{ "Event": { "published": true, "date": "2026-08-03", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-08-03", "timestamp": 1785801782, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "eba8ef29-675e-441b-9c3b-a139b8845aad", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d1d9635-8f63-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785779262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785779262, "uuid": "89130ac0-dd93-488e-bf03-0dfab82592c6", "comment": "Malware payload (Mirai)", "value": "51e07a1dea39b599af64e875aca48745", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785779262, "uuid": "bdfe5170-f9a0-4d48-9580-bd6b41f18553", "comment": "Malware payload (Mirai)", "value": "03a1fc9b3cdd97b957dfb39a70b044f64b330c05df59b75f5c16d96eae053216", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785779262, "uuid": "41d8894a-d33a-4cb8-a29f-5e55a37de1ec", "comment": "Malware payload (Mirai)", "value": "cf947a5d9992600754e90effa44fbf4564b0d7f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785779262, "uuid": "0c9c11e8-5b55-4273-9c6b-2911085f0362", "comment": "Malware payload (Mirai)", "value": "c07396636a7be41fb3a94f56949f020557b470be504d835e0b4dd4a465ca880b45e85b3e3cedb1e589d1897eb4f03971", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785779262, "uuid": "6f69375b-6b18-4d9a-b120-4ddd6d9e73c2", "value": "T162933A03B59090FCC4C6C1344B7FA636EA72F1ED1279B65A37E0EF222D5AE211E2D950", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785779262, "uuid": "1c6e4763-9e1e-4fa8-bf10-37181927e9f9", "value": "1536:qnPjFljLKNGA17rMy5cpUu7ysE9/Xv+iWpnvPww14+3Ipe1peR:SPjrLKNGYMyStg/Gi8v54+3I8He", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785779262, "uuid": "414ed366-e000-4cca-9c61-26e9777683db", "value": 89200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785779262, "uuid": "f145abf9-0d38-4bb2-9732-8d2c93cbdd34", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785779262, "uuid": "2c741bbc-50b2-442a-b1aa-48cd8e298629", "value": "lkxstress.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0777a75c-8f38-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1785760623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785760623, "uuid": "be3e8dce-f502-4103-b4f4-c5a903c42c3c", "comment": "Malware payload (Formbook)", "value": "0542ade50c2fba4ec61499340cc21884", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785760623, "uuid": "860973be-8c39-4321-8528-21e62d16785b", "comment": "Malware payload (Formbook)", "value": "04e293d3a35fc2a8a1c90f28fa4d1c92412a04757035972fd49f47de0e5e5a9a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785760623, "uuid": "86d6a824-6a06-4046-8fd8-f02ac33e2a93", "comment": "Malware payload (Formbook)", "value": "ab332f0b1b72cae0727b85d96c6a0be0fd1e1b93", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785760623, "uuid": "8608a3e2-6866-45a9-9cb0-35c0eba734eb", "comment": "Malware payload (Formbook)", "value": "d50340535e84d7c4e32cff2a634709a4a032b92e1c7aeb87e4d4dc5902b35a6ca67ca3d7a33841f074983af14fe9bb87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785760623, "uuid": "eb60f6a3-ab74-468e-8b4e-c585fe189cb4", "value": "T14F351228F729D513C98787710835E7B502B05DECA521C39B9BF9FDEB3869A0A3C1D291", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785760623, "uuid": "1f011233-83c2-40aa-8869-da8ac7e962b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785760623, "uuid": "529c27da-77c1-4821-8dce-d5cde361e11a", "value": "24576:8YYawfiZKUcBnCYoz49xjMnFtlB/LApclnWtALYKdjU2PwCKG2W1:8YYawq8UcBnCY+dzwQnWtALYqU2YA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785760623, "uuid": "cf635b24-facd-499f-af82-7f10995df82f", "value": 1075200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785760623, "uuid": "508564ea-4e9d-4a18-a38f-4a784f85585d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785760623, "uuid": "aa2c8976-c0ad-48b5-884e-6f87cc13bcda", "value": "Doc001886_1308002341 Pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3d23887-8f4c-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1785769555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785769555, "uuid": "089c9e85-5daf-487b-8e92-35230bf85103", "comment": "Malware payload (ConnectWise)", "value": "00e25db05ce4a4530f327bc9051abc94", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785769555, "uuid": "9d71debc-b085-42c7-b078-62685b4f75bc", "comment": "Malware payload (ConnectWise)", "value": "04fc7818da3d609e6dec9122726d338adbce524786756d4b12e4352b743222db", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785769555, "uuid": "7e9e1355-3f4c-4298-8f0f-2237c2355deb", "comment": "Malware payload (ConnectWise)", "value": "71a931cf2a41f6a776ef276ed34af51eaaf69669", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785769555, "uuid": "ef47bb24-d38f-4112-9e37-090403cd2070", "comment": "Malware payload (ConnectWise)", "value": "c37ea6de95b7c334383c318c758c5f7aa78361f44d6bb64c8dedacd06255eccf03974800adcd619bddb965db41a2989d", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785769555, "uuid": "ef314286-390d-4f0f-a40f-4ef5c2bcf8b4", "value": "T15813F0D20E34ED84B3D86939BDBC7560E3E0DEBB25B7A7611087E71E1B028462715B72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785769555, "uuid": "1616dabf-ea75-4e7e-8780-fdd96ea4ad4f", "value": "384:IHUL96ptFCu6XYQm4+ngnVJzWR9DqGmpJg6lQDf1X7oE9Hvr97t73H3em82PqfH0:sUsPWNoX9HzN9iRtC2OpK01", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785769555, "uuid": "dec095b5-e449-4fdb-a53b-d6a71035b05b", "value": 43754, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785769555, "uuid": "872d4db4-fa6e-414a-8745-75c6758f78b5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785769555, "uuid": "7b90eee6-4a68-4d76-938e-b052cc3177a4", "value": "zoom.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a319bdc-8f63-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785779257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785779257, "uuid": "77a220a6-26fd-4a60-a9a8-02196161f3b5", "comment": "Malware payload (Mirai)", "value": "6fcfd32e4707781648b15a07568c1197", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785779257, "uuid": "93dc6ce6-d9db-47e4-b257-b981670ae28d", "comment": "Malware payload (Mirai)", "value": "04fc92d37968f2d09f65c6cfd74a39052d504d239c357e5f6612e207b80cfd21", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785779257, "uuid": "f3498585-02dc-4322-97a9-144e95b9f6a1", "comment": "Malware payload (Mirai)", "value": "687cbee14180c428503085e1cf3f55ec64e4e194", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785779257, "uuid": "9c8113b7-0b8e-4fef-9b23-400097c44979", "comment": "Malware payload (Mirai)", "value": "8eb3c1e96dc60d92736b8f24fa2b73cc682d4a722bb6036f7fe7ffef26de354047034f89e84f8a84b497f123acbb7a8c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785779257, "uuid": "c6862f97-fc60-41e1-8f0b-a54b5f38a978", "value": "T19F933994BD419B12C6C6227BFB6E428E372663E8D3EB321399215F2137C785B0D77A41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785779257, "uuid": "6dec151a-bc9e-45a1-8072-767df2da7e44", "value": "1536:GyY5PRqZv1F6Wu6UvWaRvVnFvNLjCuorywgnY8V2FvwRP/mr+zlSTU0:Gy6W0WaR/1L8rlgnN2FAuC8Tv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785779257, "uuid": "6e4b4a72-fa56-41e7-b9ed-e90c22c85de9", "value": 91732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785779257, "uuid": "e0484973-8b40-4048-8874-3d4a710178f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785779257, "uuid": "0594eb1e-e7f1-43bc-b17e-f1461248b7a3", "value": "lkxstress.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3990f32-8f73-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785786332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785786332, "uuid": "234c164d-1903-4bf7-9bed-ca0ec1a07423", "comment": "Malware payload", "value": "a74b3e8e21f9073692d7479e2fc682bb", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785786332, "uuid": "9efdea4d-df9d-4d3e-b6a4-85d4ccb1ff1f", "comment": "Malware payload", "value": "052b25daa98e4f3e8a5be46798588795012f9628288ed027e0bdafbcfe681333", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785786332, "uuid": "73266a8f-d1bb-49a0-a630-de07b3cad679", "comment": "Malware payload", "value": "c27b811d96d2ef8d6b4dfa08d9755c71b30d7377", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785786332, "uuid": "95ffe723-98e6-45ca-86ca-d1a96d1ce189", "comment": "Malware payload", "value": "52f0f37c995e0fc342d6978731e6e45d8cdc15e54257a1c373db1c87a06be70f28d33b99b2b78bc6782f6c74b79fba46", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785786332, "uuid": "1914d39d-a163-479f-b971-01cc0268d44f", "value": "T13A164A176E9948F5C099E735C4BB5256BA70B84D4B3133D32E61AE782F323C1AE39B44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785786332, "uuid": "e2ffcb8f-9e86-4f61-ba65-1bc96d9174fe", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785786332, "uuid": "784feac9-e37d-44aa-b612-5e4b2446bc51", "value": "49152:6E5Z92ACx2VQ6B1pMEqFneHVYzgio2R1NlJ/87pkm7e7OATdNio+muW8nm3Fj/w2:6ehvbY84Hlu4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785786332, "uuid": "42c00554-8890-463f-a990-e9e33aa59bc2", "value": 4277072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785786332, "uuid": "4d5e88e6-e6ff-48a2-ad2b-12b2f842d0f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785786332, "uuid": "0c99bff9-020f-43a5-810e-af5aead3f65e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d28acb61-8f49-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785768265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785768265, "uuid": "ca229e7d-4726-40ea-8d17-f748223919a8", "comment": "Malware payload (Mirai)", "value": "f4d728ebfd692f08a98924add76bbe5f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785768265, "uuid": "c2bbb9ee-bd3f-427a-964f-529b66780a39", "comment": "Malware payload (Mirai)", "value": "057a852e3bd8dd555b724f266ba22f97259fd4b65049ce463d6f50f3685da4d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785768265, "uuid": "1499dea7-7eb8-442d-b640-04932adf1152", "comment": "Malware payload (Mirai)", "value": "9a696bcd7b1f23af3217e5c23352b7712ea5c8b5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785768265, "uuid": "29748f86-944c-4b09-b5ce-db6d4db95cd4", "comment": "Malware payload (Mirai)", "value": "da5e6b6892e31cbf6562638d9a68ced711bbdb162c71715d3ab4009cd92da3330418965829292547173289ea54f0a465", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785768265, "uuid": "4e780058-687a-4b62-902e-157940c5ee1c", "value": "T1A7B31A45F8508B17C5C661BBFB4E428D7B2657A8D3EF320399256F65378B89B0E3B102", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785768265, "uuid": "31bc33bd-5b37-4d63-8c11-88363483164a", "value": "1536:VZn0b2+BZpUJqv54VrPWTPXkWmDGlv5wywV6kxdRgc9YGJCiphwXUbOeM3z:L06spUi45WjXkfLd2ivUnz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785768265, "uuid": "3da601f7-f8a8-44e0-8e68-ba233ab462d6", "value": 109376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785768265, "uuid": "f1f7cca5-7c5f-4dd3-abfc-17bfd05013cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785768265, "uuid": "8e229707-6882-454a-9170-57554d0c4354", "value": "miron.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8efd3708-8f41-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785764715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785764715, "uuid": "f3d5faf3-1cf4-4ae5-94a7-3badb23dc7fa", "comment": "Malware payload", "value": "5ec5596e606e28f8e412414a5276f6e8", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785764715, "uuid": "df71f0bf-09ed-425f-b4bb-3c818b33af45", "comment": "Malware payload", "value": "0791f456de3f04a13cef7ab34156edee9bea3736087fc047513973d29eecac7c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785764715, "uuid": "f9dae47c-ce88-4923-9e5b-b235e9cce03a", "comment": "Malware payload", "value": "70f18f58df3ebdccf9fcadaab5625ff1052cbf04", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785764715, "uuid": "28960d92-a94e-409c-bc0e-b67c0021fe78", "comment": "Malware payload", "value": "75aeabed568efc03c0dcb2622eab122eb47507dd9d1b43c84f8a61787b4377afd7f1c4b450917373cbd3079083bcc344", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785764715, "uuid": "dda32757-2c57-4ade-9a77-6a173921307b", "value": "T160B02BE720061C00EFC8985974610170042378B304040AC8101700A43C282C0372A110", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785764715, "uuid": "b9929c8d-367e-453f-8bc3-b248fcb4e534", "value": "3:TKH/vzg3LcLVc/tvvjYuRebM3PjIWFW3lw2NNin:AzGc+/3RrjrFWwb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785764715, "uuid": "68bc7afc-0850-4e29-b802-76268e56d2b3", "value": 123, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785764715, "uuid": "19583ec3-e51d-44f0-9462-fc1fda76101d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785764715, "uuid": "238137c9-3a92-45b0-96cb-a135ce167af7", "value": "test.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4cd50d7-8ed5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785718474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785718474, "uuid": "28683477-91c4-4437-95a4-2bf2168ee456", "comment": "Malware payload (Mirai)", "value": "80cf33ae18550313eaab6c7b921a47b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785718474, "uuid": "7aa74534-1d6b-40b2-9ea1-95e2ee8a162d", "comment": "Malware payload (Mirai)", "value": "07bbab1d1641808a5c3cecea3710d4ae5c481decddc49675adb0f096610a529d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785718474, "uuid": "9d3628c6-865e-4b41-9528-394fd3b16be4", "comment": "Malware payload (Mirai)", "value": "5e87b5906083607c099c89d4059e5673db0b3e1b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785718474, "uuid": "e067b823-580d-45ae-9f75-c2db350af769", "comment": "Malware payload (Mirai)", "value": "f203236da9027ac9dda0a22f3fcf05e5f46cc044f473739c6b17cc94df816c1d3fade9496007da065fe0bb59cf37bc27", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785718474, "uuid": "0450533d-752c-4ab5-9caa-38fc92760994", "value": "T133D32A46F8824A22C5D722BEF92D218E332317B8E3DE32129E245F6137C659F0D77A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785718474, "uuid": "27fa8bde-a33e-478a-8aa0-8672f7e0f7ec", "value": "3072:jcEmwP9WEHpwI24eGL4d7dafrDyxCKCqR/oHPc:jxmw9pwIxB4dxaHVKC8oHPc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785718474, "uuid": "2e136e4a-afa2-4c22-92b4-28af1d5f5583", "value": 132576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785718474, "uuid": "a360ec9f-8fda-437d-b36e-bdc04c44049a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785718474, "uuid": "184c8f5c-b03b-4ea6-b1eb-21ec6e06354d", "value": "nz.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40021ec6-8f2e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785756423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756423, "uuid": "f9e1f412-a418-433c-a40d-b8ac1a98d852", "comment": "Malware payload", "value": "2a22f2c3194b6ef82e62d87a230804d5", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756423, "uuid": "a1ec440b-f22d-4991-8b4d-4d3078869d57", "comment": "Malware payload", "value": "0856fd952eaae15989bc532e0127d6ba15261d6064e057ca0c48342adfc6ff61", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756423, "uuid": "9028eb6b-19c8-43c2-8b28-c83d2aa09896", "comment": "Malware payload", "value": "48c84a774f852743011cc2c32a7c70bb62aa6099", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756423, "uuid": "b462bf89-88ba-41c9-b820-dc8c3d5ce2db", "comment": "Malware payload", "value": "50652dbad7ac470d3773fa4bdf87760c14bb68567f9b26b083ba917d53a5d342009c0db92df003d1b9cb89a498bbf382", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756423, "uuid": "07e60aec-5e78-4400-ab7f-387c0efb5845", "value": "T180B3F10AB351C808E6554C3585DDC2D7066DBC669E0AE90F36C1734E2AB26E6CF8F717", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756423, "uuid": "a267e09f-d5d8-4735-a2ab-d66dc93f323b", "value": "3072:N/XqRyToyBSVAdacPHm42RDtIHnwMqTgC4S8h:NicTnBIAUcPo4nnqTQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785756423, "uuid": "1283f737-e227-4db5-944e-f63c2615c34b", "value": 114688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785756423, "uuid": "69cd5cf5-33e5-46f1-92aa-8622a1c59017", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756423, "uuid": "7009a3e1-21d0-4e79-bdd3-67d38a096f8d", "value": "3035_260716135351_001.