4de2-80fc-1224e009f4a9", "value": 270552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769199945, "uuid": "e0bfc841-f547-4965-aa27-c96c2dd78cf2", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769199945, "uuid": "f7e312ca-2903-4421-9368-0b910cc6b4e9", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d183f948-f806-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769136861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769136861, "uuid": "b41a7e85-8c80-43cc-8530-8f854a818ca3", "comment": "Malware payload (Mirai)", "value": "1d83b3d592ac45db69b7e2ec9d6bf01f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769136861, "uuid": "c5b58757-e815-46df-9f7e-ba68eb4e4b4c", "comment": "Malware payload (Mirai)", "value": "d7b47e5af2494044202f87f02040bd06364679dd2f70bab53292c44c91eb397d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769136861, "uuid": "9e7b3509-fe0c-4794-94ee-2739cfb91707", "comment": "Malware payload (Mirai)", "value": "a515c21e0d6431275b67d66a5c7c66d4369c1d42", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769136861, "uuid": "f17ea598-6286-4f2d-93ff-c922165d039a", "comment": "Malware payload (Mirai)", "value": "97e3568c3e57e32d3399378af16c80eeabe154d50662497d9d1824da33dafb44b1c5d41af8bce4ffa5fc95b817ea0857", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769136861, "uuid": "8fb3c23c-3909-41ff-8ecc-cbcb185fad82", "value": "T1A0534B03A8C180FDC48BD2B8579FA63AED73B8A9112D756D27D4FA236D8ED205F4D250", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769136861, "uuid": "1a1fcd65-4a36-4357-a298-48daee4545aa", "value": "1536:Eg/bRiQ4uM+aEuvjTH0xUDc12INX/3ot9dDWwU:EgVipuMLbvvH0xP12INfo7dhU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769136861, "uuid": "c51d4d79-ee70-4a32-9973-1a61e2d0db56", "value": 63808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769136861, "uuid": "156e4fd9-b2ea-4318-bde1-27b9e5cecc44", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769136861, "uuid": "1bc47076-eb2c-4988-b282-1cfbf9d043cf", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61ab3ff1-f860-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769175328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175328, "uuid": "8f7a5400-8753-4f35-a7cd-b0390a76fcf0", "comment": "Malware payload (Mirai)", "value": "66fca96c6c3defa38a97428eb20dadbe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175328, "uuid": "f70fd7d5-aa25-48c1-8f3b-e5059093f428", "comment": "Malware payload (Mirai)", "value": "d83654476c4fc3fb7445a09a8cc2c6718132b8bdd635472c6e06c3894f394177", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175328, "uuid": "0ec37362-19f0-4f95-abad-cb8675706df4", "comment": "Malware payload (Mirai)", "value": "e474b6511f39865e9e65c6d421a22d1f0a7930ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175328, "uuid": "6c6a07dc-a088-441f-9690-bc3231dfdf28", "comment": "Malware payload (Mirai)", "value": "66354290899df86363fb09239a8104bdecadd479eaf317ecb2fd7b9c0b393d4eda7fdb99071c57499f7b7ec755090619", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769175328, "uuid": "6e39e8bd-3bce-4321-aa0a-11c64512e018", "value": "T12F838D02CCB65DE8F03A7E7120B9DABA4317B505A81B6CB73C4782255017AD8F5A7BF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769175328, "uuid": "c6e11666-2a2a-47f9-bc0f-ebbae84c34c7", "value": "1536:mS4bo4AFEEP+QKjG0EuUaESCsdJfLCn5x3C5xCK74sI9jO5b:mSwRc1+QKjZEuQN4fIy5xx7vIY5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769175328, "uuid": "3e7c0549-7528-4a76-80f0-9d694d21016b", "value": 87248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769175328, "uuid": "4f1f42a6-c81c-4782-9ffd-fedd6042e77e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769175328, "uuid": "d131db66-f805-40d8-beb0-26d5397eda18", "value": "splsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f7974f9-f7f3-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769128590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769128590, "uuid": "dcf48009-6558-458a-8f5b-e47172f35a29", "comment": "Malware payload", "value": "93935934f40c2beb9fa2335e8bb55047", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769128590, "uuid": "da407754-e25a-4a3c-bb4c-f97bd1926a17", "comment": "Malware payload", "value": "d86e5e500f326cc90692d58e1b97cdb174675693fb07a923e6b416b3a465fc5a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769128590, "uuid": "253ce2c5-407c-4632-bdff-56754933fce0", "comment": "Malware payload", "value": "b69605e985034bd2891fe9e9c7323d5a217a991f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769128590, "uuid": "05f0ef17-67cd-4a8a-bc51-042949476494", "comment": "Malware payload", "value": "9dc3500b8089c7443d05dd8b65a0343cd9c67b83bd1fcaae5824c9041ca643a9a268e8e88d6b1fb8f58e8449ef6d490d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769128590, "uuid": "f8750598-303c-4022-a1d6-f7aa0d7c42e7", "value": "T1C8E08655EFB513A4FD41954E5EE021D22489E44968306DCCFD348E619414B00D315A84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769128590, "uuid": "a2d940c1-c67a-43d7-88cd-123c1360b409", "value": "6:hx60uW913nENFXuXL8EArVyiuuXaMI9QKKi+RbV/W9b:nDVuFXub8LZ6YaMEQRiudW5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769128590, "uuid": "2f4fc369-d702-45be-a3a8-4d8956fccb39", "value": 309, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769128590, "uuid": "60a6f234-7ac1-47f5-95b3-b6b55ecefedb", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769128590, "uuid": "0aa2eab2-837f-4401-a613-02d3c7bc7b55", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e22be01-f879-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1769186006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769186006, "uuid": "2dfb3631-c0b2-4bde-ae8f-2a6b6a1d4244", "comment": "Malware payload (Adware.Neoreklami)", "value": "7c3fe6087a4b2eb9ea785519ddef9de4", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769186006, "uuid": "2d6be509-c0fe-435a-90ab-e492893bec4f", "comment": "Malware payload (Adware.Neoreklami)", "value": "d974fc1b867e0913e1d6ddbf6704cf67d9e8dc0a77e0c4fb6da6be74f78cd734", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769186006, "uuid": "d9698462-d74b-4b7a-ace7-a7a801f300c1", "comment": "Malware payload (Adware.Neoreklami)", "value": "3cb9bee1190a6c84652ec684fa616c730ccc6d08", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769186006, "uuid": "355c6104-e3ba-4b6e-938a-cc0b973b0609", "comment": "Malware payload (Adware.Neoreklami)", "value": "417ba295449abaf9bb10af7b66811cc84ea99f075d0bc1bb2e40f7760b6636f07fd4551b8339c958dd2b027bd5c4a312", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769186006, "uuid": "2629fdfd-d3f5-4dba-ad4f-b0471057b54f", "value": "T15376333175C460FDE00328364B49FBEAA2E4CF7559B485737AB686293F38891C97219F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769186006, "uuid": "668db584-fdfe-47b5-804b-6144c0e064f2", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769186006, "uuid": "0cd85813-c307-464c-b895-0516c69c5ca1", "value": "196608:P1OBwy2BYIiU5fVTqkA+R1XKMqQ/WuEyeBrZEEdDK2:tOBwy2WU5NHAy1XxqQ/WAeRDK2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769186006, "uuid": "23ff4f8c-1fda-4513-acfd-415c3db369f2", "value": 7511998, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769186006, "uuid": "e1170bfb-91c4-402b-af04-aa507dc10047", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769186006, "uuid": "91ad7f73-b75d-4a7f-b27c-bb396b243ac1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "551c1b95-f896-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769198500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769198500, "uuid": "0d742ba1-86fc-4978-814c-8e9be377a82c", "comment": "Malware payload", "value": "660389b880dfe5daf5953b13a9541781", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769198500, "uuid": "d74858de-9902-4fdb-9d00-95e893528ca8", "comment": "Malware payload", "value": "da835322226ff886c61fac17595a46b7d37287f789b4cbb6c386fd2108eb7c84", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769198500, "uuid": "3b50d55e-76e2-47ac-8fcf-1879797beb26", "comment": "Malware payload", "value": "430b9aaf868eb9145caa0b9f73a79ace93274b09", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769198500, "uuid": "6b78918a-527b-40f3-a2b3-a83c40d482bd", "comment": "Malware payload", "value": "28ffaf2bdd1c527ec5e1a5edc0639486ffaddca4acb496451fe202b3c7c840be4fef314f4d201f370a97a39d6ba8e443", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769198500, "uuid": "270c5d9e-0069-49c0-af5f-099180ef17ff", "value": "T134968D03FC9555AAC1DAE63189B39253BA717C446B3623D72BA0F3386FB27C06A75710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769198500, "uuid": "2f1f0e6f-7fc5-4a19-b44c-ac8a89bace5e", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769198500, "uuid": "c56aa887-ce57-49b6-b604-243988dd076c", "value": "98304:Bw+30IiExv34oVgp+9A+fBEwaDNzC5FL4US/:Bw+3018vIoVp9LC1iF3S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769198500, "uuid": "e3f157bb-85b8-4096-a345-e6654d9896b0", "value": 8955904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769198500, "uuid": "dc963214-1848-425c-a696-4797a7b2c9ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769198500, "uuid": "d1cb27f8-d06a-443b-923c-be0088fc3c44", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42c928da-f829-11f0-a129-42010a9c0007", "comment": "Malware payload (BlackMatter)", "timestamp": 1769151654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151654, "uuid": "1e62f10b-a6ed-4e55-b2c9-cf9c8cfc5cf3", "comment": "Malware payload (BlackMatter)", "value": "8a182b49d071fbffb3fc10ab1d2b54d6", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151654, "uuid": "025cc9b7-ee99-4889-8fed-6db696e4c2eb", "comment": "Malware payload (BlackMatter)", "value": "da9b344bd9920b1d403a0d62f94881acf5d65b6fea495b04855aba40188e6e36", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151654, "uuid": "0b12fdf0-12ae-4cfa-9404-a53f4e2925ea", "comment": "Malware payload (BlackMatter)", "value": "20e287ff0208f18a2e897c76434b6c83bcff8c72", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151654, "uuid": "03c548da-86a7-4579-bf84-79748c455136", "comment": "Malware payload (BlackMatter)", "value": "1efca15084d78b1b8f0143a44616749c10f6bfb23ac730e3dee2f276ddf00a6fc221cef36725a866db6920a44d51f5be", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151654, "uuid": "d25e5da7-6be2-4811-84c1-df6f463215ce", "value": "T113E36D21F212D073C83718F53736B572F39E8E2C19A56847EAD80F99BCA48236F45997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151654, "uuid": "649eb35c-e5db-408c-919d-0343bd442eaa", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151654, "uuid": "ceecb87f-8805-4318-86c1-1b4a89773a68", "value": "3072:c6glyuxE4GsUPnliByocWep0ifhg1CroIzn6O:c6gDBGpvEByocWeDq1Cs4t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769151654, "uuid": "dbac4d6d-20f9-4cad-99ee-beaf46fe0ff5", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769151654, "uuid": "1f6ae472-cdd6-4b27-a224-77402d9b1ae9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151654, "uuid": "9d3bd39c-a410-474d-9696-c13bdb1310dc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7c181c9-f8a4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769204678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769204678, "uuid": "79d5c3fd-63f0-4241-9ef3-55a6e4470224", "comment": "Malware payload", "value": "2b27b94c01abcd9ac1d94fbeb9bf2c07", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769204678, "uuid": "c8f0eb79-e044-41a6-b978-ee2f868f5b03", "comment": "Malware payload", "value": "daa37257065c0cd4bd467c3705a209a3b65f857710d39c546a5797933485c09b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769204678, "uuid": "aeaadadb-2118-4873-8baf-7f932df3885e", "comment": "Malware payload", "value": "bdf1b0b26ea8cec3a905f0a2fb83d5e1c8e0a00b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769204678, "uuid": "fda6e851-9b00-4e40-86c1-c93ada28d6f6", "comment": "Malware payload", "value": "b27b5ec11efe99467fd99093234b4096aedf2a2bf4ab4a85e450ebf60e110a772fc94a179606231e9b781e55fa45ae4c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769204678, "uuid": "ed2141b6-e47e-4d54-9bb7-496548019aca", "value": "T13095AFB876043DE6E66F177BDA96ADDD03B626239A8BA4CD806477C30563371FE02C05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769204678, "uuid": "933f0206-2ab9-4b19-bedf-0fcf88a8775f", "value": "ad72aec9efd201e91e27001d8bc8ee2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769204678, "uuid": "a8e1677f-0ab7-4094-bdd3-dacecc2b2bf8", "value": "24576:ShoYCBK2eJB0+dpJDLXwAbsL3aIglsVFAaoynVWM1G9FHZHj195oOqMQTArtB9pf:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769204678, "uuid": "a1f574b6-23bf-454d-a4eb-7adcada5350a", "value": 1999360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769204678, "uuid": "cf21aa0b-7c7f-40fa-9a26-39447cbfc6e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769204678, "uuid": "de4795cf-ed2d-4c87-9fb4-fc2208bb217a", "value": "chrome_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33ce9cf3-f829-11f0-a129-42010a9c0007", "comment": "Malware payload (BlackMatter)", "timestamp": 1769151629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151629, "uuid": "52118ee9-7a69-4139-9449-49411aad7ba7", "comment": "Malware payload (BlackMatter)", "value": "ce77b45ef810454154e7858200aeef4a", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151629, "uuid": "80983214-a685-49ff-965a-befa7a5b4818", "comment": "Malware payload (BlackMatter)", "value": "db176add8daa4f1b68ad74b7ed6a123003a7705badcd119086f4f5d9f4083469", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151629, "uuid": "c21a19fb-3639-4784-8926-a7b8c5c666f3", "comment": "Malware payload (BlackMatter)", "value": "c974b1f4671bf1143b991603c2cfb1cab32a29c6", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151629, "uuid": "bdec1404-fb10-40b2-98d3-af8c9f42ab6e", "comment": "Malware payload (BlackMatter)", "value": "57c1e9495d6648ba20f17ebf610206708198b6ed4d9f66c5577686d18cf3bf6e52bb182ad6867e25f38fd609dcee7a50", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151629, "uuid": "2062f6e9-e5e6-4369-b214-c27233234b8c", "value": "T173E37E21F222D0B3C83718F13736B572B39E4E6C25A56907EAD80F9DBCA48136F45997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151629, "uuid": "26fb3d37-fc29-432c-9f2a-badb12b816aa", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151629, "uuid": "139d902e-6c9b-4ae5-96aa-b89d0a8724fd", "value": "3072:r6glyuxE4GsUPnliByocWepioX/mClBe:r6gDBGpvEByocWeQovmG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769151629, "uuid": "2008d86b-0251-4f04-8d67-589c9bb996fb", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769151629, "uuid": "0c828f32-62ac-454c-9452-c649c1361321", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151629, "uuid": "5ce6d481-14b6-4bba-aafa-8e183b02530d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38eb9e77-f883-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769190292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769190292, "uuid": "d2061ae2-95c7-4b93-9e4c-4988991981b4", "comment": "Malware payload", "value": "c04bb3992c05402d3767ea068f2a2942", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769190292, "uuid": "e8aec5da-b1e3-4e30-b772-56cd770366e2", "comment": "Malware payload", "value": "dfd44eef5f9b873047ccea5c7b14b0b25cc0a08bc2e5dfc40fd8fa5dc700acb2", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769190292, "uuid": "1ed3bfe9-05b8-4893-9b1f-e01fa344672b", "comment": "Malware payload", "value": "27cfa94add1508461dd6ec5d0b9cc8e62344d3f0", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769190292, "uuid": "9a8dd65e-81b3-4026-92e5-9c63fe57e98a", "comment": "Malware payload", "value": "543bd83e8e81ae9f12b6eed915d7c5e3778953cb0917403dbe62201f727e78ef905a18e613233e89c144bc52c8a0c225", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769190292, "uuid": "26216982-09ce-4a14-8535-af643407f977", "value": "T1B3C528332CA14DA9C06AE238E9A2318277757F040B7233D72A907B791E737DC5676768", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769190292, "uuid": "b6294ab4-2171-4d4d-a258-53bbaf694b8b", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769190292, "uuid": "8712ffc2-a774-4ff9-a504-7179fd022e2b", "value": "24576:dAMQrNl491pCjddfQ8oRPLhTjiK1B1o9nLGKDod3yQXVh5:dAvN297idfroRPV51suFyKVh5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769190292, "uuid": "85c38337-aec2-4d7f-ade2-df9ba9e997cf", "value": 2706648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769190292, "uuid": "615dfb58-ac4b-4189-8886-99cf8d92abdb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769190292, "uuid": "063e8968-d73b-441c-94ed-80658466be2a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c76ada1-f851-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769168931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769168931, "uuid": "24135c55-0409-4ca8-b900-c43f30e4b6ea", "comment": "Malware payload", "value": "0416ec01f3c5df508bc8392264d3e954", "object_relation": "md5", "Tag": [ { "name": "77872549", "colour": "#402254", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769168931, "uuid": "bd96dac6-40ae-407c-b5d2-59ea7b358000", "comment": "Malware payload", "value": "e0fb6a9dfac0e9544f1a4c39a6e89a35b16b38aae8ad674f3085d7504ee8e3ab", "object_relation": "sha256", "Tag": [ { "name": "77872549", "colour": "#402254", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769168931, "uuid": "d79ab7b8-5518-486d-9688-33debfb5c3b7", "comment": "Malware payload", "value": "cd3572175af590c45ddf9b8b58d0dfc36719530e", "object_relation": "sha1", "Tag": [ { "name": "77872549", "colour": "#402254", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769168931, "uuid": "1badf7cb-c746-45e4-9e76-d87000b4326e", "comment": "Malware payload", "value": "e1a8972a8b27e7d8c2198d8706e00cb78db7ee186667088bfd8cff0c0c7bb035f7ddd18901720b8841e799b86d284db5", "object_relation": "sha3-384", "Tag": [ { "name": "77872549", "colour": "#402254", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769168931, "uuid": "c2ef92f5-fdf9-4fb6-a001-d89ded966d17", "value": "T19B739462DC4B580750B2F38D4EA588C5F7198797A6021E163BFC470C1F7E928A6E46BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769168931, "uuid": "9a823d27-3d6a-4604-80ca-30ff72735697", "value": "768:m81h81zLhhr6rAl+lxert3YJqgBL95lud+jkmI0WIp8l2:m81h81Xhh+jhYmIjIpd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769168931, "uuid": "4d8737ed-a077-44d5-b899-fcf17e935cdb", "value": 73973, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769168931, "uuid": "9bb7907c-a6d2-44ec-b3f6-8b9888c177f1", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769168931, "uuid": "9d3740e4-472d-4539-bf7a-dd370a1a4480", "value": "skstealer.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2160c23b-f89a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769200131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769200131, "uuid": "6b3157f1-ed77-4220-b63e-0616b217beee", "comment": "Malware payload (Mirai)", "value": "289d7e044a9646bea3a9b1d7196e612f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769200131, "uuid": "2437f3e0-efd0-43d0-bc89-a85fab58ffd6", "comment": "Malware payload (Mirai)", "value": "e1070a1fc2fb87915180f0aae2b9632579758e15cc333e79500d9bf289bc645b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769200131, "uuid": "365801f9-b5cf-4223-8772-22549df7f4d8", "comment": "Malware payload (Mirai)", "value": "a2a27a0d72409cecc0115f4b4ab693739e2f29b7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769200131, "uuid": "11a12cda-f032-4ab2-9cd3-c42c34cf4e96", "comment": "Malware payload (Mirai)", "value": "309ad0b1acc6ce5451bed638fae458fd2e87151a041fc04e0eabaf08b495c5db1dfcabaf0b0073474c175ca03741047b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769200131, "uuid": "1542fc46-bbae-49a3-8e81-c94e46912724", "value": "T1A7434C137881C0FDC589C274577FA61EDA23B07E1236B26A37A07E2B7D4AE311F1A645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769200131, "uuid": "96b78893-57d4-4c06-add8-ce29dce47020", "value": "1536:PqNVEOcdTRu+Dj1vuAeHx/U/9+uZX/4Bavtus:PsVEH1GAeHGUYP4Buu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769200131, "uuid": "07229647-de7a-4de9-90fb-5d43bbba8a81", "value": 59184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769200131, "uuid": "d434aa39-a93b-4ad0-b3cc-e6f80977b14e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769200131, "uuid": "1440e413-9905-49bb-88a3-25b0198bd79b", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15cb2c61-f862-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769176060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176060, "uuid": "f19c0026-9445-4f86-95da-3122a794190b", "comment": "Malware