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48a64b53-8f3c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785762450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785762450, "uuid": "c165db96-da24-4380-b43c-7a108120d2fb", "comment": "Malware payload (Mirai)", "value": "e8a49303c543bb74c6ae2eb536b7be3c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785762450, "uuid": "cddb9e7c-f214-49dc-ac07-35877eb9da3c", "comment": "Malware payload (Mirai)", "value": "086745aabc5602cdcf25bc78852cec41fd059c98fbc021ff8e80b73602e20f65", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785762450, "uuid": "2dc2e0e1-0ab1-4b47-8cd6-ff36e60f0897", "comment": "Malware payload (Mirai)", "value": "10baa3019c6a71143904b98feacdc50618e9fb79", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785762450, "uuid": "303ac130-596d-4373-964c-0046becb6d1c", "comment": "Malware payload (Mirai)", "value": "750c59eb00eca5eb10494a10c86be312225834a69df8a9c67bbaf826844431bff1f5a3cb58137238683c80c1fc6b7740", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785762450, "uuid": "ba0f521f-2445-4658-8186-9859fce587e5", "value": "T13E14C51A6E319F6EF729823157FB4B21D31932CA17E1CA46D26CE7001E6039D6C5FB98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785762450, "uuid": "d00d8923-c0e1-4441-85b3-55afccdf30f7", "value": "1536:cEBD698TW4NzZbDd+Jo6XURI/rQKydSwalVDGRMZdojA2keJ+uCD5cYVnQo3a6Fw:RR6y3dIo2QKyE7L7ojlA5cYVnQodc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785762450, "uuid": "4c6cd9fb-83de-4e9f-8889-1aea40918abf", "value": 207520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785762450, "uuid": "6a76c15d-2652-4d06-9b1b-ce834faad085", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785762450, "uuid": "a7a415c5-ea2b-4cd1-af09-01585c82da05", "value": "tmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "213c0132-8ed5-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785718146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785718146, "uuid": "aeb595c8-df1a-4522-9326-7c95f25806bb", "comment": "Malware payload", "value": "89ccf0e628a266b5764c9602279451a3", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785718146, "uuid": "78bf3214-c50a-4f16-a9f1-420e3351f016", "comment": "Malware payload", "value": "08a91019ff7ba6f77de3b774dc201cca18edfd264f9a46e34f243f6d76e37077", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785718146, "uuid": "0e723afb-f70b-4606-8da2-a0fbc13e78be", "comment": "Malware payload", "value": "59669e051d7915e5af98a69aca8716f4fcd95ec2", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785718146, "uuid": "486d26b2-98bc-4fd8-9e8f-8a0ed4e12823", "comment": "Malware payload", "value": "456c8ab579d26ad5ef7f9b597a81eaf82d783e0698a3a0a8d5336b316af7a6637ffffabdd839aa20e566d33bb18ad9e8", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785718146, "uuid": "1b475779-66be-4ad0-a9b6-450738c0f6db", "value": "T13FC27D966A867C44BEC98A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11F9CD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785718146, "uuid": "571142d2-8b0e-4e75-943a-651e519d7cf8", "value": "768:FQV8vCB+25j6es8R1X9FYpMSUpi+20qUpi+20YQX:W8l25J1xd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785718146, "uuid": "31ea8fd7-a731-4b18-9617-89eab6a86bc6", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785718146, "uuid": "3a753edf-538c-4f8c-9816-a175a11328e7", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785718146, "uuid": "610be846-0d93-4b56-91be-ec438f1700fc", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a350bd37-8f43-11f1-bd95-42010a9c0009", "comment": "Malware payload (Xw)", "timestamp": 1785765609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785765609, "uuid": "a59ceb47-655e-48db-9a53-283efb0e1abb", "comment": "Malware payload (Xw)", "value": "36cc6f8f06019f5c20deca53d6082234", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xw", "colour": "#43DCAD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785765609, "uuid": "cb9eb575-db2d-457f-948c-05a807278816", "comment": "Malware payload (Xw)", "value": "0bc8c8c368ddd8047900fe40d00159b033c6ad52f0316cc4dc8c0dd8ac66d2f9", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xw", "colour": "#43DCAD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785765609, "uuid": "45259a00-a030-4131-b94e-1be264c8cb25", "comment": "Malware payload (Xw)", "value": "1b1c0516dd36c8b174f9fda82c5d8ecccd6e1fd7", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xw", "colour": "#43DCAD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785765609, "uuid": "abf4566f-2b83-4ae5-aacc-fc09dbc780b1", "comment": "Malware payload (Xw)", "value": "cc15a822dd4503a77ac4cb1e2e2c90b27abd99d076fcb8db0f560b4f1f04c1deac14cac1b4e23ef08ae1f54896c5c63f", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xw", "colour": "#43DCAD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785765609, "uuid": "23ef109e-1a45-4782-8950-635f8a1ba692", "value": "T1B115BE4EB2D331FF1ABDB618C8051B16B8F7BE0D24150D68C136ADD6D6AB167840C9AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785765609, "uuid": "241a97e6-918d-432a-9323-5668d52101b6", "value": "768:GCJNcUnYXjuz5fHxEpcYBpVO61pLVaqE9xF/cj2A0Fwj44GmosYT/Vbb8AjUORuk:Z1f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785765609, "uuid": "3c6fc7e8-edc8-4061-92cf-34ad7920eb04", "value": 947073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785765609, "uuid": "3b050e97-c0e3-4070-813d-b83fe0b76a58", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785765609, "uuid": "4f549b64-a9b1-44c2-b921-11ce7544bfb7", "value": "rPurchaseOrderNo_002082026_pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebc81205-8f2d-11f1-bd95-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1785756281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756281, "uuid": "0669b4fd-5d26-4750-b489-9e55618864f7", "comment": "Malware payload (XWorm)", "value": "f6ed08f1026449dfa4d65df5ceca4e2a", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756281, "uuid": "e30b5d36-ce94-4824-a6a2-1535c0d7c014", "comment": "Malware payload (XWorm)", "value": "0c6a3c6460f32d1d68b2faf454b646e970da513232d4ba91541f15323b84225c", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756281, "uuid": "866d8825-2cb9-4d85-be8e-0f15e92a1077", "comment": "Malware payload (XWorm)", "value": "6391213730f6d64c7f54cd69cd35a369db59af73", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756281, "uuid": "507cbaa8-4dc5-4722-aea8-e4325c2623ef", "comment": "Malware payload (XWorm)", "value": "1dc25b303b29015cef32ddf882c34a176900bcb41517c415c916d6a63b75cbcd846e7aa86c3db5aacf616c60c1aa069e", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756281, "uuid": "2e8b7009-5329-4063-bc3c-ee535c32d437", "value": "T1EC22B0DB8B338BA433816558D439D785131FBD9D37CEC320234E3ED2C692254AE9E692", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756281, "uuid": "d8875b9c-cece-4563-89c4-6ea9e9fbef19", "value": "192:FGwWGRKimXCi9JXLCs4gkVVCJtEy0k6d9cnzvfN+z:FGqK1XCi9JXiVVatWdW7V+z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785756281, "uuid": "5c997c2c-4944-4f88-9f5d-cc61482575a5", "value": 9926, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785756281, "uuid": "11d2b224-c41a-4d4e-9439-9f86879a9f96", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756281, "uuid": "6d965cb6-8531-4328-9cb1-dbb98a502993", "value": "Order-Specifications.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0a72555-8f48-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785767832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785767832, "uuid": "c4d5ddd4-1107-49ae-9eb3-615b6f13aa2b", "comment": "Malware payload (Mirai)", "value": "7ef3dfc4315f85a776d0a9a721de11e6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785767832, "uuid": "60ee328a-f5ea-4e35-bb25-c638a3ade0ca", "comment": "Malware payload (Mirai)", "value": "0ce142bb8ac39905c74eb7bc0708e87b4a3eac2da242fad2a8049549fd3a7ea1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785767832, "uuid": "4782b9a4-52dc-47ce-98ac-796791fafdbd", "comment": "Malware payload (Mirai)", "value": "31099c2f31aea045f90957acfef0becc8284baff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785767832, "uuid": "2a2da1ea-f59e-49dc-8bc3-61d167fa277a", "comment": "Malware payload (Mirai)", "value": "6530ef3ed3ba74b7bad17ca748c27889aa34f019990e9d3e80dd8c5d76ae46738431a0895bdc08ff89116c45c032a186", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785767832, "uuid": "35279ae0-b14b-4a68-b3cb-5c2954202ebb", "value": "T1DA2301670368260CC228DB79CC8751DC7DA3B7882276BAFE0752F5C94311C964B6AFA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785767832, "uuid": "5d4e2506-f97c-4d7d-b135-5ae1b4923805", "value": "768:QxDgP9UtSbJF5ZimrK51r1fVXSo5jkHtsPnI5KJoYsz7rSEtZJsS:QxDglUtO5ZNi1Bko+HtL5+o9z7bZOS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785767832, "uuid": "d62ac7e5-2faa-420d-947c-a86f1cbbf9f4", "value": 47860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785767832, "uuid": "aca4c0d1-5b21-4d2a-8803-688ed6ac1f0c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785767832, "uuid": "fbfcc1fe-88ab-4968-98a7-1a9fa2ff1acf", "value": "miron.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b704cc6c-8f94-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1785800431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785800431, "uuid": "d926c9e5-ed6b-4c7d-8668-0df9530139b3", "comment": "Malware payload (CoinMiner)", "value": "d22dc224cc7f11bf35137ed753078d62", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785800431, "uuid": "463cd698-334a-403d-8c51-41b33bc3ef93", "comment": "Malware payload (CoinMiner)", "value": "0d477ed687d9f7424d2d28b66717bad4c0d21db8433752c9c51b032d04066af1", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785800431, "uuid": "3aa9a83d-9e5a-43bb-bee9-f434887ea18e", "comment": "Malware payload (CoinMiner)", "value": "5a299e5bcf4b947e9e3aee9925ed068dd8809f9f", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785800431, "uuid": "50745f12-babe-43f4-9d68-371103419de1", "comment": "Malware payload (CoinMiner)", "value": "57e2ccd2f115119f84293a2c964aece7e3817afe409bcc9b61755ad5637d8e1d363f48f56df1ba60d2d27822ee8cf255", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785800431, "uuid": "335f52e7-8ba3-4a95-a753-240bd5e2b11d", "value": "T15922392B7E444231E3A109B41175868F557D1233A787B3EBF373EA9E0BE62049440EAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785800431, "uuid": "c3c74a40-e084-4ba4-ad84-aadd9534c4ca", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785800431, "uuid": "71e0ff3d-d5bd-441a-889e-d65ff831ac8a", "value": "192:uaWso+WuaB6x+eClaWBfPFJxTEZmFhSorcP2:jWsoMJwhRBPFwZK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785800431, "uuid": "c97208c0-fde2-4363-98c0-1c0eea4e7592", "value": 10752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785800431, "uuid": "f51c9f55-d344-428f-8450-af0a75b9c7e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785800431, "uuid": "c9b92ed2-85f8-4589-85fa-d2eb3e0d88b9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a687fbdb-8efc-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785735120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785735120, "uuid": "2596571e-4080-4b8f-8eab-04f2535c5e92", "comment": "Malware payload", "value": "c0df7d085947183f7114c0d79c4cc0bf", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785735120, "uuid": "00c60fb6-d6ab-46c3-88c7-e3d63552d183", "comment": "Malware payload", "value": "0d4f1d87798b83be37c3b8723b8be93f978a5f51bc96958e8f927c1d22a59e88", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785735120, "uuid": "1fc8d9be-7808-4d59-beac-026d1860d942", "comment": "Malware payload", "value": "d7bec074a71f1a6dd68e1ce1958e0366604f59e7", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785735120, "uuid": "648d4000-0352-4b46-9296-445edce66603", "comment": "Malware payload", "value": "2200d2729ea833047a6a80a254a82cfe548dff1a13708f3ff099fb6d6143c9ca1f39fb12b4a99ad8ad61c8366bdb3372", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785735120, "uuid": "76e0fde0-980b-4ccb-a218-9af02ef9811b", "value": "T14D93C0A8402F18B1C8125DA75FAC111040DE46C992BE716E68DC79E8EF43F77FAB6C25", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785735120, "uuid": "29b72feb-46a3-40bc-857e-9a9adaa5117c", "value": "1536:3DdHttPoXaPTQsMosVfRjDeKREXZHYAGAu015Reb:zdPoXsUbxflbR9AIb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785735120, "uuid": "5e7714dc-ab95-4d2f-b2f5-7306482d10f9", "value": 92766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785735120, "uuid": "7f95abf5-9f84-4db3-af02-ee01ad1aab81", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785735120, "uuid": "e7136581-93b8-44fb-86b5-cbd95aa11ee4", "value": "RqfXOilXDistributionXEquipmentsXAugX2026XPdf.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b79d2e5b-8f0e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785742879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785742879, "uuid": "cfb49fdc-7cc1-4a72-b117-3a7fa9e988f3", "comment": "Malware payload", "value": "bb8cbfc7790e386b7173ad8e29616b64", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785742879, "uuid": "60572730-3f5d-453a-84c5-ac466bf0f28e", "comment": "Malware payload", "value": "0dc1c17732b3643fe43368ab72b5c92474c22c9871934c7aede2ef3aacd3d0c5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785742879, "uuid": "af3a57f1-0bd2-448e-9ce1-bf595fca43bb", "comment": "Malware payload", "value": "691347fbf37794e64fe98ec78c2318cb33b77282", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785742879, "uuid": "9c1a2af1-d98a-4881-abe2-2ca7d723919c", "comment": "Malware payload", "value": "0d1ba900ae7418823543474564a76fcf3f04c7cdcbe4ed26790c3e40c28975bae828d9071a01cb9004fe7b04e88e0dcd", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785742879, "uuid": "d81543e1-7173-4a38-9b56-ecf2b9ea3765", "value": "T1BEC28D966E867C44BDC98A3E4CBD2B1D6DF5C3D1324942AC3D8A3C719C11FACC618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785742879, "uuid": "9a80bc9b-e15d-4c0a-92ee-dbb95cdd9471", "value": "768:58vCB+25j6es8RC9FYpMSUpi+20qUpi+20YQX:58l25Jkd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785742879, "uuid": "eee2e79a-3fc8-47f6-a219-531ceb15c343", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785742879, "uuid": "87871076-b0f1-4ebf-9fe6-6c71f2c18ea9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785742879, "uuid": "17914d42-0e3b-4964-b7b6-e44e8256a6d8", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f781c262-8f40-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1785764461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785764461, "uuid": "722715f3-a4d5-4070-8f16-dec04e215c65", "comment": "Malware payload (CoinMiner)", "value": "c63d0b0188904d9904a22f43d0275301", "object_relation": "md5", "Tag": [ { "name": "bash", "colour": "#CC62C8", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "postgresql", "colour": "#A47ECC", "exportable": true, "hide_tag": false }, { "name": "rediserver", "colour": "#D3FCA3", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "shell", "colour": "#705F77", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785764461, "uuid": "07fc93b0-1cb2-4cdc-a254-9e0203694c13", "comment": "Malware payload (CoinMiner)", "value": "0dc71107e3965df98aa4ce5843c7436a95a203f56bfc6f5647f68b41131ef1c0", "object_relation": "sha256", "Tag": [ { "name": "bash", "colour": "#CC62C8", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "postgresql", "colour": "#A47ECC", "exportable": true, "hide_tag": false }, { "name": "rediserver", "colour": "#D3FCA3", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "shell", "colour": "#705F77", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785764461, "uuid": "0910443b-b8fa-4134-9963-0e286e4e42ee", "comment": "Malware payload (CoinMiner)", "value": "addc73d42d8951ad994745095e4d53d8cbf6cac0", "object_relation": "sha1", "Tag": [ { "name": "bash", "colour": "#CC62C8", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "postgresql", "colour": "#A47ECC", "exportable": true, "hide_tag": false }, { "name": "rediserver", "colour": "#D3FCA3", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "shell", "colour": "#705F77", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785764461, "uuid": "14228143-0e02-42d9-98f9-5c605c2e1f18", "comment": "Malware payload (CoinMiner)", "value": "12bb9527feca5e3cae95949e2ea520eb77f7cf9f2fabac3b443e2b5affd99051cd9d0ea000b3ce3b4427dbde4d86bb2b", "object_relation": "sha3-384", "Tag": [ { "name": "bash", "colour": "#CC62C8", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "postgresql", "colour": "#A47ECC", "exportable": true, "hide_tag": false }, { "name": "rediserver", "colour": "#D3FCA3", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "shell", "colour": "#705F77", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785764461, "uuid": "f745ad77-a8fa-42f4-b9df-4c3859996996", "value": "T11331344AE53CAC2E39DC4D61B5D15180A183CBCC5A766A24F773ECB56C6C106B22DA28", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785764461, "uuid": "73730d18-8275-482e-be4f-182870fea9d8", "value": "48:zipPHn5ZYOgKoH77j4GLtPi0hetTmZKjEg:zihHDYtkGLtPi/tQg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785764461, "uuid": "8b883696-de95-4275-959d-664d0b15d990", "value": 1682, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785764461, "uuid": "b65d6d35-cc3d-4777-aef8-c02054eda7b5", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785764461, "uuid": "eb950aea-1fee-48b5-96e4-38231cc57a94", "value": "0dc71107e3965df98aa4ce5843c7436a95a203f56bfc6f5647f68b41131ef1c0_from_65.49.27.190_pgcopy.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62bab2c9-8f35-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785759487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785759487, "uuid": "274e16d8-d842-42a7-bc82-44f71ef8da56", "comment": "Malware payload", "value": "f6804b537958ef3f568a327b005eaf18", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785759487, "uuid": "dbfefa91-4ba7-4cbb-a1a3-82e9fb10b41b", "comment": "Malware payload", "value": "0e5f917db5e97e59801ebf005d6961bdf912fc0e297dda52d7b693389f7d8455", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785759487, "uuid": "67626866-821b-4b16-8aab-0372fff87b81", "comment": "Malware payload", "value": "9d6fcaa6c8e62ce4fb3c56af6e6849674c3ff648", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785759487, "uuid": "e0f3e4b1-73e7-48c3-8d71-a0bdbef376cf", "comment": "Malware payload", "value": "3fe00514f48221c6fcf2d28413b7de6a35ebcb67fa243402ceb1e0aec5f8aafecea0a837647dff804b637d6fc13f6aec", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785759487, "uuid": "57aecc69-6acb-4fce-a7ff-a7614fec982b", "value": "T19E9302820D8BC39CC60B603045659ECA2E91074AC458D96F46FB5EA614EBDD7BF27CCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785759487, "uuid": "72750904-28b5-4fe4-af3c-1fe19376fa54", "value": "1536:BGt0J4xbjVtT2jQuTDbYa5KL3vDAhu7yqYbmHqjqa9j48E/av8zjYM:g0GjVtluTPYa5KfrAb+qua9j48Hv4jYM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785759487, "uuid": "fc397f85-abd7-4a1c-9f63-f7e4f0c96f1d", "value": 93652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785759487, "uuid": "4b16104e-939a-479f-9070-60f2374054a1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785759487, "uuid": "64c31fe4-d369-46d2-b619-898a44d41faf", "value": "1.21.11 (2).jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6770439-8f0f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785743307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785743307, "uuid": "2d6ae5ce-44ed-48fc-b371-79c51d9336e5", "comment": "Malware payload", "value": "309197d49671b9135b19b670a94145ba", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785743307, "uuid": "f8632a70-82ed-4caf-afc7-2d91c79f22f6", "comment": "Malware payload", "value": "0e6faaae537b9d1a7bee629668eb41e0be7c20e93f54b6c25d8b6d86e3b5c8c8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785743307, "uuid": "e40f8416-9ccd-4974-b200-6b34ebdcbee1", "comment": "Malware payload", "value": "1824fe70568876445f99aa73ebdedb2405c5906a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785743307, "uuid": "ece48a0b-6d81-479a-b679-83fb87df06cc", "comment": "Malware payload", "value": "6893ac7d0399bb2970f44bfa8a359183b239abe559aabc2385ed51a43f117cc17c344590920df994b80d5d6319b7c54d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785743307, "uuid": "388f5ffd-0ad1-41e2-82c5-58fd6650d2e4", "value": "T1F2235C6516857C24AE98C8361C7E2F0CB9AD43E6324452EE7FCF3CF68C4AA9D910971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785743307, "uuid": "e64fb3e7-3891-431a-97b4-33e7057d7511", "value": "768:7+e9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:7+Lcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785743307, "uuid": "ba3032b4-e173-4082-8609-43470826bdaf", "value": 50051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785743307, "uuid": "55a4257b-9c80-46c3-9fd4-8e6817548342", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785743307, "uuid": "f6cc6b79-a17d-45b1-b223-13dcec5c1db4", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dd4bc44-8f3a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1785761492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785761492, "uuid": "88b94643-85b4-4952-ab94-e87831a8bcb2", "comment": "Malware payload (Formbook)", "value": "b2f762bb14208360400afb6ead98cfca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785761492, "uuid": "06de8885-f3e0-4c41-82ab-f3b0e796b8d4", "comment": "Malware payload (Formbook)", "value": "0f2b42e74b69b831569d55b2b450a1a840b9a6edd3a43abc953c87b7fc3392b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785761492, "uuid": "c377405c-4f7d-4aa4-9c35-192de399f5dc", "comment": "Malware payload (Formbook)", "value": "135c0038a29d2209d4333e3c02ec163fa3b6ddae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785761492, "uuid": "6b5446e8-f693-47ce-b328-ad277ac32fc7", "comment": "Malware payload (Formbook)", "value": "71464a84cef235cbf6fc4a31590db95282be40ecdf999a22f274357e8b135fd0eff09dfa0a3722d93e55643b34eea69e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785761492, "uuid": "74c9da8b-a5f5-4f5c-ab3c-151900cf7863", "value": "T140E5B86332CE7A077E067393904DE9658F5FC52B1B42BCC8749E4888450A6CF6ED4DAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785761492, "uuid": "1eeaf4fe-6e82-4b9b-95dd-e65cfdd06b91", "value": "12288:aZaymIsFxMB7NQ6HhMzdPcLz9B2uxlZIDfbPt99oCfYWYwvdDQvlHOQC9ChzCIg0:gBKavuHR45MXfaLQT70NIfcNPcbPVvc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785761492, "uuid": "30f4d390-e066-4b89-a88f-318896632310", "value": 3146182, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785761492, "uuid": "a12fe9ce-ba0b-4aab-993b-24eb4a3c0635", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785761492, "uuid": "f5edfd77-42cd-44a8-bf7a-833ac98e9e76", "value": "Arrival Notice.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0b9f4d7-8ed4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785717930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785717930, "uuid": "bcdbfce4-0107-43d4-b7ef-e2871642761e", "comment": "Malware payload (Mirai)", "value": "844ea552dab68db838c2d682fec39274", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785717930, "uuid": "2232f3cc-2301-4770-862b-073413007233", "comment": "Malware payload (Mirai)", "value": "1018201ac9e47403b240fdcbce9ab1fca8837694a92ffab02089eceef7541ede", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785717930, "uuid": "5443c5f9-0788-4774-b064-eb1d2476275a", "comment": "Malware payload (Mirai)", "value": "6a441f2146a49485764a7673dfd1e2fe835a6cd9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785717930, "uuid": "5282cd54-c9ee-4bf8-b4a7-812b9898a72f", "comment": "Malware payload (Mirai)", "value": "4163f34c179314ce2e54aa301a2c805fc878993f0e6685ddd8fc2ec240046e9378d926efdd8c89665c42cba75bc0c0a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785717930, "uuid": "caacf12c-3601-4e50-8213-76d017efcf59", "value": "T1F2E3E80E7E218F7CF795823447B79F1A965833C637E1C585D1ACEA012E2068E645FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785717930, "uuid": "b378e190-56cc-40c5-9fa4-61e586f3def9", "value": "3072:0dK+SE7ktsNOT8wR41M7qlkoKrMh8XQPr6elpEqRzrnPcH+14tTI7V7mFM7mYIrz:0dK+SE7ktsNOT8wR41M7qlkoKrMh8XQ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785717930, "uuid": "0064f525-0489-4c72-8895-643415ec015b", "value": 153372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785717930, "uuid": "fb6071a5-33ef-4905-9b01-f23bb3ac9d91", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785717930, "uuid": "db2ea3d4-57ea-40ca-ab41-46294a38618a", "value": "nz.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2f9babe-8f72-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785785794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785785794, "uuid": "d5e3dd04-8350-4b4d-9f70-4ea0e619ee9e", "comment": "Malware payload (Mirai)", "value": "fe4fc7ed7696a18680d5f46b2636206c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785785794, "uuid": "b9d6e5d5-e549-46d0-8342-bb4c50becd88", "comment": "Malware payload (Mirai)", "value": "1107aadd5df38b3f62710237e84538cd4a7d5c3da44af0451b6777d83c58d253", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785785794, "uuid": "859e8cf0-0e1d-498e-b368-f3a3b3641f8e", "comment": "Malware payload (Mirai)", "value": "5dd775c0076533ff9a67d049607a427bc385b37c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785785794, "uuid": "8e9e6e1e-172a-4929-bfd1-4a069579b8d3", "comment": "Malware payload (Mirai)", "value": "f100aabb7ce772dcd23900c932365cd9419392266d2bfb56813ee9338224bab9daac9f0763a55f4e097aa31eb9ddb6cd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785785794, "uuid": "5017f3f8-d955-4b19-86b2-1a927cec6e1b", "value": "T151E3875D6F228FAEF66C873157F74A30A75C22D623E1E684D2ACC1145F2028E545FBE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785785794, "uuid": "5acd4995-364b-4f25-8a8a-d550fd3ba522", "value": "1536:/g0ohqwhNpaHjMVqD9CFVZqUGYoTOy9Ha1T34oPMIYj4beESVRxj:Y0ohqLoVqD9MQ/TOFSoPMIYj4ZARxj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785785794, "uuid": "51ec75ad-bed1-4008-93d3-2e0f609e5352", "value": 148508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785785794, "uuid": "a1d51bc0-5f5d-4dfc-b5ed-12ef85f0a15c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785785794, "uuid": "59201a90-1029-45e1-9b55-576ea37e6993", "value": "miron.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4b5bf77-8f5d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785776885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785776885, "uuid": "5cc59139-736d-490b-a75c-d77f0843cd6b", "comment": "Malware payload (Mirai)", "value": "ddff5f2f6b79fe18a33b4eddf6b8e3c6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785776885, "uuid": "edc5c84c-d7ce-4990-bc08-27f6104cecb7", "comment": "Malware payload (Mirai)", "value": "1110d37053fbefa3ce931a85d8ae3207815d0fe73d30693d8f76fa3a70900555", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785776885, "uuid": "e2c512ce-2287-4d46-b326-bc5607ff3a51", "comment": "Malware payload (Mirai)", "value": "ecf4e1651070c7bfa816eaa6e72be0cbae4a0381", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785776885, "uuid": "7ae76804-49f9-440c-b66e-c8024a6a5f39", "comment": "Malware payload (Mirai)", "value": "50e81bb1cca6f941571c1f5c0ff6bafab75b38718a5dedc82d936ee4d6e67d3efe3db8168a85ac5cfdd2093b689cb853", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785776885, "uuid": "e0f7e135-b05d-41f4-81bc-637c89d49914", "value": "T1F6A2D01308D21C79CEB4D831FD7DC24F32961FB9F2DD727A28045276A6C6C0766B9662", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785776885, "uuid": "a52be496-b9ec-476c-8519-7ad5467d8b4f", "value": "384:/orW4V1gXq/F/JHQ6eD4AUZkJZ/2vr8az1Jid5z0l0dKgP8hymdGUop5hKwY:/K7gXqt/JHQ6k4ASk/+rZz1kd5z0lWX6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785776885, "uuid": "c2b3ebfc-6eea-4686-b8f0-fa7ceb8b3faa", "value": 23028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785776885, "uuid": "11cf6057-8dfe-4a16-9116-1258e530c66c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785776885, "uuid": "df372bae-379c-4bba-9b04-660ecf057485", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e84300ca-8f5d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785776891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785776891, "uuid": "27c4e6db-aa93-4171-b49c-01d080a23894", "comment": "Malware payload (Mirai)", "value": "1d8ea80e42b20d546101b1eb6f0924c7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785776891, "uuid": "2af2d0c2-49ac-43a2-801c-efbd31a20c25", "comment": "Malware payload (Mirai)", "value": "11930b03f4eabccdc20bbf11819e0cfa79b94c8119882a55f4a578e9e147aaea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785776891, "uuid": "83ae7017-bb85-4c95-a697-a40f9932c339", "comment": "Malware payload (Mirai)", "value": "4d6b625a95f0e23eeb55b1017e80bb791d2df672", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785776891, "uuid": "78c90f3b-922f-4774-947d-59aee63ef6b7", "comment": "Malware payload (Mirai)", "value": "086338a4bbece9a5c9b283107c6e84be46fee69e51258416d5ed61f3e857b15c86dd18b8b099d1aeb552ea585af23e50", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785776891, "uuid": "5d9b4308-0200-470b-8689-edd224ee8f03", "value": "T104F39EA3F30B1090C82306F41BCB6B9D6E2315431F6BC6E7BC6A31396A765DE5905BE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785776891, "uuid": "42b9ec5f-a9e1-4fc7-9eca-c141e146cd25", "value": "3072:uot+gknCZ5Nu+97umSJ9u85iOOC7+aQkoUAcVk+o/Vyu7geCmagM2Cub01eSq:uot+gknCZ5Nu+97umSyrOZ+adlA0OQuN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785776891, "uuid": "84fd0b65-06e4-4650-a139-aae44517f8ba", "value": 165352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785776891, "uuid": "fdcc517b-f320-4f08-ac5d-84d48bfdcca2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785776891, "uuid": "61813854-a348-4fea-9ecf-3743acde1e9c", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c55e47f-8f4e-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1785770241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785770241, "uuid": "55f0cf38-a687-486d-8a9b-daeb4f01b6f5", "comment": "Malware payload (RemusStealer)", "value": "ccbe729552b9298fd594305af3527bd3", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785770241, "uuid": "66d6132c-73c1-4151-8b0b-54b16281a277", "comment": "Malware payload (RemusStealer)", "value": "11a258ccf1bf0cc0a8edfd2b5afda3e7bf6b1b4b25936ff32e7db5b48514b66b", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785770241, "uuid": "28733d6e-5980-4659-be0d-a58696139c23", "comment": "Malware payload (RemusStealer)", "value": "d900e63ac7565f73c329d3087ecb569d8e37f250", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785770241, "uuid": "21de962d-0e43-4bd5-96d2-ef1eadcc8338", "comment": "Malware payload (RemusStealer)", "value": "c25d1772a67a8ef3eef6783251f7ea514ae0652eb1e2c843445de078dec5cac42bd8d0f17d67baf8cb68c4c9b08f6c84", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785770241, "uuid": "e772d1d1-d27a-485f-b01c-81d1d917539b", "value": "T13F257E59B7A918FAEE77D13CC9524505EA72BC524760E7CF03A00AA61F237E09E3E711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785770241, "uuid": "96d50a52-9526-4306-9dc6-411f35b306b3", "value": "6197946e028952867fa8ae79ec4481f4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785770241, "uuid": "8c2621a8-3cdf-4b26-bba4-1242a1ab75eb", "value": "3072:gFqea5uWbxMIVpgIEcl/MsOv6p+Tw1H6oL95lDTqHpl00X2Qid3FiQ14UtHsVIvT:AYM9CpUhwPkny3FOVIvW5VXrtmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785770241, "uuid": "37fe961e-ba2d-485e-a0ce-e7f564db0ed9", "value": 1048576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785770241, "uuid": "9d80a0c0-da41-4edc-9b83-ad46054be951", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785770241, "uuid": "35b35693-91e8-41ef-aee3-d937a5e03fe6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83a48067-8eff-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1785736350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785736350, "uuid": "2e7e0e6e-d056-4312-815d-abc27d368387", "comment": "Malware payload (RemusStealer)", "value": "8e82c29c8f56e5c8688ed59fa9b96ec1", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785736350, "uuid": "059ac616-4911-4281-af40-56ce203ceb72", "comment": "Malware payload (RemusStealer)", "value": "129917ed452c3eb6c19552d38ab4d2b4a741c35d8da76dd9b0313b868ef54c08", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785736350, "uuid": "192df253-b260-4948-afc6-08613035d28d", "comment": "Malware payload (RemusStealer)", "value": "fd254f312fb2d68f00f75ad55aacd6a3bc8a8537", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785736350, "uuid": "0dd40659-7a25-47a4-b100-ee8534dae95a", "comment": "Malware payload (RemusStealer)", "value": "bcee020c6cf59c5166d5408ac13e848d738b81204d3bbb5e5c17abbba02423efa9ac2f47f6920ce32d134e6c53c446b4", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785736350, "uuid": "4141287e-3b91-489e-8c9f-12966e48088f", "value": "T145E56C03BDA448F9C0DAE73988676266B674BC09473233D32E917AB92F767D09E34744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785736350, "uuid": "a303aff4-9618-4b9b-ac95-3c869acb2de3", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785736350, "uuid": "671cb992-bb61-4ef4-b13c-6f28237c2408", "value": "49152:eaRCNmy5vCwRK6uy0DJbvP4fkDFj0B67lDAZpB:eJ67Lj0B67SZ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785736350, "uuid": "aa2f3a3c-27ac-4faf-b3bf-ed66b7c9fac6", "value": 3295608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785736350, "uuid": "c23d5ce9-d5f0-4714-82cd-1eb88118fec7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785736350, "uuid": "268fe858-ac72-4ab1-ad8a-50569a53bd54", "value": "QuickFetch.