payload (Mirai)", "value": "d68197b58dd70a99d942ae3d2d7d3735", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176060, "uuid": "2247e324-d22d-4f79-ba00-b55b8440265f", "comment": "Malware payload (Mirai)", "value": "e175eb2030f608223d693624a1bced22bd031a63e993f230202829571f0e55cb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176060, "uuid": "b5e8a299-267f-4234-ac4d-d9450055e750", "comment": "Malware payload (Mirai)", "value": "f6fcadddca94af32d99cd4c3360d4862b054b175", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176060, "uuid": "de14f0a3-bb3b-4680-a78e-15a463720cb9", "comment": "Malware payload (Mirai)", "value": "e554ff61c1fd0a1389f8f2b815726f1e9833026ff8f2c9db79815c06b26fa83607b2764f790f6b40fab91a5685628048", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176060, "uuid": "6bd0ed64-4fe6-4393-a8e8-9f5893a55b74", "value": "T152B31ACABC818B11D6C526BAFE0E518D33174B78E3FA7113DE145B2E678A86B0E37501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176060, "uuid": "d43994e4-6fd8-40e9-a577-fae2129a4e71", "value": "3072:ZeqnAozfH+Q/EdZfonO2Z/BfXR2bvTRTfiq3MtdS9V7MKty5b:FH+TynO2jf4bv1Tfiq3MTS9V4K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769176060, "uuid": "829d2b87-197f-4f23-98eb-4629dc5a8416", "value": 111988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769176060, "uuid": "b8289339-cbf7-477f-91da-48a56c17e845", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176060, "uuid": "60f7620e-c65d-465f-b2f5-aaf0df5ca7c0", "value": "nklarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3395afb-f83f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769161345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769161345, "uuid": "4eee1b87-711d-4aee-a959-2b114a18e43b", "comment": "Malware payload", "value": "f6a353f2677c35b5dec8aa3f07917860", "object_relation": "md5", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769161345, "uuid": "229cbe42-b9f0-4615-97a9-10e1c5163392", "comment": "Malware payload", "value": "e287f22b47a0bace0b82261593c79e1653666e92ac563c4d7bea8ea9da8d9bbe", "object_relation": "sha256", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769161345, "uuid": "86f3a765-9c03-4170-baa6-bb97a7fa287e", "comment": "Malware payload", "value": "afa7173782fc66a10cefadfb124d8fcd9a1c9bad", "object_relation": "sha1", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769161345, "uuid": "a6b8f3e6-2d0d-4694-933a-9eac101c5272", "comment": "Malware payload", "value": "6f2f65722c3e00d04c7a568ce5f13514f3e5d57cabb7201e18277ea19c6e5be7218eba67cfcbde6a6f5ea7f6b189d14a", "object_relation": "sha3-384", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769161345, "uuid": "1182d632-26d5-40b8-9708-554beeb5b8cc", "value": "T106641256C91FEF0E0B355D9B53CB4C0868826D83A46453D8B7C584DFA71BD1A20BE2EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769161345, "uuid": "fa09cbb1-90d9-4370-a5fb-6be2a9b1fb6e", "value": "6144:mS68ZqUdN32Szi24A/24sUNiZI+d2/iySNACr5pyvL2+bG/:mxwq+e8/fEI+E/0NXravW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769161345, "uuid": "57e58bba-87b0-40e6-9876-72c9e33cd323", "value": 334510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769161345, "uuid": "850ea819-65aa-45b5-b385-3a5c6b4ba21e", "value": "text/xml", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769161345, "uuid": "a760ae94-4557-4e64-8a05-4a5ea53f5bb6", "value": "Nextier_Equipment_Company_Profile.pdf.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bb11d98-f8b0-11f0-a129-42010a9c0007", "comment": "Malware payload (RedLineStealer)", "timestamp": 1769209759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769209759, "uuid": "a4d76402-c5d1-44c5-a665-43b847130f0c", "comment": "Malware payload (RedLineStealer)", "value": "67c6a075b37b11e324c035c032219a48", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769209759, "uuid": "2d337273-999e-45c9-a315-e5b320d97f83", "comment": "Malware payload (RedLineStealer)", "value": "e3829c25e9f38b778ed41aa78f34955a25a2a53236810aadce18dc25ac1601f6", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769209759, "uuid": "e56b3980-c76d-42fd-bd6e-8cd42054a67b", "comment": "Malware payload (RedLineStealer)", "value": "a42e04c1adf37c815aaafeafd9ce9f5ce3674453", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769209759, "uuid": "c783f6de-78c6-4506-af08-6f0a0d5e6002", "comment": "Malware payload (RedLineStealer)", "value": "5579d32ea45628d8ce4cae97c0e00bdda3d2481a200298658c5163670d193e6a59f01bbe76ee3cb68277e7fc7f2af86b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769209759, "uuid": "14f02077-650e-4bab-a584-89cc64be6641", "value": "T19AB4C58336DB0CEAEE932B3C51D76336AB36FE608B3A4B6B5114C2311C135D16E6A754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769209759, "uuid": "4aad2f89-ec93-4b9a-8d99-ccc49dcd61dc", "value": "4c785070d31918effde68a86f76fb27b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769209759, "uuid": "582dfa8f-6788-45ed-9416-fa661a8b4c0e", "value": "6144:MBSbnvsgOFgHit/EXU0cK66x0d07dR3dIe2C6SdBHUWq+9yN86IpKIGl9AvXZq2K:MBSIeit/E2KTbHnSjafJkJ++DnrQBg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769209759, "uuid": "582945db-b5ce-45d3-b6b6-be82856f360e", "value": 502376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769209759, "uuid": "0ae47db5-82b7-48fa-8718-3d5022d8dbba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769209759, "uuid": "bf08bdb3-449e-4ee3-890c-c4295dbcc916", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "868af09a-f829-11f0-a129-42010a9c0007", "comment": "Malware payload (BlackMatter)", "timestamp": 1769151768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151768, "uuid": "55f42ace-69bd-4dda-b114-55759a6439ca", "comment": "Malware payload (BlackMatter)", "value": "5237c1cdd4457db4732d9afb328d13fd", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151768, "uuid": "d725b650-89bd-4362-952a-f01c220276d7", "comment": "Malware payload (BlackMatter)", "value": "e3a3d9e668fa8c144c48299206d7eff67a7dbbf3410ddc2aefc440b6e072bf6f", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151768, "uuid": "dc20ea62-74d8-4f82-803a-7758b05276cc", "comment": "Malware payload (BlackMatter)", "value": "ba444bf1f4c878ed03943fb552cb1f31a56db09d", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151768, "uuid": "76f4bfee-b1eb-4e06-91fb-ff169859e4bc", "comment": "Malware payload (BlackMatter)", "value": "093b7b5b81cb3dcace70b9c6e8edeff8b385c01177f30aa9e20382501c74686744c207a82da5e1a19504dfa5188533d3", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151768, "uuid": "bd1540a3-f3c7-4ab2-85b2-a5a9dde7c23a", "value": "T12DE37E11F612D073C87718F13B36B5B2B39E4E2C19956807EAE80F9DBCA58236F05997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151768, "uuid": "948831e4-9980-4257-9a70-193bfc1b1018", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151768, "uuid": "87ab2f89-ed4d-4129-9486-2ab29a5037be", "value": "3072:u6glyuxE4GsUPnliByocWepWVXwJbEAWLJqCk:u6gDBGpvEByocWeUWbEAWVA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769151768, "uuid": "b25a5f6f-5299-4812-8dd0-e657540882f6", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769151768, "uuid": "84155d59-deb3-4f48-a4e1-9a2ea4efe8a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151768, "uuid": "068b5d65-8ce4-47b2-9042-c1aa252b23a8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c16beee2-f829-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769151867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151867, "uuid": "49a5014d-0ddb-426d-90c6-a7d43903636d", "comment": "Malware payload", "value": "b4a11705ecb6b9f7b4476665a2a27d45", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151867, "uuid": "1828344c-4f91-4640-8cdb-220cf0b73660", "comment": "Malware payload", "value": "e3c8a6bfb8b11bcf095ca44a238937e15f0dc0193416d9cc045d8139cafaa76d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151867, "uuid": "b0ae2270-b62d-4778-8266-93c398071968", "comment": "Malware payload", "value": "4568c6a9c751071471763e65d33b35c9b61cc6d8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151867, "uuid": "3d98198b-df98-4713-90a8-07f574f5c813", "comment": "Malware payload", "value": "255e538ec6aad895be2f45379200d01e620d1329df801a1330ad2425694a7973ca2f3fd967745ea36ad6782c047dc383", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151867, "uuid": "c7e8d8b3-9b6f-478f-9c33-62829a6ae21b", "value": "T16E84D9CC33EAB12C46777D23782FA099EA6ECBB023486114D3565D997D3036ECD39629", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151867, "uuid": "53601d79-006d-4661-b8e6-0fd3d9402a1e", "value": "6144:S3SULSUsvr2wroek0MlORJixkrxF9XTqAE93uhYMtFj2y9jvbptNRc9A25kvVl25:S3SULSUsvr2wroek0MlORJixkrxF9XTk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769151867, "uuid": "db0b43f4-314d-452f-b31c-6c6adb8dfecc", "value": 381914, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769151867, "uuid": "aafc128f-d051-4e79-a2f4-020ab3ad8472", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151867, "uuid": "3de23192-a32c-4fb4-a532-3921daf3a6f1", "value": "PUR CON 02062024_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdfa07f0-f83a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769159189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769159189, "uuid": "0b486350-a567-4b23-8d8e-7650907a5a24", "comment": "Malware payload (Mirai)", "value": "6e25e75855cf5ca4881ac9cab57b02a6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769159189, "uuid": "4cae1012-b730-42f3-9ac4-cfc9486c2062", "comment": "Malware payload (Mirai)", "value": "e3da1c38d2b9d43dab7ce233fed3138df44c4ed514c5868df3feeccffc41be27", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769159189, "uuid": "56459947-2a2e-4394-93bf-e3bc18b2d74b", "comment": "Malware payload (Mirai)", "value": "f8847a40b598acbcbb5fc5033fd6f6e693487bc9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769159189, "uuid": "faa6c9ba-34b0-4ce7-bb05-fa78423db821", "comment": "Malware payload (Mirai)", "value": "80917b0e794906e5820bbc0135d7577b43efd85638cc8aa2f47f3725d559558bca9a96439cc8a4dcbf2e4ada4dabfc85", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769159189, "uuid": "de389b69-711f-4418-a9ff-d3c32fa0a4ab", "value": "T1FC634C52BD429606C6C412B7FB4E428D372743B8E2EA32039D299F2177CBD9B0E3B551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769159189, "uuid": "bda36a50-c42c-4630-9418-9356df53d8d3", "value": "1536:ZOidm8VrlEyt8ndE+aaXmNqVP7VRleO8RATWEznL:ZjdrJiP2NqVPPzdn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769159189, "uuid": "ef9f7d6e-763c-4019-81d1-a02cb73fb012", "value": 