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e9834d2-8f0a-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1785740931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785740931, "uuid": "2e4008bb-02cc-4f38-a8e3-75ae5e04c06e", "comment": "Malware payload (AgentTesla)", "value": "db14da6597a140ad252b59dbf6570161", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785740931, "uuid": "4c9728d4-2be7-493a-a212-a2dfd3d3cfe5", "comment": "Malware payload (AgentTesla)", "value": "12d2509ef269969cf5811fbfe5675bc77778eec8405f0b0d4f143520b8d559f9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785740931, "uuid": "d3797a57-4a83-4ea7-a20c-b4e97e964235", "comment": "Malware payload (AgentTesla)", "value": "de4bd45302f191c1c1582424949a23dbffab6e46", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785740931, "uuid": "9fcd8da1-c9a0-4f4d-a272-ff2e92b70804", "comment": "Malware payload (AgentTesla)", "value": "2afa60a9fd35fb8091649976d465709288224905594486c4fa78e2565d955afeda3d20d9b9b295c47cea172f07a3205a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785740931, "uuid": "bedd559b-0f6d-4e19-9cdb-be80af5ba506", "value": "T1933512182A0ACA03D49457740BB1F2B9537D1DEAA901E3176FEDBDDBB67AF054D08283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785740931, "uuid": "f4e709ec-08d0-4324-8d11-2d0af5fd5621", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785740931, "uuid": "622c286b-955d-4711-a041-70ef8082bcfc", "value": "24576:R9PZ0LtZvTJpzCLW5OP+w5TVN2R4/GeA9s:R9xSzTJpuBTqaHUs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785740931, "uuid": "77a3b2f5-9974-4f6d-a8b6-9506a263e791", "value": 1141760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785740931, "uuid": "ac1631de-65fa-4046-88b5-eb24dec7b070", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785740931, "uuid": "f0e1b86d-5b84-40d9-8344-96315e467346", "value": "AWB SHIPPING DOCUMENTS_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "396bf2b0-8f50-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785771014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785771014, "uuid": "f5a9efbb-4df3-47de-83a6-d8ff55c343ff", "comment": "Malware payload", "value": "de2419aefde9d8c4511e62fa03cffe88", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785771014, "uuid": "46302de4-6317-426f-9fd7-5dbeeb9552cd", "comment": "Malware payload", "value": "12e975c622b455d3daeec7869922a5417a1227333e6d925017d4b8e3cced8a9b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785771014, "uuid": "bbfb6b2d-ac49-4bce-ab38-01ff72c670e7", "comment": "Malware payload", "value": "b55f0605906a13c02b7aa6297e30678687cdba77", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785771014, "uuid": "8387272e-afa0-4af6-9e71-c015d1474e9a", "comment": "Malware payload", "value": "7817677f4f8a5c8a2ea8f20a4000d26af5c7d5082413d99ceac48f8ff7a9a662a0fee740460658491f9842ec04ebe0d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785771014, "uuid": "93f7ed42-b322-4512-a131-5bcf79bcbb35", "value": "T1F5564B73A09154D4D2AED574C6156213BEE4388B673863CBBBC076F11B7ABE49A78330", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785771014, "uuid": "957c215d-bd98-49a7-b728-bda200ac866f", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQK:cqYUQuVDt0TZEp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785771014, "uuid": "565edc0c-d0e9-405e-a8fb-6cba9b73f42e", "value": 6029312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785771014, "uuid": "875ba10f-a5b6-4760-8f74-5e29172368ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785771014, "uuid": "096e4ef1-f73e-4963-9750-d3d1f6522e1f", "value": "12e975c622b455d3daeec7869922a5417a1227333e6d925017d4b8e3cced8a9b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "086acbf9-8ee2-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785723688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785723688, "uuid": "0a6c5b43-193e-482e-9a3f-2540651bfc23", "comment": "Malware payload", "value": "2f6c419988e7588c7abee23c8b3ab597", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785723688, "uuid": "1d431f61-fb8a-4776-9433-dc29445e87fd", "comment": "Malware payload", "value": "13d4561d9e33998b2459ade45408ac962e468bd7b076d49d1313dd442f34e909", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785723688, "uuid": "c6ea1561-aeec-4237-aadb-07a336fadd3f", "comment": "Malware payload", "value": "176d22312713ee5001c99c4870cd83fed02d0d08", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785723688, "uuid": "e537a57c-ac74-4d85-8cbe-e720418b020e", "comment": "Malware payload", "value": "96c5846dd9d64d575f4bcc9ec3bf1bedb3100a0ce7bf482a32473b55bccc31a9f0972a8e397ff8c6ac838a93149ee562", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785723688, "uuid": "2416ff7c-cb4d-4005-901b-897e1b83c894", "value": "T17F016FD6D25095104019D95E6AE75290B421C3C7094A0BB87FDC983DEB98D15B027F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785723688, "uuid": "1d913fbd-8eba-42c9-9e93-316354de22d5", "value": "24:kXCKysE2hi0ziQvZohauUFFN/EZt8E2MUSH7:e9Qp+MsuccZaE2MUA7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785723688, "uuid": "f13b552a-f084-4dbd-b07a-b4db25aec741", "value": 839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785723688, "uuid": "f8393025-bef5-4086-be2a-0584df770e28", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785723688, "uuid": "d303be1b-79ce-47ef-9703-10786a6b7fe8", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de6a78fe-8f26-11f1-bd95-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1785753252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785753252, "uuid": "02958eb3-4e14-4dac-879f-396627c99c27", "comment": "Malware payload (Prometei)", "value": "069a33c021076489828f0496e45141e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785753252, "uuid": "9b73cf42-4d3b-48ae-ae68-9a300ae47ece", "comment": "Malware payload (Prometei)", "value": "13f8c307777f1f7f2713409ee83fe09c5a4bf76fe1764a4df4ed313d50defd7d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785753252, "uuid": "68268014-6f9a-4190-a689-6bd3d683ac7f", "comment": "Malware payload (Prometei)", "value": "0ef43cbaacc4e3e4e93d4675db7a2eafc6b7b745", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785753252, "uuid": "d4654252-8c96-4049-ba5d-056b72518d9d", "comment": "Malware payload (Prometei)", "value": "5534a887a24f505f6d0b6c6ed34ab44735956e68eea165bdc5cf4da5844705afde075340ee46bcc2699e4d1e9fad954e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785753252, "uuid": "741d4a02-e9a3-4703-8157-fb06d873a334", "value": "T144A423B4F9219E9F6DD769B91B24831DE182C172589D4C2313AE94E34F3D732AF2C816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785753252, "uuid": "0d508e1e-5d39-4e86-b6fb-3a0e6d276beb", "value": "12288:Fs+/py5fM2l+M5F7TsJwtY1yvr+bT1psS+6T6NCj76tsd/:Fs6pyCC/Ya2hpi6T6N4F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785753252, "uuid": "4d23a868-30e0-4d15-a207-23a4bfc6b61c", "value": 449053, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785753252, "uuid": "85f8ff5b-61a9-4e43-8655-9be4e0b701b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785753252, "uuid": "f4c7c3ba-aadb-4d0e-b928-dbc2672c1e13", "value": "13f8c307777f1f7f2713409ee83fe09c5a4bf76fe1764a4df4ed313d50defd7d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dec3282-8f72-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785785786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785785786, "uuid": "3440286d-3f73-41c7-85eb-ee785b559eed", "comment": "Malware payload (Mirai)", "value": "2e115f5263e782c002ef9e525eec60d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785785786, "uuid": "79ec0946-9792-44db-8d18-7ea5c2aabd03", "comment": "Malware payload (Mirai)", "value": "14bcf34c1e8e2228d2be8cfaacace1cd3cfd7a480952d717b569d33833edbc4f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785785786, "uuid": "3b009175-0fab-4c3b-aef8-1c6b26fda8ce", "comment": "Malware payload (Mirai)", "value": "f584fa8e2f497c04f1a8cc00322bd942b79eb426", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785785786, "uuid": "e609687b-d977-4dfd-b7c3-b88fcf87790f", "comment": "Malware payload (Mirai)", "value": "22a460475dee4af33cbba8d22c231448934e04f1836c9e12a542c50a5c08afbdac983a6b194ccda9d9df854c22ccf643", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785785786, "uuid": "69a04f34-c7ac-419b-91da-8ce1e018a36f", "value": "T1DA3302F37E452176C02CE533179B5ACDD4294EC33358D884F364BE487CAE539AA606AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785785786, "uuid": "4e5a8900-5eed-4d97-80f0-129cf33f0ad7", "value": "1536:hTG9Oz5Nn9HbDFkbNDJGDOyPizsHs3HhdZK0UyMJpZ94a:hy9UT97DFkbZJGayPizhdZBMHTj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785785786, "uuid": "f34bd300-8b74-4cd1-b276-a12f2c014823", "value": 54216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785785786, "uuid": "16f9a2b5-1d03-4468-98cf-bb4e603e7a23", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785785786, "uuid": "4bddde63-6dde-40d2-804a-18074bdd440e", "value": "miron.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e443f911-8f87-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785794923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785794923, "uuid": "f65f2036-a737-4c2c-97f5-32a2c14d1249", "comment": "Malware payload (Mirai)", "value": "7e7c2c7e0aa1148aca28f8ded39724bc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785794923, "uuid": "dd541ab4-eb59-4745-8ce5-1b4b6e2f66be", "comment": "Malware payload (Mirai)", "value": "15531624bc94fe22d9197148447c48d907a75a2c2d2974cca953d4143e99ff62", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785794923, "uuid": "60aad1a1-189d-470c-a286-ffcda91de596", "comment": "Malware payload (Mirai)", "value": "cfd9d57abf5cbf9ff45947cc11f805a2277f70ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785794923, "uuid": "e159ef6a-dc77-41b0-ba58-6b35e7107acd", "comment": "Malware payload (Mirai)", "value": "5909e0cb756b2b9b8e2cd18931cd6263a5f81f867ba19313a56320368a4cd5f69a367ee75c87de79d164ed314d96117c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785794923, "uuid": "d5790d76-b919-484c-88fb-df0acc4b7861", "value": "T18EF33A95F941AF21C6C626BBFA0F424A33135BA8D3EA72139D241B6437CB95F0E37905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785794923, "uuid": "736708ca-d9ce-432e-a2c8-28e50f343cd2", "value": "3072:l7XBfnE3IhdfQ40d/lqiEC4laE9ixF07rl30++nRhXlHPIvT:txfEOI4uMBlaE9ixFurG+KRhVQvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785794923, "uuid": "b7b9274c-716d-459b-8100-62652d74d168", "value": 162072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785794923, "uuid": "b8478a75-a6cb-4852-9848-b864c3b73e91", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785794923, "uuid": "3c0ccda3-81ec-4aa3-b083-b3667da4b4cf", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9cad8e1-8f35-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785759741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785759741, "uuid": "88f0b378-03ca-4e21-96eb-97af7b067952", "comment": "Malware payload", "value": "bf3292a51135f6794eee53329aa0fc22", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785759741, "uuid": "315a76c3-239c-44b9-a5ad-bdc564d05439", "comment": "Malware payload", "value": "16c7850c01dbc8ee94348b30d4c6d02cd46139ff29bdf315d14f7b3904455d92", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785759741, "uuid": "c7584d57-c0ee-463f-b05d-90761fa3126e", "comment": "Malware payload", "value": "24c169cd6a4ec9bcbf4ebcddc3b3f89befa4c25c", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785759741, "uuid": "406c7a54-f1e3-4657-a3ee-37aaa8ab06dc", "comment": "Malware payload", "value": "1caec57b2b8fb44f5e754a27b40a075a265baa70bc8b43ebdf4a19857855fd42f85231510cf73944fc9e779da5688317", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785759741, "uuid": "f10a94a3-2957-4002-b371-7fe455e14142", "value": "T107266A17AD9948FAC099E731C8B74215BA70B80D5B3123E32E61BEB82F317D15E35B94", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785759741, "uuid": "31dede38-f95e-49ac-86cd-2b287541830e", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785759741, "uuid": "6b8d06ff-f914-4f26-aab4-0f7c4e692d42", "value": "49152:iBDwixhhiyPc5W+4pRNkKNxD/yIy6Zf5pAoJDYcs9C7NLjTeLLaWRpZGRcDIe9AU:i6EvqF6Zf3AH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785759741, "uuid": "f5271d60-de0b-4abc-b8ca-43e6d5acb5b1", "value": 4545392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785759741, "uuid": "7c1c20e8-949f-47e9-9a19-bfe43cdce58f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785759741, "uuid": "3ada1a67-daf4-4413-9008-7487cb546e0f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "976352c2-8ed6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785718773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785718773, "uuid": "24671436-24cb-4cd9-a934-bbb608868cc1", "comment": "Malware payload (Mirai)", "value": "7b9fe9dd8d2464d6c99ffa574bb162d0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785718773, "uuid": "98554613-6c19-4e6a-ab6e-e350eb04e563", "comment": "Malware payload (Mirai)", "value": "1722375fa81d3e17092350c51ee6d7068c556c1d137c6d47aa027a18f84f4817", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785718773, "uuid": "85d7405a-f533-4b1a-91f4-c6631b6fb3cc", "comment": "Malware payload (Mirai)", "value": "a29b808f1b0fdc46dd8c8f9a26e112a623a296e1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785718773, "uuid": "e95eaab9-fe03-4445-aec0-b9095ec9b908", "comment": "Malware payload (Mirai)", "value": "35da7e8353adcc32f146171a26a6439d48da7b53766981a0c03dd64df705d1ad0477c531267212bc4cd3db723e8c4896", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785718773, "uuid": "59ef13b8-fcd1-4335-93c3-03d02722ca75", "value": "T154730296630B7475C53179B2BC378066220CFBFA66E247772A13C768CA11586C7760EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785718773, "uuid": "7b10c098-bc34-4808-ac80-d8f80d3905e1", "value": "1536:T5dqNXmO6/QhEvlC5bPpsB7MJ69JVLjrAf4YfIcIA6:T5dqNM/QhCCtP2xMoRLj84p5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785718773, "uuid": "7893ff98-28e9-47d8-b7a3-dfd81202fd31", "value": 74904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785718773, "uuid": "afd50a4d-32b5-41f4-8f61-c70e139930fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785718773, "uuid": "6039184e-6051-479a-8c70-d6a78db10fce", "value": "nz.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d4f3637-8f16-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785746110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785746110, "uuid": "4bdab044-c1ee-4db1-a953-c4cadb71eb85", "comment": "Malware payload", "value": "8d2b5b9d0a4b27b97ba0465b21c1740c", "object_relation": "md5", "Tag": [ { "name": "424e51f31d68f573a4621aaede8044aa", "colour": "#51F4DD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785746110, "uuid": "b4462309-f3e2-41e8-bf5f-9eb94b3b2688", "comment": "Malware payload", "value": "17668a4df917779af09b2598df9671e1f6ccfb973e56c9bb548be16a9d8df5cc", "object_relation": "sha256", "Tag": [ { "name": "424e51f31d68f573a4621aaede8044aa", "colour": "#51F4DD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785746110, "uuid": "4268e61c-3134-485a-8d73-67cd0cd69c06", "comment": "Malware payload", "value": "b2892aa2da0e386cc992ef4ba07912a39f9ab27e", "object_relation": "sha1", "Tag": [ { "name": "424e51f31d68f573a4621aaede8044aa", "colour": "#51F4DD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785746110, "uuid": "ce08594e-d758-49ef-98f2-c4f711bf7fbe", "comment": "Malware payload", "value": "5243632d5ee21afb65e419d6ceae5c15f70427f4ef95234cd7e0b907403034d7c55a152c8a55f84ad6b25b24525b12b6", "object_relation": "sha3-384", "Tag": [ { "name": "424e51f31d68f573a4621aaede8044aa", "colour": "#51F4DD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785746110, "uuid": "9573c9b1-99a8-4ae4-8ea2-f90031b64e7e", "value": "T191D523A975F61A34C873C7B28F92F86EB02937558B714E5B378D7A108C236986C36371", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785746110, "uuid": "e9ba1d8c-44d4-43b0-9897-b98dcab1c2ad", "value": "44140cbbe125df54636c585913f74c75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785746110, "uuid": "85e95631-2d09-4456-9825-e2dd2d3a0eda", "value": "49152:qlN+KZKHPCOvuVLnVzlAtSBQbUurmafKXlEGNscXDb+aGs/mw+gC/ppyoHWIEE0N:qlN+KIHPCOveDVzb6bUurm3VEGNnH/mq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785746110, "uuid": "aab661ea-0ffc-4460-863c-bc9abe40da13", "value": 2943488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785746110, "uuid": "aa944817-eb03-4fcb-bc26-b59a7e39d9f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785746110, "uuid": "bc79b633-298b-47c1-ad29-206c14ae54a1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d894649-8edb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785720904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785720904, "uuid": "1e53e3ce-af1f-480d-ac17-3ae892d85cd3", "comment": "Malware payload (Mirai)", "value": "e8f4be867a5f1202acacd8fb8e96c554", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785720904, "uuid": "16e22762-6763-4667-b917-53d8a742883c", "comment": "Malware payload (Mirai)", "value": "17e95878a491590bfdc24a82270bc318e59fd426a850dc219c65b711e9425f25", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785720904, "uuid": "824412c9-1120-455c-8c41-ac89cc90d864", "comment": "Malware payload (Mirai)", "value": "63b895cd76c37f8d4be59ffed7e7cd6a37eb972d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785720904, "uuid": "af819b43-70ac-405d-857d-bfbf987688c0", "comment": "Malware payload (Mirai)", "value": "bf3a751aefba307d330861156d91b7012cd6351f019fe25863950a449b58e5fd421b3aeeead9ae58944c82df8b48fb64", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785720904, "uuid": "ce34f3c6-6742-49ad-aff0-a29958006299", "value": "T11D230237E038AD4FE25E0E187DE5F67A23F68B26939944ACB0C87F103747185A250CC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785720904, "uuid": "953f3ff7-2ae0-469d-b4c7-11cc6cbed7c8", "value": "768:45vgNzjXZDtZ1NSLrVaw8SpIQ/NHvDx2xf8hQycQy73LC2VlRcq1NcegTkEkKGx/:45ItXZBZ6rV78vwx2xfFyc17CMlhTsYD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785720904, "uuid": "4ee73bb2-fdea-4e69-9bd2-1c9989a564da", "value": 46904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785720904, "uuid": "f1b1a0b2-76af-48e4-804f-df94dc3df05d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785720904, "uuid": "6a7d35e8-5a8c-4eb3-84ad-0ea929aafdc9", "value": "nz.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d586dd6a-8f2d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785756244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756244, "uuid": "e12ef334-4083-439d-b7aa-75b54ceb7bef", "comment": "Malware payload", "value": "01c9c0eb42055a5234f2a26a3b371408", "object_relation": "md5", "Tag": [ { "name": "dn-pdflite-lat", "colour": "#BE5FA0", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756244, "uuid": "0fb50b08-7094-43c9-bd11-c1cb8c761ed5", "comment": "Malware payload", "value": "18f1fcc2b2d7cc82ff1147e40805e5bb72f964018816fa4de76c0832a193914e", "object_relation": "sha256", "Tag": [ { "name": "dn-pdflite-lat", "colour": "#BE5FA0", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756244, "uuid": "24d12b41-32ec-4ee9-bc5c-79aa935e2c70", "comment": "Malware payload", "value": "38ba674590461e6c251b83adf351126fbf3a16c0", "object_relation": "sha1", "Tag": [ { "name": "dn-pdflite-lat", "colour": "#BE5FA0", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756244, "uuid": "8e0dd508-ec3d-491d-a794-b15a50c532fe", "comment": "Malware payload", "value": "e19dc923669a7350994ca03615f69d4af4f49836d6e4864c9a0348ed8af63bccf4b69e8d5d99c063f992720ceb792c9f", "object_relation": "sha3-384", "Tag": [ { "name": "dn-pdflite-lat", "colour": "#BE5FA0", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756244, "uuid": "f1942829-ab4c-4b68-aeba-d006eb783dd1", "value": "T1C62353F37A8682C5FD3189BB1A6F60991090170263A6D1B9F3AFDC00AF98F5905783D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756244, "uuid": "ba602f3c-36ad-4b33-bf99-433597204bfb", "value": "48:5fsf3ZRwE1Xn0DTkTD+B4LFd6HeTXRHdQfzAiZqDN:5feRw0X0DTEE4x8+TBqfzhZqR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785756244, "uuid": "5d00f10b-2780-43c6-9cc3-acb11535ad05", "value": 47104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785756244, "uuid": "53f84a16-9c5d-4b38-84a8-836901e7982d", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756244, "uuid": "ec10b916-a8ff-4f87-ac01-7423d2dad49f", "value": "LEITURA TAROT-QND2VM.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df2408a4-8f10-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785743805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785743805, "uuid": "dc0eaaa3-3fb5-408d-876b-e5370d847303", "comment": "Malware payload", "value": "be63771a2257bae11a1f23ca865990bf", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785743805, "uuid": "a263c8f9-45ab-4168-90e8-a23e95ee6b7f", "comment": "Malware payload", "value": "192725e0c2fb97926aa6a926a0f2057b74dcb3e4cfd0a1f58fe0a0f199fb0403", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785743805, "uuid": "e90d4ce6-611d-4da0-99ae-0fd2fad07bd6", "comment": "Malware payload", "value": "2931a5c9e1ff81eb00d984af76cd21f38a70c4de", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785743805, "uuid": "7d023791-1e06-4f99-b16f-a0fe77ae0555", "comment": "Malware payload", "value": "763fb1c2a9a5418131c37edf3a12ecaf8f9e58e0a97e1b3282286191fee26a0a95885112930e14ca8cbfddca62344207", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785743805, "uuid": "44832c15-e79c-4638-b858-b6d96a2355c7", "value": "T1CE87332D619D9C9DCF2B38B3F28B7A544769BD03EBC1B49E587A057A770F4B83A40142", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785743805, "uuid": "2bd4d5ad-e2a1-4417-8a69-ee0110d637ed", "value": "2876c35218120d08c062a39fea3a5bb4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785743805, "uuid": "bfe9cf8d-6c9c-49b0-8b7d-4e047c7df480", "value": "786432:JYvA1FboQMMeqRIAokqE2MtdRpe31z9z8E38W4DOzOUZ20/O/8AT51Un:BoQfeqRIAT2y7e3R94E3LVf2ju", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785743805, "uuid": "2a9b2619-8bf7-443d-9ccb-bc8d7669d46d", "value": 37064480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785743805, "uuid": "67d94b4b-2c44-4704-a507-699096c00928", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785743805, "uuid": "daede662-8bdf-4b73-ac28-ff3976a2ec5a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e28823b5-8f57-11f1-bd95-42010a9c0009", "comment": "Malware payload (NanoCore)", "timestamp": 1785774305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785774305, "uuid": "2444e34c-ae5f-4cde-8b14-83bc055f3de1", "comment": "Malware payload (NanoCore)", "value": "1081ff69cba7a5a64aa40480dc5f693c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785774305, "uuid": "5a4e3482-6f69-424b-b707-ef395b57b05b", "comment": "Malware payload (NanoCore)", "value": "1c6a49c2c071e8182a8727ccc5622e59c66bc6f3629a87f0cbb76a64f2323d8e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785774305, "uuid": "dd5ef8d1-8ef7-4402-be54-6629f34e62b7", "comment": "Malware payload (NanoCore)", "value": "d9eb77c0e2a658f9ea31ffe63bd22560badd01ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785774305, "uuid": "62dec3c5-ec67-4c8a-a203-e35eff11ad2f", "comment": "Malware payload (NanoCore)", "value": "5f015d18539713ceaadfdbd253475cf5bbdc811a77e00441087a6c68db0aa629d65a323a942c5769fc2c4852f7543e3a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785774305, "uuid": "a2bd2be9-bea7-4e88-940c-1e179cf3abbe", "value": "T10314CF163BA84A2FD2DF86B9711212178379C2E798C3F3DE28D451B39B667E50A071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785774305, "uuid": "cecd2ef2-c15e-4dd3-85ef-077f2a0de476", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785774305, "uuid": "43fbb2f2-9557-4014-90ca-0e8f4d289388", "value": "3072:MzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIHgXzMrrC/Y6jmdzBb6KaGaOCu:MLV6Bta6dtJmakIM5RkC/nqzp6jGaOx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785774305, "uuid": "689ff834-c725-412c-b980-156922fb9155", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785774305, "uuid": "53f1cbc7-6328-44a3-a72c-88cd460dfd95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785774305, "uuid": "9eaa54bb-0e42-440a-ae90-67d66d4831fe", "value": "1081ff69cba7a5a64aa40480dc5f693c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9b7b5fb-8f5d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785776894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785776894, "uuid": "6ad75d1b-fd91-4e62-a2a5-e6cd2f73580c", "comment": "Malware payload (Mirai)", "value": "2147ee7ac47d2b00d6ac9265e21dc8eb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785776894, "uuid": "b4702f69-571e-45a0-aab0-4e7b65bbe27a", "comment": "Malware payload (Mirai)", "value": "1d777ad3b6b3c296b9322e4e8e6fd0c9954b94f628f25c4cf361a118976f4784", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785776894, "uuid": "b81cca49-333b-4672-934e-0b959b494e2d", "comment": "Malware payload (Mirai)", "value": "cbfd3c322a8ebdfef112a38c1ce199c802cca1c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785776894, "uuid": "7a855ca5-77f1-48d6-a8cd-fe9b392c3fae", "comment": "Malware payload (Mirai)", "value": "d01a7bb3786142877befab81523004c07498e08d3ee053bfba368ffc8f5d30e5dac4279187f663361836fef39543648f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785776894, "uuid": "f0878374-6064-4432-8e68-873f3aa3422d", "value": "T1B233024290F6CB00C2ED733158EDF65962A86E0E242548F09FE8E81D77576763D1E7E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785776894, "uuid": "a7566f3a-9fb0-4fa4-990d-67a107c9d8f1", "value": "1536:i6/kzrBe/UP2RuGMal5RaFBeeTmNAdvDNnouy8oyk:i6/kxfPkn3l5RaFBecr1outG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785776894, "uuid": "e22dbb8f-cb4b-4784-b286-926e6d5fafe5", "value": 50952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785776894, "uuid": "649fe769-9afe-483e-9836-45bfdfedb79d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785776894, "uuid": "9cc74c9c-1da8-4486-8bb2-976f73805442", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc1c86a1-8ed4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785718083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785718083, "uuid": "3fc44584-1eb5-4e05-8d2a-a64eaa0aadd2", "comment": "Malware payload (Mirai)", "value": "de7d971ad4d0c117e755fa2a7dfe8f17", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785718083, "uuid": "e8c8572b-16c6-4c45-95ce-3af591fceceb", "comment": "Malware payload (Mirai)", "value": "1d87d05a3772a774667df44d1ebdec9a31eb460d8e6fb4ea4ed4ab9314dcaa78", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785718083, "uuid": "ed254756-395c-471e-a20f-961f81605c1c", "comment": "Malware payload (Mirai)", "value": "c1bf0e08626e4b6b17fe464e3228913370245e7f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785718083, "uuid": "27f8ecb4-e035-45d7-91ad-7e00385a3fa8", "comment": "Malware payload (Mirai)", "value": "5793cf5a6cd264b250042f4b91e0242d144b1fc7b1e07a53bf4b14a73b1a763e4498a9638a23d9579baa216df4cecfce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785718083, "uuid": "2ba83ccb-48b0-4c77-aa26-86508bb70a41", "value": "T16BC33BDAB401DD7DF94FD6BB48632D1AB921A35252831726239BFD93AC321E47C02F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785718083, "uuid": "bcea0c43-abbc-4fbe-a865-4d2956ccd37c", "value": "3072:GQKrXvsHp3Zldglu0jIhdkPud51qOijI2lF1sh9:vKjvsJ3ZldglCmWdvqe2lF1sh9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785718083, "uuid": "73cdd7e2-6ef1-4042-87f0-b96afe8d93b9", "value": 125908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785718083, "uuid": "a2bc52f7-73e8-4b83-b684-10e49416b1e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785718083, "uuid": "12f04066-9270-43d0-b676-f029abe922a9", "value": "nz.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1e25d7c-8f08-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1785740266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785740266, "uuid": "729683b2-1bfe-45cf-9521-06731f7fe941", "comment": "Malware payload (ConnectWise)", "value": "ec2fe6b52afd09ff96c17acaa1281dbc", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785740266, "uuid": "a29e70e6-d27f-49f5-84fb-7dae30cb8a8a", "comment": "Malware payload (ConnectWise)", "value": "1dcdc10d6ef85d117c06f5cccd2d29e4b2bfade68ad025c21c9cc5746e175c56", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785740266, "uuid": "86bc454e-bdd3-435d-ac69-f4f80142a635", "comment": "Malware payload (ConnectWise)", "value": "b7d28bf01db567dd09c4b3ce41122687e34a9d11", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785740266, "uuid": "804e9b99-2169-4342-942c-d58017c84d84", "comment": "Malware payload (ConnectWise)", "value": "dc6fa9586fe85e3bc3b09cd8de599d0461facb3a52aaf2b44af531d0dc15e28851806e43cdb58600941dd9f2e1e2f5e1", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785740266, "uuid": "b5d96a3e-1b65-418f-ab8f-07e0eb63529f", "value": "T15B46E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785740266, "uuid": "e7c900b5-4860-419e-811b-b6831b033464", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785740266, "uuid": "d7b5f5fc-9147-444d-9d13-52c09e7ee819", "value": "98304:9zIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:9hfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785740266, "uuid": "4390074a-f5a2-4b0e-afe5-c0d041dcc5e4", "value": 5642256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785740266, "uuid": "68ebe8b6-678b-4744-8aa0-a27538621592", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785740266, "uuid": "673dea7a-2d90-41f4-a863-0b55ef11272d", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d4eca95-8eea-11f1-bd95-42010a9c0009", "comment": "Malware payload (Joker)", "timestamp": 1785727346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785727346, "uuid": "0810c204-f664-46ca-8210-926cab139029", "comment": "Malware payload (Joker)", "value": "712615e029f0179c8703c93f07517bbb", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785727346, "uuid": "2ed13798-59f0-4b8b-aff8-02f1a0fc5ba4", "comment": "Malware payload (Joker)", "value": "1f14be1a82024cbaf1e203547a8a0ffdd2598c407d4fca59b5d4f9b3379e7780", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785727346, "uuid": "d8b4f4c9-e96a-4dd0-ae52-f84f41736047", "comment": "Malware payload (Joker)", "value": "41700ba0a8351610b68cad00ea365dc655bb1748", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785727346, "uuid": "1ec4db52-77c3-4d18-9155-3eabecb07058", "comment": "Malware payload (Joker)", "value": "a64771a7d531393e80d5402acb37ca368ede38a1e3643c9c2ce739b26b2d58bf0e843b9a401d9f60874d681870c61e52", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785727346, "uuid": "960f4be8-76ab-43e2-a786-64e53e6ab225", "value": "T1F697D146E50CC936D8DEB178BE7E0A9173245A2C85E68856F81C6124FFDB1F019B3BD2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785727346, "uuid": "f8205a77-be36-4dc0-8965-6177296aebbe", "value": "393216:EdGtw2btbxjlCFDqMbmGR1RhWdl9t7ZAnbesZRgl27C7mcyu:EUwEjlCLfKTjZAnKkut", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785727346, "uuid": "851fb528-f0b4-4bc5-9590-821bbdd9a444", "value": 40695975, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785727346, "uuid": "d7c5be51-c5a9-4d17-b465-1fb6aa7b8026", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785727346, "uuid": "bb78244c-6df3-4bfa-89ff-9c326f5335a4", "value": "com.techgiant.imagetopdf.converter_1.6.2.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "912ef29a-8f2d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1785756129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756129, "uuid": "de37b795-78d9-4cb6-b196-092e0f4f67e2", "comment": "Malware payload (Formbook)", "value": "7ad4e09741ed2bee5735319598f78945", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756129, "uuid": "f0d0b0d0-758b-4486-a8f8-89354f176ad5", "comment": "Malware payload (Formbook)", "value": "20cdcfc958897b318418dce7c7f6308e3481731f09fac0772d0fd27d4e66e528", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756129, "uuid": "2116f6d8-e508-467f-ad2b-4f9155f94643", "comment": "Malware payload (Formbook)", "value": "9a3b226cfa0779946211730a3b2099c0e02bb332", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756129, "uuid": "28dad466-8a1e-4c53-80dd-49f8615a9e53", "comment": "Malware payload (Formbook)", "value": "1ad8145a9d469347034c6f96dbf1a364e0c7948a83311bb11fe8028a3fefda46cb5d86acb61ea6f9a615278d535fde1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756129, "uuid": "70014cc6-4d59-4212-8d5a-3696305f3f10", "value": "T13B05F04077BB2F56D27D93F1D652682063B6652F6124E70B0FE220E63E66BC489D0F93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756129, "uuid": "76ff4f55-edf0-483a-9ffc-514ac2271c91", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756129, "uuid": "ee479fc7-53c0-4028-988d-08a998f43a50", "value": "12288:+sFXqBNPEKt10ka9f4/cMCayYP6GNZsQtgzpqjdvs+thwKObjslZuYy1Rl+H1I:+sCNOk+bMCayAldUMjdHhwLbjiuDf+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785756129, "uuid": "52ec5769-de9a-477c-bae7-a2aa87f1253b", "value": 854528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785756129, "uuid": "43c479c2-44f5-4282-a76f-737170bd48b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756129, "uuid": "3b679f0e-eaff-4023-9f1d-743ce5c3fb98", "value": "DHL_AWB#6078538091.