66716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769159189, "uuid": "2b12a133-7d53-4305-ba00-268b4b186cda", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769159189, "uuid": "939f8188-4817-4d9f-85dc-c5e4231ce470", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a489f28-f84c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769166806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769166806, "uuid": "f845e483-d841-4a28-b269-4c575e2f9f1c", "comment": "Malware payload", "value": "0d562f1d072dd7d1be87e3a686e63f19", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769166806, "uuid": "b78af125-8c06-478b-9ddd-783beccd66eb", "comment": "Malware payload", "value": "e45c62edebf1822300644e8d7d211fa56af63c3befe378028334dfec5ac6fb8f", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769166806, "uuid": "b9fc65ca-535a-4e0e-9a7e-12092971d6e5", "comment": "Malware payload", "value": "68baafb3ff4621773a7fce1b6f48d17f812abc0b", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769166806, "uuid": "a3e71f03-7696-4cee-a393-b07d27558fe1", "comment": "Malware payload", "value": "9ba2b589d44d3c5a9071195a8e00062bf3a715756460ed94ae34cd42475687a52f83052bb9c7e6c4c398aff727b2f5e2", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769166806, "uuid": "38dc4f29-4856-44e1-af79-a93ee186339e", "value": "T1FB73028E69C4C532E4E5AA95ECBC49E440148379E6843C7D627703E7D1B8DE3CDE61C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769166806, "uuid": "73c4825f-9271-4b6d-a1ed-230f7676b4eb", "value": "1536:/vcrHDJVTnh6J88/fKgZ1LRS15HIGPjMch55xlJcy7ZT5mvQKDYUMIk5PwBZUvIA:/kr1VTh6J0AtSd5vbBZsvzdQBeZUh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769166806, "uuid": "d9bd7783-e6c2-41f7-b0b7-e56acced2b37", "value": 76391, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769166806, "uuid": "81683f43-518a-4d28-b24d-ab5e2402fc06", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769166806, "uuid": "76789498-575e-4c95-b86a-3ea637d4ee87", "value": "E-CATALOG.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76987d04-f862-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769176222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176222, "uuid": "dad00b5e-e09c-476a-8792-04efce4e31fa", "comment": "Malware payload (Mirai)", "value": "fd4e4b1d398eb24a101e1e5f774b917d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176222, "uuid": "cb0dc0ac-54da-4ede-9522-97fbd6315a38", "comment": "Malware payload (Mirai)", "value": "e45e5c7f45a95291fc9a7da2d1e536ba327fe9ff84587834d2689c1bc9e8c2d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176222, "uuid": "b3eeaf64-4343-46d0-bc90-210128221af0", "comment": "Malware payload (Mirai)", "value": "0861fa932ed3401a0fa45533d94d755b8b1305e0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176222, "uuid": "6fb5f808-2a2d-4cab-801d-5ca0967bd704", "comment": "Malware payload (Mirai)", "value": "18d3ebadd834c1193a128465e697326aeac00f67cd555d9a2681b3646746b7c700fbb4eee7642c4d7008136b5c12573f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176222, "uuid": "234ce59a-91ca-4f51-abf7-fa5af0a374b4", "value": "T11904D81AAB550FBBCCAFDD3706E90B1139CC954B22A83B363674D528F54E50B49E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176222, "uuid": "f1de087f-64e6-40c4-b05a-0b31cbc3ee55", "value": "3072:OeEksFM+wXpOgaVB8H3NaMFuDbcpB99k+rhsKb80:OeEnO+wXwVGdaMkD4pHi+Po", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769176222, "uuid": "0f996ec8-d439-4242-b0ce-652434e6311c", "value": 177860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769176222, "uuid": "6957cbd6-5849-47cf-8852-f317b5f0f63d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176222, "uuid": "e936b550-61d1-48d5-9c43-35d89e4712a3", "value": "bot.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76e37c1d-f89d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769201563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769201563, "uuid": "bc6ce473-5efd-4104-9a79-db6b5e83d379", "comment": "Malware payload (Mirai)", "value": "2534af5373e9636a7332596810c9432e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769201563, "uuid": "272c603c-7e7d-4114-ab91-d4d56992d2c4", "comment": "Malware payload (Mirai)", "value": "e478194e705ddb9c71827a6e96a6033cd725f9d3290abdc42f8129ec7eb7dab1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769201563, "uuid": "7580c5c1-1683-4790-84fa-5de73ff96e8c", "comment": "Malware payload (Mirai)", "value": "96ae2abb3e5c9741b9aaccd7489899c5c2134823", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769201563, "uuid": "6520da4c-c09d-481a-9d94-40f356a2bed6", "comment": "Malware payload (Mirai)", "value": "880c66c19ee4061556a0e550cc37ace86f1c7fcd054a085edd8d9d58e64e21d4a8451b3bb9a33726584c1200c4341403", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769201563, "uuid": "7b0ccfbe-9b50-4520-96d5-b7fafc744c79", "value": "T1BB531985BD82DA13CAC4537BFA5E42CD3726279CE2EE3213DE155F6032CA82B0D7A551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769201563, "uuid": "87bc2591-ff39-4cd1-831f-6378003bd231", "value": "1536:PXU9w5YknCF8CLCLWXShn9f/JPz/rksBF:MOnCjo93VPk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769201563, "uuid": "a3d48e83-a288-4704-974e-aa3ad3b63eca", "value": 64296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769201563, "uuid": "a7cb0f53-1573-4eaa-ac66-f780d69b9027", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769201563, "uuid": "7ad7e520-bcee-447f-8c6a-4aa194bf5de9", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec0e51a0-f864-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769177278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769177278, "uuid": "b9ccf79f-16b5-4008-9767-7cb83bbd6621", "comment": "Malware payload (Mirai)", "value": "35657279be8dcea502afc6251b954e8e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769177278, "uuid": "9373644c-d898-42d4-ab34-231f48e267e1", "comment": "Malware payload (Mirai)", "value": "e59937d217056f88ca7fa74c717cc8279fad96ebc3a2d3aebb11df4194a69237", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769177278, "uuid": "80bc35bc-02ae-46a8-b8e4-f66087b0c0fc", "comment": "Malware payload (Mirai)", "value": "5221fe7e6fc46a9c792348e0674d7fe3a0c1259e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769177278, "uuid": "29c6a544-4289-4524-8b62-1d5a2e086f34", "comment": "Malware payload (Mirai)", "value": "3bd245b36049d0a0583af1fa176b9770e1e0bd16f03f4c4ccd534c32580198f5369d55cfea941fa7e5c4ea11f8f68908", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769177278, "uuid": "7be2fe1f-0cbb-4959-8a60-4f2d3be7aee4", "value": "T10F930A46B9419F12D4D621BAFBAE414933136FBCE3FA7102DD20AF54238699B0E77612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769177278, "uuid": "e89023c7-4310-47d8-bd52-7aacbfb557f0", "value": "1536:UAn+tB/UOmIV1sxRuh8RBrIeaY79y5oNTYdNlTiiHsu3+nKHZFYHrs+T7:Q/rmysxRuORBrIeaY79y5oErsu3+nKHg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769177278, "uuid": "cb05d796-5bb0-4e81-928e-4334c8b4acbd", "value": 94984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769177278, "uuid": "d337419b-b70d-4868-9516-79837baf63e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769177278, "uuid": "10b6c222-76b6-4efb-99e5-7f49eb98d7dd", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13f6c4e7-f862-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769176057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176057, "uuid": "2fcb4908-4e64-467e-accc-10c75b254120", "comment": "Malware payload (Mirai)", "value": "7382fb70ee182f3e633db7a1cbfdb7eb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176057, "uuid": "1f62ac4a-87c5-4f3a-8f59-6b7115d96b99", "comment": "Malware payload (Mirai)", "value": "e63735a4dba02583f5a9effab8999ea1b07e67d2f02ac5f5cd243097d9e450e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176057, "uuid": "63f35724-629f-4f3b-8720-8696188449e6", "comment": "Malware payload (Mirai)", "value": "827d13fb1dfffcc79c494521540e5d92869e03e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176057, "uuid": "d4f54808-10e0-48cb-bf58-b00b231e1eb6", "comment": "Malware payload (Mirai)", "value": "142bbf8d7f5ef2871562807920a0331dcde7131de830b0565cba1c06593ab26c1c70a12c779f8bf6750e956609db2c32", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176057, "uuid": "b8cb45af-68d0-4e82-ab25-5b1397b12202", "value": "T116B3B64B6E529F7DF32C82354BB38B36A659238233B0C185E66CDA405D6038E586FF94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176057, "uuid": "d3a6a819-21b7-4475-8513-98bcbeaf5ad3", "value": "1536:4WHK6OZBDbRDbySb5D7GfkuKZtC+TSvI9ovw9+HF2/bXI:4T6AlCfkuKZtC+TD9o/F2/7I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769176057, "uuid": "418e8f0b-df72-4a3e-94ab-5651476885a1", "value": 117452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769176057, "uuid": "623fb228-f797-4299-a765-170be2ad3c00", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176057, "uuid": "1d190504-f87b-4466-8852-88f89ef913ae", "value": "splmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "824972e6-f878-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1769185691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769185691, "uuid": "55fdce4c-fe2d-4457-86a6-302755de98bb", "comment": "Malware payload (ConnectWise)", "value": "7ee8f60d705967984bfa7be129f38003", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769185691, "uuid": "6cc268d3-9e15-46e5-a2ca-78f6076b5938", "comment": "Malware payload (ConnectWise)", "value": "ea0abb5e3a7d6a3223dc8ddace4f15b7c6e5aa267a6f3bc113bc9d1dec9e5109", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769185691, "uuid": "e8c68100-fda4-4af1-b6f6-39ca5d2ee368", "comment": "Malware payload (ConnectWise)", "value": "d288fcc7c8d8e1fb2402126fdd24e47b5e39feed", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769185691, "uuid": "3f786f74-6d8c-4858-96e5-051dd0290b10", "comment": "Malware payload (ConnectWise)", "value": "e499d85c171377a2752d0e4b112a27ef9a6ea8c8f59d1bc16365785634ca9c10c433229439f0d8a26d0139291b289b80", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769185691, "uuid": "2aaf394a-8529-4643-834c-0b7869a6bc17", "value": "T1A8E6236027FCA66CF1B31A39E93980F5683A7C65DD51C22E2390796E1E72DA0C971733", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769185691, "uuid": "ab484c07-ce35-4bcc-a92f-46d58a44f5df", "value": "393216:ahdiEnhdiEnhdiE1hdiEOhdiELhdiEVhdiE:OJvJvJpJCJjJJJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769185691, "uuid": "869421ad-ab4f-48a9-9ee9-efeea80c2b4d", "value": 15228928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769185691, "uuid": "569e8014-bbf1-463d-b33a-3e33dd26e2b3", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769185691, "uuid": "c893abee-835e-4057-9645-15c3c20cc332", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "090f0727-f861-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769175609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175609, "uuid": "0d60cf71-632f-4760-ad29-baaf2e311794", "comment": "Malware payload (Mirai)", "value": "00edb66f80ff99c8475b16906b6c4fce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175609, "uuid": "d2a62d7a-d6c6-4329-993a-01cc006d4d8d", "comment": "Malware payload (Mirai)", "value": "eac8aff4e049d416ba169a010dd35ff1c23f8f7f259b99eacba1b45a2680b1c5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175609, "uuid": "578087da-469c-4305-b0ca-6e22ac340c84", "comment": "Malware payload (Mirai)", "value": "e30ae8e74970b27cca4e8cbfc50a46b92143422f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175609, "uuid": "3ba775c0-17b3-42fb-9bc3-7a957d7bae46", "comment": "Malware payload (Mirai)", "value": "53e86d441b4dd0b5bc07c2cc27fd4dbedf3a1fab4a2bb50afb84944a8b531c8131997cf1eaccbde4977166ee8eafb2bb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769175609, "uuid": "77786251-ecbe-4ef0-98d5-ea8bc24bc6e8", "value": "T1B783B60AAB20ADBBD81BCC3308B8478229CCA55771543B7A3974D92DBF5654F4AD3CE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769175609, "uuid": "e8e907ac-bd95-435a-8b42-e68b911595e4", "value": "1536:kMubySUyjix4pDdjlmm5WJgzZgDIvSTQb9GsPgQ+M:PubySdjiSIJgzkUn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769175609, "uuid": "b59c23d9-a4a5-4b30-bfba-7e725fca1e4b", "value": 83076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769175609, "uuid": "f5976bae-c43e-468b-ae4b-c9a5b3fe78da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769175609, "uuid": "7175d958-b220-4116-861a-5668dc51ca11", "value": "n3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db01608b-f82e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769154057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769154057, "uuid": "11b3faf2-8d4a-47a4-9017-f958b41d7dd5", "comment": "Malware payload", "value": "320c570cfb8e9fdc4772123f59ba4fe5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769154057, "uuid": "aaca6010-c73d-4c22-8bd4-0f2209847b0b", "comment": "Malware payload", "value": "eb4598d0449b6b5448eb51d5492d0194bc2572a526d424f8aa344fac8cb62e88", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769154057, "uuid": "f1b9a7ef-0825-42d3-832a-d2215392adf9", "comment": "Malware payload", "value": "b19f0de2cdca6848c33aaaedbe7f328765691bbc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769154057, "uuid": "bef0e380-1bb2-43b5-a1b3-9c8fdbdd15c0", "comment": "Malware payload", "value": "c0e7eff8783391f284196f302a8fbe93e3ca69e316a4b2b54ae771cee22413631f8bd61d0915d26220210724d67fcade", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769154057, "uuid": "e32a114d-d13e-4ab5-984b-aa321ca50d7d", "value": "T1967339D7F400DDBEF80DE73B44274416B230E7A20B921B36235B786BAD751A5193BE86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769154057, "uuid": "be4511d7-5397-4538-a948-9095c1eeaeae", "value": "1536:Fyj8j/8Pc0m6qKDjq6ZEwAq8zzyaGX7lhOl39WeLG/fZ1QlPmY:s8DscoNq6ZEwA7yaGXWl3oeCg+Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769154057, "uuid": "531139eb-d06c-4e6a-a5ae-703bdcbef143", "value": 76028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769154057, "uuid": "15d37f5d-8eef-4892-865b-ff272c2b8c5b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769154057, "uuid": "a5da0088-8e7d-4b8d-bb82-19e0789daba7", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6baa699c-f898-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769199397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769199397, "uuid": "3493ad24-da2c-4667-a834-a90ae4fb9476", "comment": "Malware payload (Mirai)", "value": "be5603a185d908ed95a9ff43c803f505", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769199397, "uuid": "b3067a31-a2e9-4a66-a558-26cc528aedf1", "comment": "Malware payload (Mirai)", "value": "eba6ab5823262dfde27dcd4ff5939b39948392ed991113f55a401226af4e970a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769199397, "uuid": "27af44f8-f89a-41a1-a77d-f5134e77fdef", "comment": "Malware payload (Mirai)", "value": "6f60a16119d3982b0551ea88d7982f65e133473f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769199397, "uuid": "872cc0fc-dbc9-4711-b156-ef2cbc6d3a11", "comment": "Malware payload (Mirai)", "value": "4d86663297e533fb4a0dc08b819a535ad54a93b494e1f5336b14bafa398597a219b3dd9f5b6d6d8585a4f1c64ef33685", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769199397, "uuid": "6ae5e5bf-38fb-4753-9cd1-89f2dfcb4d51", "value": "T146557C2AB2B2F66CD007C03457DBC6A18531F0752A323D7B37849B352EB6DE56359B22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769199397, "uuid": "ce3d7a6d-9c95-4225-a764-a82152446670", "value": "24576:6cgaXhNgZXWsA2o71XJIVUXFK4js/27shoILQ6dOLY:6cgYhNgSnJGUXFYGmLQhY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769199397, "uuid": "0811b74c-fc7f-43fe-89bd-2e21bc794c4d", "value": 1323008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769199397, "uuid": "a52931b5-682e-47e0-8b24-7d1e589fcc71", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769199397, "uuid": "f4f1ed66-f48b-49b9-9dd9-73b40812a30a", "value": "bot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6612d8fb-f89e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769201964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769201964, "uuid": "5bcd393a-c090-4ad6-9a77-2d70c48f113a", "comment": "Malware payload (Mirai)", "value": "a53a7b6af62c32591526cb9398239f94", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769201964, "uuid": "cb9aa7f0-fdf0-4b50-8694-413f3c26323c", "comment": "Malware payload (Mirai)", "value": "ebb61aff3e4f9907917bdd7a3365ab3856683285c0e92c24d2bcffb0da9b7f91", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769201964, "uuid": "cc7d0d39-d1fe-4559-99e0-3f384863d3dd", "comment": "Malware payload (Mirai)", "value": "a5d04acba743e1c387f890acc687a9f90321ab37", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769201964, "uuid": "c5d97b99-7e32-4479-8bb5-bf43e7f5331a", "comment": "Malware payload (Mirai)", "value": "4df2b67ec43bdf31e5654a7b007b7745e7d21e150e8dccab0a98a2dac70658c548255b1eb761c4c3290ec62f7ba80fce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769201964, "uuid": "c720bf4f-54fd-4962-bbe2-3ed9b2b2020a", "value": "T12A44F75CF880D779CBD0217AFA5642CD33731F64EBEE320589356B3837E6A25993A241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769201964, "uuid": "ce710005-2e8d-41f0-a803-e8d44393e98a", "value": "6144:pxCbaxCXF1S06j13uZ89Ryma112/2NPseMmID+RGWbmU+zuBqMjcDdik:G+s112/1UbmREadik", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769201964, "uuid": "fdd14ee5-549d-4e9b-a3e0-36b21a8637d9", "value": 261236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769201964, "uuid": "8f89f06f-095d-4367-803a-88c1924a08ec", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769201964, "uuid": "38b3015f-3ab0-4322-bcd2-940181cbaee3", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "877ce3d7-f84b-11f0-a129-42010a9c0007", "comment": "Malware payload (AtlasAgent)", "timestamp": 1769166372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769166372, "uuid": "86807e91-7bdd-4cb2-ac1f-f129018de0f0", "comment": "Malware payload (AtlasAgent)", "value": "6862a1b6446fa4726d13f83ce4564abc", "object_relation": "md5", "Tag": [ { "name": "AtlasAgent", "colour": "#998CCE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769166372, "uuid": "c404f1dc-deea-4063-83c6-7e7c630202a3", "comment": "Malware payload (AtlasAgent)", "value": "ecf64162e512ba693f0372d85db18d367fe05f2abd3799ca45426f152a982591", "object_relation": "sha256", "Tag": [ { "name": "AtlasAgent", "colour": "#998CCE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769166372, "uuid": "668691f1-97fa-4f01-b613-fc92296fc715", "comment": "Malware payload (AtlasAgent)", "value": "d4f64a33853c9e9d17a1823f87d7a583001f7f59", "object_relation": "sha1", "Tag": [ { "name": "AtlasAgent", "colour": "#998CCE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769166372, "uuid": "31312066-9333-4a9d-9043-d33daf1a5e00", "comment": "Malware payload (AtlasAgent)", "value": "8ab8b3146738b3a579a43fc7ceebf396a2448dfd72a1e6f4349334851268f30e200cb347ab694e346f22119d78f2bee6", "object_relation": "sha3-384", "Tag": [ { "name": "AtlasAgent", "colour": "#998CCE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769166372, "uuid": "b6464a19-9753-4bfa-869e-ddca6c9ba4ce", "value": "T142B62311EA5E8C32E1E329377DB6DB919CE87C9B52F0C05F116E743A113891F2A5F229", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769166372, "uuid": "98f1a339-c131-4a3b-a29c-342b2c0a0d31", "value": "196608:sI2eU4IWz/fOu5mKOz7ixW1oMl/wPmbbYB3Tvu35mg4Q:sI0Wz/mu5mKxxWDpKmJ5mg9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769166372, "uuid": "98978fde-0515-499a-9008-88a51eef1eaa", "value": 11434008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769166372, "uuid": "859f6303-c039-4654-aff9-4042d59bb7f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769166372, "uuid": "58c1e255-2f96-4715-aa3d-bd6815768f99", "value": "ecf64162e512ba693f0372d85db18d367fe05f2abd3799ca45426f152a982591", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b8f1f15-f892-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769196900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769196900, "uuid": "de4d576d-2d58-4961-bf36-f6e7880b30d5", "comment": "Malware payload", "value": "ce3dc5d508beeef578f39434787adf09", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769196900, "uuid": "b6773afe-70ae-4c3b-a96d-a7aca05b76c4", "comment": "Malware