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0a8a791-8f3e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785763510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785763510, "uuid": "6b994ea9-8ed9-4a94-a5be-803e8711c616", "comment": "Malware payload (Mirai)", "value": "d9dc2fbe1322f6f249f75de128f31ee4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785763510, "uuid": "e5d0cf89-6356-458c-a387-f39388242a2a", "comment": "Malware payload (Mirai)", "value": "210c550d32a55fd9e7167eb60e940795e7172500bcb27721e689669e98ef6f85", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785763510, "uuid": "8b2863bb-b2f5-40a9-b51e-eba739080db6", "comment": "Malware payload (Mirai)", "value": "db3153cdeec9154f3adc97642a5e393de611eb8a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785763510, "uuid": "fe428633-f491-46ed-8c62-bd9b0a86e810", "comment": "Malware payload (Mirai)", "value": "693c9c36c4759117135e545748b4340f4f542fa417be3ec3c7fb56691818fecdb7cfc8c9809fd4dc7df418ef549dc36f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785763510, "uuid": "19e4c8e3-60f8-482e-8606-4f3dbec0d5c6", "value": "T11C042AA4B8819A31CBC05577EE0F0388331D57E8F1DA7343DA681FB53A8743E4D56A96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785763510, "uuid": "699bbba4-1ff8-480d-8a6b-b243b233e00c", "value": "3072:XEFIE8gRwV2AtDLqaVFKZl3Cq5uElvdI959M7fzWvjPYVnQa:XEFIEx1OGaVFKZl3CTElYrM76v3a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785763510, "uuid": "62e5444c-099e-4c13-a3ed-80dde9d94359", "value": 177844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785763510, "uuid": "5a845bbd-0ec8-4f09-9121-4aa71768b3b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785763510, "uuid": "a3e7afb2-b4c7-412e-84fc-b804b3cfe982", "value": "tarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d589cc6f-8f2d-11f1-bd95-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1785756244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756244, "uuid": "d5343f66-1458-430d-991f-709dc68e3a0c", "comment": "Malware payload (XWorm)", "value": "49c2d57edbf05b4e22045362bb65ee63", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756244, "uuid": "c5c1f776-144d-471d-a650-69272f4922b4", "comment": "Malware payload (XWorm)", "value": "21871794d9b51b04698daa0385a36d0092ba26aabd0da5e3106c5fa102adb703", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756244, "uuid": "bbba6c8e-0b94-4e47-b0b9-db8187b4cdb2", "comment": "Malware payload (XWorm)", "value": "62c2f36ea9a1ccecd212a7c72b8ab5f459b27b84", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756244, "uuid": "42d65f47-3d4e-4b0a-953d-c2be2e48430e", "comment": "Malware payload (XWorm)", "value": "97e126f2daf7ac060703fa37e14a8db38bcdf12b4331b32841ea14607f35d6d45e26059b514770fdd154b75f3948f672", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756244, "uuid": "a3dbd70d-d4dd-4226-9b5a-ed30deef9c08", "value": "T114050DF30BDDAC83EC69A379DE03860F99AC503FD6524A85E8F947E648A0C5C5750DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756244, "uuid": "990e55af-ebad-4e1a-9151-c507ee5e2e70", "value": "192:is3XKtBw9Csgxk1REeg5ba/sG5tpSs2lsnJCsMR9s5sMpErhsLgsCVkXJ2svytsx:R9IKSV7+pOk9si4qOSf1YBL/4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785756244, "uuid": "54f0067a-ebdc-4a68-ae26-0eb6ce4a4ab8", "value": 795430, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785756244, "uuid": "71d8fc76-aa6f-4115-8157-1f52f95a557f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756244, "uuid": "db2fd1bb-37ef-46df-b983-2dd506a58a96", "value": "Order-Specifications.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ce2334f-8f11-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785744016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785744016, "uuid": "3496f236-cc20-416b-a9d6-0cda381914b6", "comment": "Malware payload (Mirai)", "value": "c674b93ee9e8cb3d5f7bbe4550680632", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785744016, "uuid": "ac862305-d9e1-4635-bdca-36f0df7d5e3e", "comment": "Malware payload (Mirai)", "value": "2279e2d6c16091785e5ddf12e446f096ff8e78b64ddee0b4ebbebd6a322b76e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785744016, "uuid": "adf79e48-329b-4936-a0eb-9f3fb1321cf9", "comment": "Malware payload (Mirai)", "value": "65e9499bb8e3d7fdb7d6c89f9ebf341d1fc03208", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785744016, "uuid": "d5716816-4624-4fd3-bde6-a661969fcee9", "comment": "Malware payload (Mirai)", "value": "4390ee59036a20374273cf745a5ca63cd84616f3466e19c188643424b307befd6501887bb3fafc59d5fad6723674ea77", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785744016, "uuid": "7360ed89-f5ec-4d4b-a117-ad81a054b7a7", "value": "T1B8042A85FD815B53C6D216B7FB6E4288772707B8E3EE3102AE255F30379A45B0E3A641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785744016, "uuid": "298b58b4-84e2-4a9b-b7c9-57aa4d73c8e5", "value": "3072:ed01c00zkHEbLcNsEDuYwSKLBM4g93dhPlPQThPxc40T:edy0zyzVx3KLq4K3dhPdihPxcR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785744016, "uuid": "cea87936-d152-455d-90ba-e2cd3ec9608c", "value": 177536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785744016, "uuid": "bcd91e89-a0dd-4c42-bab7-039eaef94369", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785744016, "uuid": "b8854afb-5d3c-4eb0-b8c0-56f6d3aba21f", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8893b483-8eeb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Joker)", "timestamp": 1785727768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785727768, "uuid": "04db897b-9105-4e69-9616-2c94199acaa7", "comment": "Malware payload (Joker)", "value": "320f5589d9891941101c48e7d31580bf", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785727768, "uuid": "028d804d-4e6e-4cfb-9791-bf57f0548c0c", "comment": "Malware payload (Joker)", "value": "2428e3bc10482c8fcb0362b8d95dadeb0231b258e2606b7bd6adcc7e5664578d", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785727768, "uuid": "8115318a-40f6-4cdd-9369-e106fd2b9de8", "comment": "Malware payload (Joker)", "value": "91186e06fcc0ced484f2a4861bd8ebaf4ddf912d", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785727768, "uuid": "ff560247-8461-49a0-b70c-8e881fbd5bf2", "comment": "Malware payload (Joker)", "value": "3101c54ce09786d68745f3ac768e3a29311c593c29aa8c860b5c7d88c17e6824deb032d3bcc816f212aa60b6c3b4fa94", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785727768, "uuid": "f8935644-41f3-4793-8522-c8887cf692a6", "value": "T10EA6239AE70CE02FC477643689BE0330915754478E83BB93B914961C6EAB6C89F5EFC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785727768, "uuid": "321e2bcc-e400-400c-91ca-9bd1b27fd156", "value": "196608:nSDhk+TyYZgHMTLOksv0veRgn295f/lZQZVMG:nSDytYLHOkshRgOf/4VMG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785727768, "uuid": "23f6e86e-a418-411b-b486-9e994b47d1e4", "value": 10224563, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785727768, "uuid": "b0e3cc4c-8093-4c12-8069-353629f89dba", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785727768, "uuid": "c8a4e8db-0ddb-4a69-ac4b-a659dfd6c708", "value": "File+Cleaner+Master_1.0.6.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd6ecf7d-8f2d-11f1-bd95-42010a9c0009", "comment": "Malware payload (MassLogger)", "timestamp": 1785756257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756257, "uuid": "440c8143-98d6-459a-8aa4-6cbdf709e8e4", "comment": "Malware payload (MassLogger)", "value": "173013c03002a22e31282a80a2599c1b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756257, "uuid": "b520a52d-3b30-477c-86ca-fb593bc28a13", "comment": "Malware payload (MassLogger)", "value": "24cca04c7687562c0c27339a3b930cdb43eba408cad346033ee3bf116f7516ec", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756257, "uuid": "6fbb52a7-3816-48a6-bd17-513851baa869", "comment": "Malware payload (MassLogger)", "value": "2ffa7ebaadf726484e4b3a339717c11f5cb6b359", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756257, "uuid": "27967eeb-909e-4d22-9ec5-2d4631ee8087", "comment": "Malware payload (MassLogger)", "value": "882a69cc4118c2643d5573986c8b8195b40ab0b7d73e37173c432147415031da301373f28a5a710ed5d605ed3eeb9a78", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756257, "uuid": "c120ddfa-ba2a-495b-bc3b-ddf14d7aa5ad", "value": "T17536C17CCC58827AC2B3C62DCECB8A13F896195A360DF94AB1D2735B5523153F8E216D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756257, "uuid": "cd0ddabd-173e-418e-8b40-3981ebe3063b", "value": "3072:C06ibyM2jTTUYIMZPeIR8NcK4HnIGQpwG2Br4XukF6YY4Sw6i9mBEt/zsI5g0aqq:6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785756257, "uuid": "d1efe73a-112f-45e7-844a-0117803bcc80", "value": 5329244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785756257, "uuid": "46f3205a-13ba-4d05-b46e-4226d75777f5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756257, "uuid": "c3973ced-27fb-44a2-aefa-846fb0ed59e9", "value": "Balenciaga_PO_2026-01.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05424166-8f85-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785793690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785793690, "uuid": "887aff78-5dbc-49ba-9958-aabebfee0a7f", "comment": "Malware payload", "value": "5ee0870deef10092a5aa6b795bcac5fb", "object_relation": "md5", "Tag": [ { "name": "complex", "colour": "#2377D9", "exportable": true, "hide_tag": false }, { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "IRAHook", "colour": "#155CA5", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "keylogger", "colour": "#66C828", "exportable": true, "hide_tag": false }, { "name": "minecraft", "colour": "#820CFC", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785793690, "uuid": "1ea25753-58b6-4d81-ae03-5edd378db069", "comment": "Malware payload", "value": "24dbd4c441f3fd7184f77f46e5912d2be474112e0b44966fbd1ecb068c0c81b9", "object_relation": "sha256", "Tag": [ { "name": "complex", "colour": "#2377D9", "exportable": true, "hide_tag": false }, { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "IRAHook", "colour": "#155CA5", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "keylogger", "colour": "#66C828", "exportable": true, "hide_tag": false }, { "name": "minecraft", "colour": "#820CFC", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785793690, "uuid": "5ab548a1-4e1b-49c8-9712-a0780f2f64e3", "comment": "Malware payload", "value": "1a579d2fd70e757750a26bcc3c246c5a1bcee63b", "object_relation": "sha1", "Tag": [ { "name": "complex", "colour": "#2377D9", "exportable": true, "hide_tag": false }, { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "IRAHook", "colour": "#155CA5", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "keylogger", "colour": "#66C828", "exportable": true, "hide_tag": false }, { "name": "minecraft", "colour": "#820CFC", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785793690, "uuid": "ffed716e-2ddd-4d7c-b91a-0d097c4437df", "comment": "Malware payload", "value": "f502c0100efbd01e38bb0a3f4d530a60b0f1b6d2ffb9041c33909c99826c65067417e7a9a6547941171f804332bc4af4", "object_relation": "sha3-384", "Tag": [ { "name": "complex", "colour": "#2377D9", "exportable": true, "hide_tag": false }, { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "IRAHook", "colour": "#155CA5", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "keylogger", "colour": "#66C828", "exportable": true, "hide_tag": false }, { "name": "minecraft", "colour": "#820CFC", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785793690, "uuid": "31c0ef5d-141b-4d6f-b5f2-00e730ac723e", "value": "T101472327BDEBC928D96750B252C281F3612B1AD9EC0BD02F66A04D865D31E4B4353FED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785793690, "uuid": "c79a3d6d-1bdb-4f88-9787-d68ef8d53189", "value": "786432:nM9lF6p63m/QeRINTl77bhorJajD0SZsr9O7Gw/:nM9mp63JyINTxb3D0SMeh/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785793690, "uuid": "ccb339c2-a105-42c1-9551-f4c95c3d1741", "value": 26975408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785793690, "uuid": "ec6b9e58-8e51-4417-a15a-6e89d4d0c20d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785793690, "uuid": "9d07805b-1f78-42b7-8cb4-44cb9671b667", "value": "modules.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5ce1712-8f46-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785766928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785766928, "uuid": "8778b71b-080b-49f2-b4b0-c9fcfa033056", "comment": "Malware payload (Mirai)", "value": "296cbab26e45da849779de920fa8a558", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785766928, "uuid": "30d279e2-82b6-42ac-a875-d4519bae5fd6", "comment": "Malware payload (Mirai)", "value": "25cfe793849502ed25a794219dfcdd00566c13a96114694ae5137e494ffe16eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785766928, "uuid": "e4c2d9a5-89ed-4e0f-85c4-de8232b61492", "comment": "Malware payload (Mirai)", "value": "83633b38a18a2b6e8c33d9496e5063bfb50364c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785766928, "uuid": "fb1b99d8-0561-42bc-9351-1a32e198fd27", "comment": "Malware payload (Mirai)", "value": "64f8f7ff8d349cc40ac68f0f6f1db6f1aabd4813be4a861904b77d764af31422c7e3e2de1914c745068b2fe1f754fbe0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785766928, "uuid": "576934ba-65d8-435e-9e52-a9087d5628db", "value": "T1D204F747BC825A25C9C3527BFE0F0359B71357F8D3EE72628B181B70268756B0E67426", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785766928, "uuid": "8b30e087-6fdc-4a3e-a90f-018a7204abff", "value": "3072:F8b4Y9W13dYKU38cWaXxJoC33qkaPePkWjTQzlUGhfuZYVnQH:Fi4F1k38cWaXxl36kaGPkRzlnoZH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785766928, "uuid": "360f653a-daef-46d4-8060-90c382d5423d", "value": 189540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785766928, "uuid": "51a45160-f768-43f6-baa0-3942de3f2835", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785766928, "uuid": "0825c875-9857-4c35-b3d2-3ac6ea787cce", "value": "tarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf9e612c-8f2d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785756207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756207, "uuid": "9c791107-05d7-4b3f-a4ff-d2e551658c1e", "comment": "Malware payload", "value": "531c1bfec5a168eb0c38ad8f64af7a3a", "object_relation": "md5", "Tag": [ { "name": "dn-pdflite-lat", "colour": "#BE5FA0", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756207, "uuid": "196fc924-e2fe-4732-b3a4-e7adbf91d0f8", "comment": "Malware payload", "value": "261144f579fa466a48d4e9a01e9d62b8b72d367ddcd2ba4f4ae885d2759b9dea", "object_relation": "sha256", "Tag": [ { "name": "dn-pdflite-lat", "colour": "#BE5FA0", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756207, "uuid": "533f87fa-e614-4ef8-b65f-50e2c18d4d14", "comment": "Malware payload", "value": "96e3c0527ca1a56acaec9a6933c9d20f95b8c620", "object_relation": "sha1", "Tag": [ { "name": "dn-pdflite-lat", "colour": "#BE5FA0", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756207, "uuid": "72198add-868a-44ff-821b-4b4216c33a81", "comment": "Malware payload", "value": "ed0198cda7e34a7fa4989ca9a56285a2e0399b228e8ff60b79fc7340382684b3d34b9e6722c0baae67e738852cda7d6b", "object_relation": "sha3-384", "Tag": [ { "name": "dn-pdflite-lat", "colour": "#BE5FA0", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756207, "uuid": "f19d2737-f33d-4fb7-a5a0-b7fc978f18ee", "value": "T1E723A7F3BA0A06C5FC7149BB4B2F609904C426035396D1B9F2AEED04AF89E5945783E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756207, "uuid": "631fe0fb-b7b5-4bf7-bdaa-37b39b90d0ce", "value": "48:5Rkka0jf3ZRwXkS8Z+ATNNjCzWS03TSaHxHY0LzbqlovL+j9VDN:5RfPRw2Z+4Pe8TSExHx/bqlovChVR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785756207, "uuid": "c75d92ad-ed78-474c-9ba1-0d293fcaceee", "value": 47104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785756207, "uuid": "f8629a82-ffd9-4d4d-b6e0-3fd97a6f9d95", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756207, "uuid": "c2b35b7e-ebf6-43e4-ada3-6429deea88e6", "value": "Nota Fiscal Correio-FCS3TY.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3e75716-8f63-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785779353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785779353, "uuid": "6597ba68-c3e1-49ed-8da6-e22ba7622fa0", "comment": "Malware payload (Mirai)", "value": "2fbf80db2e883420104956cc3dacf908", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785779353, "uuid": "da847c37-8c7f-4386-82a4-96e69a3d2a42", "comment": "Malware payload (Mirai)", "value": "27246bc5ea0ee6ffa98f52ee144b71565137ae7ed3a51d115b710f2cd65dad85", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785779353, "uuid": "5c29ad1f-cfbc-430e-ada7-733476e569c1", "comment": "Malware payload (Mirai)", "value": "c1161a7dd4c779b25b87711cfa17a84da52b0332", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785779353, "uuid": "5891926b-79f2-4ef0-9949-6508227adb68", "comment": "Malware payload (Mirai)", "value": "0ce0f55294fa6c62b1ae802de69754e42bba15bc15942fc677c28e4c29fc595d0432166806300548e11c78108a5bd32a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785779353, "uuid": "83f0af94-ecd9-48c9-ac9b-a63d2e88b773", "value": "T1BBC3E60ABF210FFBD85FCD3B06A91B0125CC555722E9BB3A7574C928F64A21B09D3DA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785779353, "uuid": "4a003284-0a32-4e23-9856-8cfadd8a34c1", "value": "1536:iAy/d3WuD3M6d7W0pBSgltn/bs/aGzhFFskqUUyZtjzzJuVi7+vdrpIG4M:iAy/d3WuD80Xn22UUy0GMIGd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785779353, "uuid": "d16cbd68-88fb-4177-8d14-8f7cd82d69c5", "value": 123332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785779353, "uuid": "f7056ea4-3850-4eeb-8d6f-e8bf22ca4d4f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785779353, "uuid": "658a8494-4f3c-4c81-9e95-29c216f04f67", "value": "lkxstress.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55d0beb0-8f49-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785768056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785768056, "uuid": "01191766-4523-453d-b92e-2e722bbca6f6", "comment": "Malware payload", "value": "af22e6e224031f90c8e295df4992d376", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "lurlsource-chakaska-com-br", "colour": "#F547FF", "exportable": true, "hide_tag": false }, { "name": "remoto-ddins-click", "colour": "#E4CFF6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785768056, "uuid": "8994b387-5a06-41c9-842a-ff9013cc65e5", "comment": "Malware payload", "value": "284cdb6ed51b1fe3a17a1f62b4f36ce83f28935f3fced506a8c0e6fc3a2cebc8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "lurlsource-chakaska-com-br", "colour": "#F547FF", "exportable": true, "hide_tag": false }, { "name": "remoto-ddins-click", "colour": "#E4CFF6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785768056, "uuid": "3095e449-9d71-4230-95aa-04e8d4efb630", "comment": "Malware payload", "value": "aa48d19d085366b44cff797d87fab1ded4ee6c41", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "lurlsource-chakaska-com-br", "colour": "#F547FF", "exportable": true, "hide_tag": false }, { "name": "remoto-ddins-click", "colour": "#E4CFF6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785768056, "uuid": "05365901-72eb-4fc5-b5e8-ae71cedfa3d0", "comment": "Malware payload", "value": "07777ed675065132b01d2be00432d6f907bf3b6d138a3ac44adb73dd0d18d88ff7dc34c57920d1ab1db4ae6e6ffb76de", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "lurlsource-chakaska-com-br", "colour": "#F547FF", "exportable": true, "hide_tag": false }, { "name": "remoto-ddins-click", "colour": "#E4CFF6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785768056, "uuid": "e301a97f-9f7b-48f9-ab7e-7e82a04807d1", "value": "T155754B13B389F93EE0AB0E364967D444983BFB716906CC47A7E4090CCE3D5546E3AAD6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785768056, "uuid": "fcbc0131-7ba9-4744-b9d9-dc182cdaa747", "value": "1f365d4e2c37b47fb208b089b5f61d49", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785768056, "uuid": "82d6e224-4448-4208-b290-f9a9412561a9", "value": "12288:WM7LY2SaNXjP2/x2w/6roBJfQkxDpog+fbfUpTjUbDJ1sGlQpLp:h7zJjP252w/6rutl+fbfUpTQ2GlQ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785768056, "uuid": "ae99757a-efde-46de-a383-01cd3471f712", "value": 1697792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785768056, "uuid": "e60962ea-ab2d-4401-937d-c4249b15c507", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785768056, "uuid": "10714d9d-ea6a-4dfe-9a11-893e6f27242f", "value": "284cdb6ed51b1fe3a17a1f62b4f36ce83f28935f3fced506a8c0e6fc3a2cebc8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1220f3a-8f10-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785743727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785743727, "uuid": "d48d5e08-87e5-4f27-b37e-6149de908784", "comment": "Malware payload", "value": "3cf0b2d2f34acc712b3084f08f763883", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785743727, "uuid": "fb8636ce-ab8b-46d9-96c6-f55147347473", "comment": "Malware payload", "value": "2903d10543e021d3a00d8fd13f276fb2f6bceda6e4fdbe5db82d995c4c509494", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785743727, "uuid": "f5fd61c5-7f07-40fe-aeeb-aa15389a5b21", "comment": "Malware payload", "value": "7e3f820f1d375ecf2a831dbd2dc306eafbfa8cf1", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785743727, "uuid": "ee29af4c-89f9-436a-a13c-532a98a54547", "comment": "Malware payload", "value": "fc3ddbdba8f807fd0ea2c9e1e831708b900840f684f9e1a2114dcb77e8c9c1fa64d165f809f1ddff862e710cc4a337f1", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785743727, "uuid": "6cd6aa7a-6c12-4a68-8ff9-cc146a3c0503", "value": "T11941C910A7D54749D2F90E33787CC244207AB4206E82D39D42C0E4CAA0E3210E33AB13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785743727, "uuid": "c7ac9776-745a-43b2-a2b9-b0be22a1ffc1", "value": "12:8Oe9uPYCaAGMlDmIfcITMkyG1lDmIfcIK0pH5aVzGiIZ2387P:8eaAF4I0w9yk4I0d2IVpIZ2387", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785743727, "uuid": "0403b5e8-3fc0-4a7f-9d74-461522cf3b10", "value": 1931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785743727, "uuid": "ae49acc4-9bae-4906-9a59-58becb33d4e1", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785743727, "uuid": "2711d15b-052d-4a27-a3f7-c433aaa7ad25", "value": "videoa_622468161049.mp4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa779404-8f40-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1785764466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785764466, "uuid": "0e345965-e993-4917-ad01-6d47207676f9", "comment": "Malware payload (CoinMiner)", "value": "8c548fc736fb23bcae42baf73f0f7c2a", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "Kinsing", "colour": "#D800AB", "exportable": true, "hide_tag": false }, { "name": "masscan", "colour": "#55E938", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "shell", "colour": "#705F77", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785764466, "uuid": "6ae48571-d2f4-4a7a-a69a-3e1b6d039305", "comment": "Malware payload (CoinMiner)", "value": "292ac9eec4431164f96e0b58f37065ceb4785745c6339bf2bfa0ae722cef3a0d", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "Kinsing", "colour": "#D800AB", "exportable": true, "hide_tag": false }, { "name": "masscan", "colour": "#55E938", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "shell", "colour": "#705F77", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785764466, "uuid": "59602d0c-9857-408c-b52c-6e68719a106a", "comment": "Malware payload (CoinMiner)", "value": "4aa9b81a99828882bf566a499096a61ac41a3f4a", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "Kinsing", "colour": "#D800AB", "exportable": true, "hide_tag": false }, { "name": "masscan", "colour": "#55E938", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "shell", "colour": "#705F77", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785764466, "uuid": "08e76099-5522-4379-9169-081639914785", "comment": "Malware payload (CoinMiner)", "value": "f267e03479192b0b05ca94cfd1a14f2862174cb1e8ce8271f7b6f896cc6cfecd23fa10e50bb5b7dde34616133667d892", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "Kinsing", "colour": "#D800AB", "exportable": true, "hide_tag": false }, { "name": "masscan", "colour": "#55E938", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "shell", "colour": "#705F77", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785764466, "uuid": "6270c3b5-1e7d-4cf6-9a5b-f2a4aa637da0", "value": "T19381318D9062FC793CA5C85AD8817248644FF18781F33FA8B9127E3C2FE4145F6695AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785764466, "uuid": "2c73c075-d8ad-4279-b834-9ba628a704c9", "value": "96:eSaLaZaZagaLfoi8THN6Zx8YjiRa9aAaTMajka6MfPcyZPsqtstCgrA:eS8OSPefo1hc8MiYMrTPr67qtstCgrA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785764466, "uuid": "4fcafc6c-2afc-40ff-b1d9-fbe1d0fec835", "value": 4108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785764466, "uuid": "f809a099-3659-4483-877e-f2aaa6424967", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785764466, "uuid": "d670d498-4b65-4a86-ba45-e706da132c89", "value": "292ac9eec4431164f96e0b58f37065ceb4785745c6339bf2bfa0ae722cef3a0d_from_65.49.27.190_pgcopy.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99866cdc-8f2c-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1785755714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785755714, "uuid": "ee2c7f54-65fd-4ff3-a179-68372c51ef4d", "comment": "Malware payload (WannaCry)", "value": "b9a222a8ed9984bf392d9db4d559fa34", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785755714, "uuid": "0f6742a3-82b8-46e3-8e9d-b8d60b684e2d", "comment": "Malware payload (WannaCry)", "value": "29eaf996e94ad29861ab63c7c8e4a03d15c41c4db3c60bcc72dfabf64a5cb7a2", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785755714, "uuid": "140ce6cb-1a41-4d30-9ac3-8620b8c76a42", "comment": "Malware payload (WannaCry)", "value": "c6309a40963185e6f9f0f9e8247d8840ac810e9a", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785755714, "uuid": "abdda3d8-c78c-46b7-a76e-4892540a0f1a", "comment": "Malware payload (WannaCry)", "value": "3896b1741de0f97a5b599a46868540bce85896879266cefa32089ab15b6d4b74f53e3a38e5100448537f92fed7d027ae", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785755714, "uuid": "72c4efbe-b6e2-43ff-bcbf-fce64b5fbd82", "value": "T1033612D9767840B8E4066E76A7734A3AD6F27C95233D520F4B548E560D0339CEAE8B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785755714, "uuid": "bf54e427-69e5-4e6e-b316-3b9c2b1c39da", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785755714, "uuid": "86fa4855-f86c-4bad-a1b0-43e51eea3dee", "value": "24576:jbLgcbLgdlQhfdmMSirYbcMNgef0QeQjG:jnpnQQqMSPbcBVQej", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785755714, "uuid": "551ae2a4-b8d5-4f8f-82e8-1a006d6822d6", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785755714, "uuid": "fdefab55-ec5d-4083-ab69-37c7927b7266", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785755714, "uuid": "6d60bf6b-8990-41b6-8876-acdb3be91fa8", "value": "29eaf996e94ad29861ab63c7c8e4a03d15c41c4db3c60bcc72dfabf64a5cb7a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0587150-8f47-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785767429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785767429, "uuid": "84bcb35e-e466-4ff0-9ed5-efb40251ec43", "comment": "Malware payload", "value": "32d22e0ad64d0636aee7b9aef9a8e0e3", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785767429, "uuid": "e15c4bf5-7047-44e4-8264-c85441907e88", "comment": "Malware payload", "value": "2b521878306fe30a79e10d024b1bdee2083f89c45ac400b6d2d605180f20b205", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785767429, "uuid": "85b69af5-e52a-43fa-a19e-a0dc91c14933", "comment": "Malware payload", "value": "9e88701cbb32d3ce919a6aded5593c74e97bb94e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785767429, "uuid": "ec4e80cc-6568-4ed8-9c93-6f43bbd168d5", "comment": "Malware payload", "value": "1cc7d9ba1a66e989488bb221b62416b17a081b8f3dc1f1320bd597c1881e6607b37c19772be6600e96b64ca3a4d8fac3", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785767429, "uuid": "d2e5ad2b-bad0-4081-8644-bb979113305b", "value": "T1C7235C552A857C14AA98C8371D7F2F0CB9A943E6320452DE7FCF3CF68C4AADDA10961D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785767429, "uuid": "1b292a9d-bd12-4ec7-9006-fd55301f4919", "value": "768:eJFWzZx5u9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:8kz9cr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785767429, "uuid": "49f772d0-2ec6-47f1-bfd1-568bc5bb438d", "value": 50067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785767429, "uuid": "6335d682-880a-49ba-8e83-66c8ae7861c4", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785767429, "uuid": "ceca45e5-9547-4588-a217-4e5e8126fc1f", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dad4ccc3-8ed5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785718457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785718457, "uuid": "503cc3b3-ae09-49d3-b8c4-e8003e0d7ec3", "comment": "Malware payload (Mirai)", "value": "39bf981ac3ee5852950080fcf5a82ecb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785718457, "uuid": "802f15f7-d246-4b25-8863-f8a18dd2fe4b", "comment": "Malware payload (Mirai)", "value": "2b873c8e53c32d1947f8b0edbaea7fbf208ab1e202ff1cb07adde58d84894140", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785718457, "uuid": "bba51400-cbea-42ee-a7b9-d366e2ecceaa", "comment": "Malware payload (Mirai)", "value": "ca7507d60425cef9e617595140ef5c61966b24e3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785718457, "uuid": "f8ea2f2c-7d50-4953-9808-f4994a25ad0d", "comment": "Malware payload (Mirai)", "value": "64ee72e5f5f94691eabdcb6637d658dce5d9d70c9ef4698c03542129f6a9c1de4044dc9a625ab084d50372fff36f0ecc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785718457, "uuid": "dd8ee496-e409-40c4-b7dc-3eef0e745186", "value": "T17A330279E061DAA39D60847F6FDF5484308735B8917EB4311939C4E89CE121AA7DEF0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785718457, "uuid": "e43d91d7-f0ab-4200-894d-219296268928", "value": "1536:6NyNNXEw2PWNLqp2J1yML/w9mIYg1Pp5IMLO:6YXXApmjQmI11Pz5LO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785718457, "uuid": "6ae11795-f89b-46d5-8e2e-367c23953437", "value": 51856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785718457, "uuid": "512fa70e-921b-41ca-b248-b074e03bec17", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785718457, "uuid": "0f883876-f63a-49ac-be09-e890dbf6ea8e", "value": "nz.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55ceb231-8ee0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785722958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785722958, "uuid": "3caa0747-61cc-46c9-b5b1-8166c25a046b", "comment": "Malware payload", "value": "486c8fa64b8d20d789a32a363531c322", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785722958, "uuid": "84d9709d-60be-424f-afbc-9f0d8b816c20", "comment": "Malware payload", "value": "2bd04baefb1f340e0c7d816c96db0078c4eb8b7cfce6689fbb187e5696bc7a3a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785722958, "uuid": "321478e7-ad09-4b1f-9bdb-58b8236f968c", "comment": "Malware payload", "value": "8e187058c73ea0ff5c7c20a06f2ffc6c09da4051", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785722958, "uuid": "fd2511cc-2061-4b15-8bd6-d49ae66e693a", "comment": "Malware payload", "value": "01a0f4e0232717777b926f2914389717f17680d399a9dcb0ee6ef45a8caae49ba8c5f93277a5588cb76c9b8f89a8f7b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785722958, "uuid": "09a2b62b-f395-4ff9-a0ce-9bba0a994f78", "value": "T1F8C4AE07FAB114E8D9AECC348A1A9133EA29BCD8421676777FD45B213F25A10EF0E751", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785722958, "uuid": "e6eea962-6826-4769-b1b5-f2dd872d7a14", "value": "12288:LYt8cChCRDDJPnKG4olirFdk+hVyT0QJ9D3ZjHUIhGW:KHRDHwhVI0c3ZjHToW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785722958, "uuid": "f026532e-1097-41a9-b1d0-9b1947a415dc", "value": 589183, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785722958, "uuid": "af06a2c8-c216-4e0a-8657-e0aea63390c5", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785722958, "uuid": "3535fba0-0a50-4124-a1c6-3e8fe4cc797b", "value": "bot.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3db25fba-8f2e-11f1-bd95-42010a9c0009", "comment": "Malware payload (LxBaseRAT)", "timestamp": 1785756419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756419, "uuid": "e95f86ac-fafa-4ff6-92eb-1e916d1651c1", "comment": "Malware payload (LxBaseRAT)", "value": "b95ea96f18acef88803536eeb8d2b1a9", "object_relation": "md5", "Tag": [ { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756419, "uuid": "ad62a881-1813-4d8e-89cf-a0690ebd7fbf", "comment": "Malware payload (LxBaseRAT)", "value": "2bdb865c80afc6f8eac8747cefd827954b072db11f24054d71e7cb2cc5890a07", "object_relation": "sha256", "Tag": [ { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756419, "uuid": "70ec7aba-dd5e-42a5-aa1f-9c8055cd71a9", "comment": "Malware payload (LxBaseRAT)", "value": "221a3efe643e809cde63ef56e4b75b5cca3209bd", "object_relation": "sha1", "Tag": [ { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756419, "uuid": "084c0e01-fa3c-4936-8e62-e10034ce6216", "comment": "Malware payload (LxBaseRAT)", "value": "948b57f2925b303271b22f8f619c6f5def259e06048afe95f4fc7443f209dfd08e40425fa0200183b63d859456170174", "object_relation": "sha3-384", "Tag": [ { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756419, "uuid": "d9718be8-9541-421e-bfab-8b3edc0a4060", "value": "T1353533DE72930FC93CC12253CEB9A13CB815A155948BE44953987B7882F7E412F7F296", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756419, "uuid": "2a73fa8a-ec61-4ae5-965a-8c603177acac", "value": "24576:mp/bCBmEZrIQIbJv9dyvZGTBEDRIZFRH8zUG5ES9OCf7+lrxc:kbkmEZrIQEJlovkc4GSS0Ocdc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785756419, "uuid": "670acf81-eb66-4cd3-9852-cb204b684d94", "value": 1058973, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785756419, "uuid": "2b82c82b-7def-489b-902e-7a5344849c3b", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756419, "uuid": "7b6a37b7-d109-46ae-8cef-4baa7f40c090", "value": "\u0417\u0430\u043a\u0430\u0437_17954113028072026_Azotny_Zavod_LLP_xlsx.tar.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "261b2768-8ecf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785715577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785715577, "uuid": "7160fdbe-a89a-42d6-8c51-668eff9e5804", "comment": "Malware payload (Mirai)", "value": "ded1882dcf2f4a3a68432ed9951a0273", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785715577, "uuid": "57729657-f220-4b95-a916-232df2340c00", "comment": "Malware payload (Mirai)", "value": "2c19cd42e8cbfd4f3b6d72ba98f4d90540bc711af6d7ccb7d94202257397b9c9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785715577, "uuid": "1f808cf2-1bae-4f08-be52-620da0e1dc81", "comment": "Malware payload (Mirai)", "value": "a64b50444ad1c911c5e84187e1a40fbd8554d9ea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785715577, "uuid": "e6add89e-9edf-4d88-bdac-993ee3c5d0eb", "comment": "Malware payload (Mirai)", "value": "e4fba66e76535ec316a788663eb4a20d50b9401e97ee1cbaa30ec2bf67697c88078febe6f4436e5a258f5f594345a985", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785715577, "uuid": "aaa82968-af17-4c48-b321-f91b2e2d3cf6", "value": "T11A23F14BD0F127AC936F953F0D6B3A1907D0AD0FCA98DC22FFC420605856B5D1B69A57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785715577, "uuid": "535155ac-570c-4fc0-baa8-1524739d83b6", "value": "768:IDsFQuY4dWeVFNdXJHYkR4bCKwOBwPHWdOLWL8znTlIaS8IIicb2pndEhY5nbcua:ILuY4EevNZJ4k25+PWdinTlicb2Nj5nW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785715577, "uuid": "b6f3690b-1505-4035-a39e-4da816b3ea71", "value": 47008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785715577, "uuid": "9a8668c9-d28f-430f-af0f-a0129f12566a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785715577, "uuid": "1296580b-3888-4d2b-9d7d-1dcc5c559f79", "value": "nz.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dff75264-8f87-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785794916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785794916, "uuid": "74a3a658-27ab-4e6f-a300-ea2abf42a99f", "comment": "Malware payload (Mirai)", "value": "3fe77d26554a6301c0d7df1dab428069", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785794916, "uuid": "1e6e0dde-17de-4cd1-9678-d4d56825ebf6", "comment": "Malware payload (Mirai)", "value": "2c8d1a3bc1391cd67f3e4618bd652cd0dbd7dd6f1b08d1afdf8193606e829211", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785794916, "uuid": "f10a2a8f-c9ee-441e-82ef-72c2369ea005", "comment": "Malware payload (Mirai)", "value": "03d1d1037f56551097cffa79cc3eb73d8fbf32c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785794916, "uuid": "986b3925-e2c7-445a-8bc1-5aa24c4a3b45", "comment": "Malware payload (Mirai)", "value": "00c7774c9976cc60d965baee593f54eb5612c985f807222accf2f27cccfe83224ff097a7db9342ee5542b12a7c0d8d6f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785794916, "uuid": "f3273538-707b-4e76-ac16-70b8832de1c2", "value": "T1C4241956F8819B26C2C116BBFE1E424E33135BA8D2DE73039D241B747B8B96F0E3A505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785794916, "uuid": "47a46dfd-6f8b-4514-baf9-889751edf03b", "value": "6144:HOy4mhP9w99LdCX4aW8V+hV1k2Nhszvj:uy4YP+99RCX4aX+z1kl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785794916, "uuid": "a5b7afcd-e135-468f-b3df-7f94f1cb8dde", "value": 215992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785794916, "uuid": "8f320cd7-60d7-4200-83ef-832d91e95e96", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785794916, "uuid": "5013f73d-91ce-43e1-8e90-c879498080e4", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e6647d6-8f1c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1785748635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785748635, "uuid": "7e43d2ab-319b-4b55-9c60-79d50c506b5f", "comment": "Malware payload (Formbook)", "value": "d15d8a8314ef322f8c85c62b3e15915f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785748635, "uuid": "a994321b-53b1-4980-9190-20d7a6d0d11e", "comment": "Malware payload (Formbook)", "value": "2d9c7ea66ffb1c9ba48227f92d85715fd0501a0bd8ce214ad8154d814b4c13ce", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785748635, "uuid": "b4dcf76d-7580-44b8-b6bb-bfe6cf6ee980", "comment": "Malware payload (Formbook)", "value": "dc8614f66c7682cb805a005ceac3e3093b26c1ff", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785748635, "uuid": "46177fca-01c6-4d0a-8cb5-723d750c0e95", "comment": "Malware payload (Formbook)", "value": "21506dc9454818c758289084514cc80384e44bd913e36c4459d20c65345f7035f515abfbf0367adbd36347d6a4406934", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785748635, "uuid": "5473c8e0-2c5b-4db6-91b3-4cdfcf9c6aae", "value": "T165E5F9E727FE6BCD1E183365204D68A8CF4F86160F424AD060DE49F124DF495A798EEE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785748635, "uuid": "8f066ad1-26cd-4e2d-831f-6057d24a2579", "value": "49152:OYsm/u0MWfZOUHyxd5ECYOLUS2Fs+NmUem6FsH1UgMvI7p4osRHsnDlnFRbh:R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785748635, "uuid": "bfbf4a39-0b58-4bdd-b1ac-25e7d18ac6dc", "value": 3192494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785748635, "uuid": "fa231210-67de-45f5-ab7d-d9257db0818c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785748635, "uuid": "69a3b93c-4c64-47bc-a97c-0c6b9a142632", "value": "Ziraat Bankas\u0131'ndan 03.08.2026 tarihli \u00f6deme makbuzunun kopyas\u0131..js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87e1572d-8f57-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785774152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785774152, "uuid": "5b8ea104-902b-4709-928e-c9ac31fbcefd", "comment": "Malware payload", "value": "2a808ee008e54db81b8509da857cc159", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785774152, "uuid": "5c2df890-3d95-4897-8f49-5f77b9faeb2b", "comment": "Malware payload", "value": "30ab4af6063c4de8efbff53dbee459b204241e2a0bcc779182c08ea17a3e3df2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785774152, "uuid": "89ca8df2-25f0-4deb-8281-0ac4cb2a91c0", "comment": "Malware payload", "value": "25feb5a3fb650dc8a4c1eb33d9dcc9db8fb20e7a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785774152, "uuid": "5bd332bb-b532-4b53-9e7f-e20727577de3", "comment": "Malware payload", "value": "bfe8913485fa9190b15cbee91570e050de9ac8be609e14c62a3394ebc34d5b456e4aa00c2ac507b214cb71292578008a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785774152, "uuid": "632e9e1c-2253-4940-8ffe-dd1d2ee63be5", "value": "T14D3112E4FE648824B40EC7B9B1EA8C506D9B996F44641D48B0DFCF3C4BAE5262215F51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785774152, "uuid": "b754859a-ec7c-4413-80c7-b3cdb228320d", "value": "48:T2GRY2167RbLsZQnEwb81KssB8C/Ll2VXvzWmbu:RuJE68s2lvzWp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785774152, "uuid": "bca0e70b-16bc-4c71-9d94-0974ffdf5ac5", "value": 1713, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785774152, "uuid": "8cf34ad8-c76a-4e6c-8cb8-89918b289177", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785774152, "uuid": "d43210cf-dbe2-49a9-a30a-e0ccc91653ef", "value": "lateral.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0793fc3d-8f7a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785788970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785788970, "uuid": "406c3ab4-19a8-4471-8b46-f0d4f5e1e0b0", "comment": "Malware payload", "value": "9f6ed61435d293d39a2f8a95b34363c7", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785788970, "uuid": "71fb932a-8d3f-4801-985a-e51752078400", "comment": "Malware payload", "value": "30f434a11e62c48583e6fc22a383011af55313513af18a605c61f3a559ab2bbc", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785788970, "uuid": "c9a93a7c-e168-4f7b-b4cb-84e2b82bcb13", "comment": "Malware payload", "value": "43388b3904b008a6c1670dd290004198b0ba68a4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785788970, "uuid": "bb2d0c9a-8352-4802-abd3-1a3e9a7b0598", "comment": "Malware payload", "value": "59d5a8ade88410f2cacbc53813654f5cb3186923805a971b6884a953c25fdfca679609051424393940080c60407f59ad", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785788970, "uuid": "0a4abec0-16eb-47f4-a1a2-690fec098646", "value": "T1CDF0819610559D655B5BC903F2749F3DA22B7FB07DFF3F0ACA88AE23004884075E2DA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785788970, "uuid": "6d929254-f179-4cc4-a8fe-3d4672e60f2b", "value": "12:5KUH5hWwfFxLnhWw+phW8LFxHrhW80hWwVFxLVhWw2hW6Fx9hWpuma9beaxFaacj:5XZQwtxnQw+pQEJQRQwvxVQw2QujQ8Fg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785788970, "uuid": "2ecde5d6-ee07-4747-9429-a6069c30eeff", "value": 607, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785788970, "uuid": "e5843107-3de5-4ea6-a40a-08fb7d0687dd", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785788970, "uuid": "c3b7a617-2098-4fe4-8dc7-3330312ffbb9", "value": "a.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00b3d11b-8ed7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785718950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785718950, "uuid": "c8b9694c-725c-45b6-b6fe-ccb5e6562d2b", "comment": "Malware payload (Mirai)", "value": "a68102afd6a1badcb38c020cead5d92b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785718950, "uuid": "ff8ebf9e-8e13-4b07-b877-3ac5384c4b4c", "comment": "Malware payload (Mirai)", "value": "30fb755b87d11dee9fa92ff4adcefb4d15a36b3323f4b879e8d96fb2c3cdbbaf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785718950, "uuid": "a211d75b-383c-4779-a485-d9ca67e4e48e", "comment": "Malware payload (Mirai)", "value": "bd71f8e7990bf0e29afd786e223199dcb5d1a6b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785718950, "uuid": "5890f1a1-fbb2-46ed-bf18-b812bee653eb", "comment": "Malware payload (Mirai)", "value": "91b5ee7de7a1a6b6ea36ec5aced4024aa75dedb4c680b9728c16ffb9763b2c4e650d5a7ea87538ef305aa431f2591e9c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785718950, "uuid": "8dc23005-b6e4-438c-84e8-8bbfc48ab8af", "value": "T105C32945B8829622C6D723BAFA6E21CD336163E9D3DF31038E219F1137C659B0D67B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785718950, "uuid": "42334fba-69f7-4308-b9e8-7ab37854fff1", "value": "1536:ny1E/bPRgWJs+T2K7zlLpC+k4bNp1SBWmY4nuyJRjP1bJS46mOlcQBPLv7H6t:nyq/Dls+n7e4qYb0P1bJmxn7H6t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785718950, "uuid": "e00b4e0f-3e50-45e6-8b7d-bb97422a84c3", "value": 128492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785718950, "uuid": "2dec7030-d032-4f13-ac11-bd0e4cd64273", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785718950, "uuid": "52cc4688-1907-47ae-bcce-e154af1076f5", "value": "nz.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "310d343b-8ecf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785715595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785715595, "uuid": "6aea075f-77be-4434-b9ee-a07013585b14", "comment": "Malware payload (Mirai)", "value": "8e9cafeb7276fc942635606fc770ada1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785715595, "uuid": "c52e4431-75c2-4255-934d-dc421968ccaf", "comment": "Malware payload (Mirai)", "value": "312fbbedbe184110665f336846fff7a36d2c211b484e87fd7f57962267bbd66c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785715595, "uuid": "bd5e79ed-257b-4d48-8e8b-81b489f598ff", "comment": "Malware payload (Mirai)", "value": "0974de6ef4f4536349ce31415975e6f63486625e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785715595, "uuid": "ffbee71d-9fbf-4f30-964b-ee4c66bfa23b", "comment": "Malware payload (Mirai)", "value": "f7ea550b3797fdf5a32562711d3ce68f9193c653da1129d25e09a7c103cb4a473bff1d8396205dc7fa7f4954403acec7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785715595, "uuid": "09f6b1d4-276a-42f3-9ede-548a6dac2dd5", "value": "T110B33AC4E243D0F9EC160534213BFB379A73E5BF212DDA43D3A49AA26C96AC1D41679C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785715595, "uuid": "9bdd9782-b1fb-419d-b644-4858cf6f7667", "value": "3072:/Wd7t7hm8ba3D2RI+DB2M5Jfebx/SHhA9:/Wd7tE8ba3q1B3GJSHhA9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785715595, "uuid": "920bf3dd-e195-4335-bcff-51e4d15842af", "value": 108148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785715595, "uuid": "86c701cf-ff69-4266-b1d8-5e17f0bab256", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785715595, "uuid": "dd5786be-b688-4f12-bd57-c5d07f081f01", "value": "nz.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c14a3a4-8f06-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1785739370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785739370, "uuid": "1ee2ebde-d2f5-45f9-aea0-96450d403d37", "comment": "Malware payload (ConnectWise)", "value": "01735fa6e2dd50b6e4e3531a65eb5f31", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785739370, "uuid": "7412227e-7021-47b5-9468-3edb448a994e", "comment": "Malware payload (ConnectWise)", "value": "32813072c3d532ce7605d1b5fe73531a2992d5c758f11f50af67699eb67e46a8", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785739370, "uuid": "eca81209-7941-46f8-b7d0-eff8c274ed6e", "comment": "Malware payload (ConnectWise)", "value": "02789ca3a126e628884561b38af7ab824522a900", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785739370, "uuid": "a744aaf9-34d6-4be5-84b2-ebb93273444a", "comment": "Malware payload (ConnectWise)", "value": "021d52831757969d13ad348b45a8b64ab50352fd2a7193c464daa31dc244d2f68018d08a1219ef8764a185cfdeddc4d3", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785739370, "uuid": "92ab89cf-ec3d-4cbf-88bf-89742e6fbb82", "value": "T15A647D11B9C48432C273383147B8E2B28DBDB8301D655B8F57A81D7A9F745D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785739370, "uuid": "16e68a30-7f40-40bf-b9b5-4957b7a228b7", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785739370, "uuid": "900335dc-35d1-417c-8cd3-7be6bd4c54be", "value": "6144:amlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9/:p1iw7gryNkSV1hy1Z1u2JLu9/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785739370, "uuid": "a2a27ba4-c7b7-4f87-b6cd-b38c26a77b64", "value": 312536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785739370, "uuid": "b4adfc7a-535a-4456-846f-ffd052246d9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785739370, "uuid": "e9955712-7ef7-4048-a338-911170604f47", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31947317-8f74-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785786463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785786463, "uuid": "9af57ac2-5158-47c1-9980-4778187565df", "comment": "Malware payload (Mirai)", "value": "6593cdefbf67ef193f01b9390f3e9509", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785786463, "uuid": "d290478a-2292-438f-be30-9777593dad73", "comment": "Malware payload (Mirai)", "value": "3299b2ed7bb81686243fe0ea91ab66882a7633b85622e51b3e7c6334c2263e54", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785786463, "uuid": "00a044fa-8297-4b2a-a76c-637f04267c76", "comment": "Malware payload (Mirai)", "value": "aa26f7f43e63cf38311cdcb60d475bcadfb243b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785786463, "uuid": "69a5a0a7-0df8-438f-8666-0e9c971abc08", "comment": "Malware payload (Mirai)", "value": "bea33ecc156550eb688d179da55e7484a68d135802ef8ca6d291d61773a7e20976633e948efdcc9099b0f9230b7cfc40", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785786463, "uuid": "ea364857-3ab8-4dfa-860f-acee84127062", "value": "T10FC34B17B5D180FDC8DDC2B44FDAA13AEA73B52D0138B12E37C4AA671E49E205F5DA14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785786463, "uuid": "421080f2-efe4-46b8-aadb-4c93cfa3f5fe", "value": "1536:o9s2Z1MWLaiWs6Df2UuWlY1Qyc3JurbG1eQyHekZY3OoV:oq2HraLsdUuWKQtZu3G9nkZsJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785786463, "uuid": "5b885afe-6c5f-46f5-8e3e-a88d57b04126", "value": 122776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785786463, "uuid": "c7ccae34-7611-47f0-a355-a8b2cdcbe270", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785786463, "uuid": "040252c6-17dd-4c36-85e0-4d38d993e484", "value": "miron.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aed1bd9c-8f05-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1785738999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785738999, "uuid": "805d8c2e-3d78-469a-abaa-6b2714b2594b", "comment": "Malware payload (Formbook)", "value": "df74dc4f971836a74f2b34ff802b8fc0", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785738999, "uuid": "23ae49ae-01b6-44ff-9c22-675463ba3d2f", "comment": "Malware payload (Formbook)", "value": "33341baf2c19c4a4360135f9be686edae5d7fa38f2745625bee98574a349bb02", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785738999, "uuid": "1cf410d4-cd45-4053-bb07-7e30f70c0471", "comment": "Malware payload (Formbook)", "value": "5bbeb9182db5c6d63948cfb02fa333761d580d5a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785738999, "uuid": "1b6c3e36-21a0-46fd-83c0-072610b334ab", "comment": "Malware payload (Formbook)", "value": "59c8465a747ce5f27f81402fc7776027dd1aead73672fe93cabc3f29e49f7277539830c8a4c8fe58e6094dc31ad53e62", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785738999, "uuid": "bce7924a-a97e-4a05-bacd-48f3c0b4ab9e", "value": "T123E5F97263ED6A4806543F5EC49D28AE470AC42E5882ADD4F1FF4F84471A9DE3AD0DB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785738999, "uuid": "eff7fd59-be66-4a33-ac57-4ab71073d404", "value": "49152:