payload", "value": "edd54a3961b15645b9a78a58c641e2464b0e0f08cd1198432858a57c694808f5", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769196900, "uuid": "98ce329c-8325-475b-8377-9aec691f2064", "comment": "Malware payload", "value": "e37b27f416f0c6e32f898c045feb68b2472d6ae8", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769196900, "uuid": "1be50441-8656-4ecd-a47a-060a91f302b8", "comment": "Malware payload", "value": "c84a8fef4d0526305346c8360c0d4da20a06d0f43b700974ae7fd151e304b1317d08cabb610ddecdc4333d2616ac8286", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769196900, "uuid": "782a04bd-3f03-4f1a-98a1-18fcda78f811", "value": "T1DA168C17FC9448EAC4AAA331C9A692537B31BC481B3263D32A60B77C2F76BD05DB5750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769196900, "uuid": "adc0c626-d07b-4985-9f63-700cbb27211e", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769196900, "uuid": "7441f81e-9a44-4054-b3eb-f76ffa2bec75", "value": "49152:RYcYLQ3fEhixHpwdviQ3blfBvSBhsX+xhu+sqNbpdC1T1Wz2/f4/VWQ:RXjv585JAi+xsNEy1gFV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769196900, "uuid": "3c313d14-ada1-4fe8-9f85-e7d3f4382b1d", "value": 4258304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769196900, "uuid": "39077790-cb32-40f2-9da0-4a8e107d6b11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769196900, "uuid": "1ded4283-1d63-457e-8d12-7adf634bbc82", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e3b3743-f85f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769175000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175000, "uuid": "8ef0d859-0d57-4860-9434-8021677713aa", "comment": "Malware payload (Mirai)", "value": "0586d56c232260596474a1a2eb0d6afd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175000, "uuid": "2a82aee7-3acc-4d5d-9fc6-97d7882d6df4", "comment": "Malware payload (Mirai)", "value": "ee7604b35770f0ce0b821f9dc32fcfc2d31d6a962cbdc9404811b21f2dacdb32", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175000, "uuid": "5d15760c-370f-4d33-b929-e5117ea04201", "comment": "Malware payload (Mirai)", "value": "512bb4ea5911ea9129948c7eff5231925abec2ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769175000, "uuid": "eb900099-43d0-4140-ba2a-0a1f93d8f855", "comment": "Malware payload (Mirai)", "value": "601055f902b73f9b7057c768abc1f78ab2d63fff7a0e6879b65350da144bcc4426e944f7de17cd6ca4faa4f9044fc5f3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769175000, "uuid": "ac1c564e-456c-4f6e-8aa3-b77fc936bd71", "value": "T17393088ABCC5C712C6E071B2BB1F51CE335643B8E3E6B1438D19AB29675B8570E3B251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769175000, "uuid": "84b0d042-26e7-4a6c-8778-17b11a0734ff", "value": "1536:yMwGIHgptGkQq9cPZNc4v2IqvtRQsWI0rBRoYON38wBI/b:y/lHYtpCPheIqvtu/I0XoJN3zBI/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769175000, "uuid": "4b0b6b25-3e1a-4c0d-bb3a-be3ec4fe1741", "value": 95444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769175000, "uuid": "24fd5734-7558-4f21-b030-2148c2a6f4fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769175000, "uuid": "f213d7a2-5180-41a9-a4f7-1f5c93f1d63c", "value": "jklarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49533077-f850-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1769168415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769168415, "uuid": "6abf32c8-4bbc-46a1-b94b-568db15ffc31", "comment": "Malware payload (ValleyRAT)", "value": "50a9cb6a636390eaab5f2511eb8ebf2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769168415, "uuid": "8811dfcf-8372-49f3-abab-ae74076d3f04", "comment": "Malware payload (ValleyRAT)", "value": "f084f24379dcb8f5b0b8683f0cd1c2a276e0cc5d4233ac5b36c481511b54121a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769168415, "uuid": "2f90606f-df55-4be2-8a28-70c2496a9c83", "comment": "Malware payload (ValleyRAT)", "value": "0ba68dc1c3cd2862ece202fdc971393a56e3a0a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769168415, "uuid": "fafae6c4-b847-4fc6-ab4f-38e1b4d43449", "comment": "Malware payload (ValleyRAT)", "value": "a949754ee85a30cf7224ce276e09ecc8064ad3960eadc819b8253585c9ea2c63005b09047eb25965668c8b94ac36d069", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769168415, "uuid": "59b1fd86-b71a-4ea5-a251-4c270767e8e3", "value": "T1BB754A01FDCB95F2E50706325AA772AF67215D058F32CB8BEA807A7DE9772D14C36209", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769168415, "uuid": "9975e9f3-4902-4639-afb3-917818838a76", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769168415, "uuid": "5317e7b7-185b-46eb-9e89-85eab2e26265", "value": "24576:dnHlaCjkBH7XALnKYCb1FDxg/L/ocBTPo3lIfBnnO3Gm8ujuDD5SajUtcadxYTp0:db3BomwSJnmXmUgbs7nG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769168415, "uuid": "7e4ec521-b3af-4255-b97b-b0a9dfde9759", "value": 1593344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769168415, "uuid": "492015f4-1b59-445a-8c26-58e3b75b8b0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769168415, "uuid": "35befb93-6709-4a72-9332-e56136c533fd", "value": "f084f24379dcb8f5b0b8683f0cd1c2a276e0cc5d4233a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6173148-f86d-11f0-a129-42010a9c0007", "comment": "Malware payload (VShell)", "timestamp": 1769181053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769181053, "uuid": "eba88e20-b5c0-41f7-b395-46d37928eff9", "comment": "Malware payload (VShell)", "value": "6df3b17ef3097e64f00ae8406261a5c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769181053, "uuid": "9930d546-83fd-4aaa-a60d-246e3f990f03", "comment": "Malware payload (VShell)", "value": "f0857c324df14c87841c4b03107858fbd48e92aa0f485ec80f75cca4b74ecd85", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769181053, "uuid": "6139d781-b956-4648-8e1a-e38a66686b2a", "comment": "Malware payload (VShell)", "value": "c20c16c489043074a4d8c69e1859d58f421e49fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769181053, "uuid": "dba66a60-6d1f-4da0-91fd-0f49c4168b7f", "comment": "Malware payload (VShell)", "value": "844e27b15914d851323d42988a5c3d9f3199337723e5993688771cfc0d18a7a7324b4b35a4f6b8992003074e0faf5e01", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769181053, "uuid": "8a5af685-8c41-4c98-b173-eb39c2ace1d6", "value": "T137C533B449D45942F37AFB97FBFB41DD2812D7C16FA09F82A01BD0C899E11E68B4A1C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769181053, "uuid": "15ca08f6-85f5-424e-8b83-26ca08c9507c", "value": "49152:2Cr/6sMf15e/JidHDcCKA1w+jGFyqHjFDsOnIgUNtpAIbdW+RnK726CjmdrCAFId:Br/6sw5Kgpj6FpjKAIbwUKijmdeCNQl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769181053, "uuid": "8c86c70c-9a46-44da-871e-e2dd2f5e161e", "value": 2562844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769181053, "uuid": "2bb64224-f42c-415e-b19e-46b3374fec53", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769181053, "uuid": "25d56ff9-55d2-4dde-80a6-db30f34ad5c4", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae869175-f829-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1769151835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151835, "uuid": "fe3823d4-1f54-4941-a13e-e0ef873456ee", "comment": "Malware payload (CoinMiner)", "value": "760c9e2edbd32d62106eead624e6f147", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151835, "uuid": "b08c7457-e9dc-43f8-854c-b0bd141e880b", "comment": "Malware payload (CoinMiner)", "value": "f11371b1a4e88d9324df22bd463921a1d72b7f6dbb3937a4aa20f87fede2bd11", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151835, "uuid": "473e0189-f599-4319-a902-7bfdda089f4c", "comment": "Malware payload (CoinMiner)", "value": "9dce3e984f7ddad12d04430f1ec0dcf2ebdf7647", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769151835, "uuid": "9a703f31-bea2-4b82-b123-4a44ce102a8b", "comment": "Malware payload (CoinMiner)", "value": "d05b96b3ecf3040103ab3161d3955b572458d6f89479e79f9b20a6414e5b871c4a5adfeaef816fcdf2d4c0d9fbc6b279", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151835, "uuid": "357ec87a-9dbe-4e02-b3af-5319e7340ede", "value": "T12941DEED64D279E87855E99CB663C21815C4F68808E7178C784C6D36F355408F7267FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151835, "uuid": "cbe1cfea-3b83-41a3-9bed-028e4434f2ec", "value": "24:o9qMkpnIDd3Eo+h/s54NvIaNHnJl9vYp1MSQ7BVKfw0c22DND7DYcHMjStLqJi5m:o9qMyIB3ETK8VE9cBCcRHGi5m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769151835, "uuid": "54f85ce2-4778-4aef-b90e-4471704f3aa7", "value": 1974, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769151835, "uuid": "d71971f7-883b-40fd-ad42-9e3cff6d07df", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769151835, "uuid": "92456dae-8ec4-4a1a-844f-98d8773e4ee6", "value": "bolts", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7c89d18-f812-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769141972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769141972, "uuid": "10f423f3-eeb0-42de-9bbb-7702334a98b5", "comment": "Malware payload", "value": "fd3c3ce3a8b179a478a48c73271810e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769141972, "uuid": "65ff55c0-8569-4fba-994c-f1519c28cf3b", "comment": "Malware payload", "value": "f1e48512bb51c88c57f63316ea267cc2dc39bdf150cd6f7ed95dcb2237f9c102", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769141972, "uuid": "78d73c71-a7df-4471-a3fc-557ab7634eb0", "comment": "Malware payload", "value": "eec0bde0509289fb221b8153c8e9556d19d31f8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769141972, "uuid": "a9dcfa1a-b7fe-4dee-b31f-34b28002f356", "comment": "Malware payload", "value": "66885b347fdf846f9fd96859d21524c586f8a0784612092c706aef704922b0883a3f35b030e49bff6d5aed301df5fb7c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769141972, "uuid": "f5c90936-e1aa-4de7-b3c8-30bab64fb94e", "value": "T198F7331AE288B13AD15937350673D51268FFA35DE1073D72B7E0D4CCCB262C48EBA669", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769141972, "uuid": "39ee5d86-f5e6-4e93-8ffa-4bbe4ef34271", "value": "eb5bc6ff6263b364dfbfb78bdb48ed59", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769141972, "uuid": "b3263c3b-0c36-4a68-89d7-835a8ef50d6f", "value": "1572864:AFNMM0jEu39AgKRoIEBtazDE4gIy88v48y5xqzXo:AM9SROBEDERIy8350z4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769141972, "uuid": "4a7c999e-b731-4ef1-b1f1-636555c4d9ae", "value": 73750877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769141972, "uuid": "2bc309ec-fa32-45da-81db-4816a2b09600", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769141972, "uuid": "8d3eeea0-8a4c-422d-9dd0-b9d65347cf8a", "value": "AnyDesklets-stup1.7.79.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3170d29-f894-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769197799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769197799, "uuid": "0f3b9d09-a799-434f-9a26-a5af59b0ade8", "comment": "Malware payload", "value": "bf9da3ffc04fca57808751bd9dc96b6c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769197799, "uuid": "089be163-d1b1-4985-bf79-80a33bdfdd55", "comment": "Malware payload", "value": "f1f037f543b0340eaf2f22043364e7c285b12994cf6441b9f62d5d7133aabda9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769197799, "uuid": "98d2134f-26bb-4750-bca8-1d3953220901", "comment": "Malware payload", "value": "f81b21df7ff0e2feb00e0c4eae7f61ed8d762507", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769197799, "uuid": "18578926-9b07-41e2-b874-b4d3ca9b5434", "comment": "Malware payload", "value": "7286517cc47d3af844c94631faaee5f3792f830eb95394b2219256ca1d75b3a732ec4870205819b8c2efd69729710328", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769197799, "uuid": "8f50531d-cfdb-471b-8b20-50b754f2872a", "value": "T1D9F533E2C95E1AF04F8552C4770B27E79A2069396D4AF037F0DA627956F88B43D8230F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769197799, "uuid": "2be2aba1-1e69-412a-abb5-10534c3a3161", "value": "98304:26oqLbHxY/ahfA8jSe+Qqes4yeXo8zHUehQxp8FdMGhKpRIiE:ZFbRY/7Rco8QbR9S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769197799, "uuid": "b104cb12-a712-4c88-a559-b7bdb828beb4", "value": 3345356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769197799, "uuid": "f2d17a12-5a65-4c14-96f8-817a94840bf2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769197799, "uuid": "ab85cc63-1867-471a-bc09-1060b77d045b", "value": "avx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa484943-f7fb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769132205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769132205, "uuid": "0a372785-cec8-436f-8af1-7a5af82343a0", "comment": "Malware payload (Mirai)", "value": "329875e7199e75636accaa42b2d26ff7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769132205, "uuid": "8781ddde-6b54-4ab3-afae-c14073e5fad1", "comment": "Malware payload (Mirai)", "value": "f3958934a0afa25fd6bcd208a6b09db7acaf29c886f661f529f49ed03ebb3736", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769132205, "uuid": "34ee4274-8e99-4a5f-8abc-ada5d359b28e", "comment": "Malware payload (Mirai)", "value": "17f02c2f6de6dd0ccfc4fec7ef24d472a771410c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769132205, "uuid": "88880e68-ea04-48d3-a4d0-ddeedf14b124", "comment": "Malware payload (Mirai)", "value": "2e120ceb8d4f76399d5efe98741404910eb8daa2689abc375868c65300ba939b5a0aeb12837403dfa31b41ebf466c205", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769132205, "uuid": "b60e5f13-63d9-4ab0-8a5b-fdd2fc1b0d13", "value": "T10BF3E916AF520FBBDCAFDD3702E90B0139CCA55B22A43B363674D528F54A54B49E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769132205, "uuid": "50b50f53-f428-490d-b439-5c8f12fac4ee", "value": "1536:UtfjgPCou6P7T1LJa7vv0YxRXIHBQ/HHZLOIiTmgCIOALrerF58qnCwAJez:UxjDo/31fhQ/HH/DIOkrebnCREz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769132205, "uuid": "e9390434-9127-4c52-aa7c-dfa8d44c4fd1", "value": 169080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769132205, "uuid": "065bb23b-459b-4de9-9119-e5acf0e40ff8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769132205, "uuid": "70faf48b-0d27-41cb-8833-34d62334f2fb", "value": "odin.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4de5c6bd-f87f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769188609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769188609, "uuid": "552cf1da-0efb-4997-a503-b754de1cbcde", "comment": "Malware payload", "value": "b2c738334b017c02d635d246b0723f59", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769188609, "uuid": "c2fa51f0-b3b2-4f1a-b39b-a3674f1a2174", "comment": "Malware payload", "value": "f47b12a3d55dd4178796d52bfbe6e59a8d00094f4f4ba527262ad3c2d96900cb", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769188609, "uuid": "888c022d-98c6-4c2c-bd52-12b134b2c07d", "comment": "Malware payload", "value": "59a6a2c106d6dc1f173159c56b2c25ffe35183b3", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769188609, "uuid": "5845a6b5-94d1-4506-9257-246fbe493e8a", "comment": "Malware payload", "value": "adfcc2563b5c708f2a8ba45e1f44859b59b59eef97236a08444b108c41cc29ba17a87c6c3ce77dfc0f4087ebe09ad3b2", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769188609, "uuid": "54255618-2a8c-41a7-9243-62bb0eeabc40", "value": "T13BC549132CD18DA9C06AE239EDA2118276B07C080B7273D72E90BB792F77BD5557B718", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769188609, "uuid": "ad43edc1-2572-49df-b806-d5fd04b66b58", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769188609, "uuid": "5246cdd8-3821-44e9-869e-0f0cd0a6a392", "value": "24576:27EpOCuBw2QrSjm9D5II4hp5lHnLGKDodij7cYS9:2wkC6wn0mxaIA5Hu4nvS9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769188609, "uuid": "bcc21908-c2d4-4fb0-9c24-81d6055a9e2c", "value": 2585816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769188609, "uuid": "cd107ba8-03df-4dbc-ab3c-393d97965d9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769188609, "uuid": "0b3ea35f-2995-49d5-8336-f6a4c4293966", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c9db727-f84c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769166810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769166810, "uuid": "02945f3b-e224-4b4b-9add-cbce667c159c", "comment": "Malware payload", "value": "bf482fb44c2e62a431a51fd1fe272561", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769166810, "uuid": "15529dd0-74cb-497b-89df-0a964fdf1966", "comment": "Malware payload", "value": "f500a3d636240a68931bf253e7aa18b04abba9014f7939a4aadda4d2fdf7d09a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769166810, "uuid": "225a7a2c-2f58-4d06-bdc2-9efeb30a5c11", "comment": "Malware payload", "value": "568ef9c6841b630b302b0e7bba59b88d8a3f9031", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769166810, "uuid": "b53615c9-d818-4e1b-b5f1-720a777c05a3", "comment": "Malware payload", "value": "c833464a41db3039050e37afa7fff3eca214086700c43285bc0c47ddf9076ccb39f47a102de49c09c654f46f89dad27f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769166810, "uuid": "387f091d-a182-4b74-8c7f-d7da2aef9edc", "value": "T15F044C03F6924CFDD836D1B4969BE733A570F8145238EAAF1A90CB252E1AD70722DF45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769166810, "uuid": "36744e8d-905a-4c95-b8ff-b19e6ae5dfa4", "value": "dfa41fbc174fda9c46816c7386c7ccde", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769166810, "uuid": "335bde05-c60c-4ad2-95d4-eb146843cef5", "value": "3072:kuhCYXxzPfQCrVXl0Psw8Wx4lYTM4hE94:yixzPfQCB101u8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769166810, "uuid": "20f1aca9-5042-4099-a1cf-b24f7ee928ea", "value": 186880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769166810, "uuid": "335de48e-2f31-4ec1-b4e7-47479108600a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769166810, "uuid": "6ebe8c3e-7d64-4faa-82dc-1f50d6ccb541", "value": "E-CATALOG.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ef08401-f879-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769186115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769186115, "uuid": "f9beed00-3395-4ee4-bbe3-69516a349dbe", "comment": "Malware payload (Mirai)", "value": "bac8bf9ed94085d2b5665aab07626539", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769186115, "uuid": "87a2127e-aa8d-4802-b662-bef96c9f5002", "comment": "Malware payload (Mirai)", "value": "f5dc117f137e7d4ec8a1d8687f9511fd816d298305616b0260d12df76a041883", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769186115, "uuid": "7b657054-1e8d-4f2a-9685-c205afd36812", "comment": "Malware payload (Mirai)", "value": "682f0a997a89a6d0b2ea226e9159a1d301b1bd1a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769186115, "uuid": "7432ad8a-f255-4df8-aa90-353c823cb04f", "comment": "Malware payload (Mirai)", "value": "c0fa15738d83a8357610a2be9f336fa5c6e18377a8b03dea72f18538c367059b88bf1e74eb2d3eecad2651759f2b41ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769186115, "uuid": "6ce7aa50-3245-4155-abc0-733d560c1ad1", "value": "T123246C91F95E7D7FE2A30F3FC14217597B3CAF124A02A926B06E61561DFB1824F6220D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769186115, "uuid": "e9ef78ec-ae84-4e81-b977-1040f323ee8b", "value": "6144:zl7McAu4RQvvrCpsHR9IBivVKPh/AW1FL8eBWW:zloblRWrRxj4TL8eBWW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769186115, "uuid": "1b7ef1ea-d348-4ad3-a9be-cb43a4d1d01d", "value": 221680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769186115, "uuid": "7b8dec9e-c3bf-4fca-9c0c-02d029e67185", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769186115, "uuid": "f2140369-a6a2-46f7-87ec-a7cb0f754528", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bfd6104-f866-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769177869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769177869, "uuid": "6170e53f-e894-4635-b98e-0258144d48be", "comment": "Malware payload (Mirai)", "value": "8e20e5d6e1bf4a10c8d37208838dedec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769177869, "uuid": "e46a9ecd-5c76-4018-8422-51e9d3a7175b", "comment": "Malware payload (Mirai)", "value": "f60d8b3f4c405578711c3328ad8d985f7c6f449f5883c68c76e508ee8802f57a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769177869, "uuid": "82906fa9-1042-4966-b320-7166f8b39ea0", "comment": "Malware payload (Mirai)", "value": "cb4f1a7fd06d648102c505fa5f6715d1ca55b525", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769177869, "uuid": "ddaf15f3-edc0-4e1c-9ed8-03dec0d9237a", "comment": "Malware payload (Mirai)", "value": "be6899d4126f9f1f811c5852ecf1ed9c144609e9fd5ba3a3f0e7e2a6f9db22b085bebc2064ad8425ec5c6cb94af3115e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769177869, "uuid": "04eddf4c-7672-4526-a918-0d3a926dfe1c", "value": "T131935A4273690547F3A74DB1283FBBF157AED5A120A0A2C5685FDB0F8135A322586FCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769177869, "uuid": "69a0f237-3501-4c61-8ca0-692ae2935fc0", "value": "1536:31vBfxHPOevoRiVo0krLYIHiv2pICdP9Fz5gDNPw4HS9MBIsRSzonLzf/J/b1P:31fOegvaCdPfz5O7S9tfQ/RP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769177869, "uuid": "cd21af42-f34b-488d-9a92-d1d8a87422a1", "value": 95544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769177869, "uuid": "01d4a59b-114f-4700-8680-abfd2f1e64d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769177869, "uuid": "cfe36d5c-2dea-4460-b3af-ecb49a22d99a", "value": "jklppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6663583-f83a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769159257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769159257, "uuid": "f571dd23-1101-4618-b939-7a9cd95a2c85", "comment": "Malware payload", "value": "8b145fde52ca8805af2b56b60182a149", "object_relation": "md5", "Tag": [ { "name": "94-159-113-32", "colour": "#84A36F", "exportable": true, "hide_tag": false }, { "name": "txt", "colour": "#BFCC1F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769159257, "uuid": "3e9d4b30-27a0-4b52-b6a6-16a7329056b4", "comment": "Malware payload", "value": "fe3a4025d51e4adcf4759d54f021eddd8b1ff78ce348092f657881f526f243d6", "object_relation": "sha256", "Tag": [ { "name": "94-159-113-32", "colour": "#84A36F", "exportable": true, "hide_tag": false }, { "name": "txt", "colour": "#BFCC1F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769159257, "uuid": "e2b8ac3e-ad07-4b80-a687-47bd03b52722", "comment": "Malware payload", "value": "0607eed49aeef918501e57a1dc327e5894badca9", "object_relation": "sha1", "Tag": [ { "name": "94-159-113-32", "colour": "#84A36F", "exportable": true, "hide_tag": false }, { "name": "txt", "colour": "#BFCC1F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769159257, "uuid": "c5df3807-2f99-4568-bf2e-ea6d8977c61d", "comment": "Malware payload", "value": "43d11566c72737165ec960d279d12bd6439b146bf4f61088cec51186da4e6fea7f775f4b01c203f7b98f7b7e04ee036e", "object_relation": "sha3-384", "Tag": [ { "name": "94-159-113-32", "colour": "#84A36F", "exportable": true, "hide_tag": false }, { "name": "txt", "colour": "#BFCC1F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769159257, "uuid": "f65c679d-2571-4fa5-b5db-a2c518c44754", "value": "T1CE9423A3F9F81FB6E15E611AC1185CC95C5CB19D3011DDC088E6694A332FEC9BA3BA71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769159257, "uuid": "15fd36c0-0862-4112-8175-336722a911f6", "value": "6144:af4dGDfPfUf6wYAx3eWOzviCYP69nSiJrkP4A4vpxtom+xtKN/sYP399+43eqvJ+:afgkkfzjOydgnS0o4RvXto7xtKVtesJ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769159257, "uuid": "cd91f81e-d569-4e44-bbd0-c5eadfa4da9c", "value": 445449, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769159257, "uuid": "8491ed14-e61e-4ab4-a171-2db083d3e4b8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769159257, "uuid": "d472892b-d5c0-4070-b526-e1bdc7e4d60e", "value": "9740507e59c5a2c686f754c7c01572b57990cb10157857c3e604752b0e478447.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "949d670b-f897-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769199036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769199036, "uuid": "7e09f253-42cc-42d5-b09d-5c04f427b329", "comment": "Malware payload (Mirai)", "value": "2bded5c2cbb37aa15596080e1f04377e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769199036, "uuid": "85d05b34-0708-4a06-95eb-b7d9e488c709", "comment": "Malware payload (Mirai)", "value": "ff393c373b902287e702625cea4fbeb76f755cb28b0d3f0bd58ce35312897cdf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769199036, "uuid": "280f4ded-a1af-4f05-b7d8-df20312d1310", "comment": "Malware payload (Mirai)", "value": "0ea3dad0ccd986e01eb1c564119892a255478893", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769199036, "uuid": "63825e35-7dfe-4d99-a340-01fcc14db51a", "comment": "Malware payload (Mirai)", "value": "df29247e525cdb619e5a5824e5c2f7eddad3ed8141d20c1c313be69d90895ede0b2f90197b9322ef7f01633d334418b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769199036, "uuid": "ef52a0bf-1bf2-4083-ba48-2296092034ce", "value": "T168347D92B95E7C7FE3630F3FC14256497B3CEF124A025A26B01E65562DFB2824F6260D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769199036, "uuid": "06c9b7ca-c852-42af-a84a-c978b3d55a8e", "value": "6144:0PHimU9HPrlkPWKr7qs1fR5evlcz//tXhjTi8eBWx:jddzljKqsk+XA8eBWx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769199036, "uuid": "71e84908-3196-4b43-b2cb-d38a79a1e170", "value": 231116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769199036, "uuid": "8a1240ea-a1d2-4342-acc7-5c8293921150", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769199036, "uuid": "16456c80-7e7e-430b-a087-5db17aba9f27", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79bfb1eb-f812-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769141868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769141868, "uuid": "1e3b8f3e-f618-42d3-b2e8-9b5f922a59a9", "comment": "Malware payload", "value": "c2d55d6ec652c302a5661a04e1e241d4", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769141868, "uuid": "5274082d-cc09-4bbf-8429-b59bde782117", "comment": "Malware payload", "value": "ff6cf1ec90b5ee387d12dbd0d9f27d29fd8a72a306345076cffd29bb93c09f34", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769141868, "uuid": "0f999c04-056b-47dc-855d-a01e5ce86a24", "comment": "Malware payload", "value": "e6491a0577b2db9bdcc39b23d4fe79c8691e06a3", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769141868, "uuid": "ea0a7384-9405-43d3-856a-1212dc08d16b", "comment": "Malware payload", "value": "7f5c2b526ef46841f6efa0dcb8f6ea1045253b7f4511d96b48a2c60274cbe7182e9ce87c380fbe75f89fc23fa02580d4", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769141868, "uuid": "b7f27c16-e0f2-4a9e-9c59-3b4178b60cb4", "value": "T1F18733B6784D4BB8C1A984F078E57A9C1E087C637E53182BF21EF4E910B24B754B45EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769141868, "uuid": "715f8b74-e234-4d59-852b-d792fa3c46d0", "value": "786432:nPjhFuLEvCCMM1F32b8P3H4v2yRjxZ7xKm9pU53ILcTbl7E8Q:NFuLWCNM1Zy5xjKm9puHl7rQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769141868, "uuid": "403afbb8-bf9d-46f2-a9e6-51eccb8e1a12", "value": 36368384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769141868, "uuid": "5d40778d-3304-4d68-a730-ef620c6a424b", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769141868, "uuid": "7f06ae55-1d3b-40ce-adff-a7180fc08353", "value": "DaebecpLSetup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "366515f9-f847-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1769164518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769164518, "uuid": "33ef871c-8307-4306-a18a-eca0d97e711d", "comment": "Malware payload (Stealc)", "value": "4117fba43b48acdc5dda6d3872ad6e75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769164518, "uuid": "85a4cdee-f829-4978-88e7-20a465050934", "comment": "Malware payload (Stealc)", "value": "ff7a2d70fce940f6373c1647728386f390487797254d7bea8401dfadfd799c19", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769164518, "uuid": "a85324a6-4bbe-4bc3-aa60-6e637648a17e", "comment": "Malware payload (Stealc)", "value": "f227399191a661207ed1bfeabfa7f825b07e79b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769164518, "uuid": "98b3f029-0ef9-481b-8d4f-a622961690e2", "comment": "Malware payload (Stealc)", "value": "42e1f8c4eacb8b3d644b8cdb59d0f3a9f9dd8e50e9ef7fdf2fc5215a77acdda471b620e68cc3a31dc83900eae236d237", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769164518, "uuid": "59c3900b-3eb6-4477-a47e-2e87326b8f4d", "value": "T1D5F47C5EE7A602F8D0FBC17CCA624552E7B67A25533096CB03E11AA51F372A05F3EB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769164518, "uuid": "02ac3ac2-85fe-48fe-9db1-c63a1c4daaaa", "value": "baedab261d9b0ee2285b2ff329a5eaec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769164518, "uuid": "3e47d984-27de-4e04-947d-fbdb4d338f55", "value": "12288:mU8VHX4ZPBuvzkOkW7UE+YTRqwJ47Xv3YZtF15kjHyA:MVH6BuvbkW7xXVVm7/3UA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769164518, "uuid": "535d6e7b-25f6-4648-8aee-d176f038cc45", "value": 752640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769164518, "uuid": "fa5d1e5c-27f3-40b5-89cf-9436208b9cfe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769164518, "uuid": "ec6e0d9a-4f06-46d8-854d-657317d66f15", "value": "xff7a2d70fce940f6373c1647728386f390487797254d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72b7f425-f862-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769176216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176216, "uuid": "a5404c86-dd0a-4afc-9574-bb8ad33e9f18", "comment": "Malware payload (Mirai)", "value": "0e87d8b2b218c6e9b5754094ba33b256", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176216, "uuid": "15d8eda4-15f9-4433-975c-16872a0310e6", "comment": "Malware payload (Mirai)", "value": "ff8c3de859887fe84e8a92abd7276782afd74bcad0adc3592782fcd5826b4303", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176216, "uuid": "d8f0ca01-5f1e-43fc-b2eb-296cf1b40cd0", "comment": "Malware payload (Mirai)", "value": "cb8cc87a444f2be7104c661444c240467338332f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769176216, "uuid": "477bf75a-7a21-43e6-a80d-943d47da7127", "comment": "Malware payload (Mirai)", "value": "26bdf84f298499156b29cd90d5a1f61fd5c7bd09d5204d3ee2fb23703fdb07dc47098413f5d2f6d778a655de3c4353e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176216, "uuid": "d8a61adf-fec3-457b-b58f-d2c063740136", "value": "T14F632995FC819613C5C022BBFB6E428E372653A8D2EE72039D256F2137D785B0E7B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176216, "uuid": "d1255058-360d-43e5-b927-50b3df3b190d", "value": "1536:RpfDF1JYaUZfVeLz8SoyaF3GipcFOEEd:RpfDzYfwLzZoyWpqId", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769176216, "uuid": "793f4b26-8587-40ef-b983-2a188c65505a", "value": 66952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769176216, "uuid": "88f9153d-d635-4545-808f-69132e7eee26", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769176216, "uuid": "4011ae4b-e2ae-4071-8976-87b21dd95089", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }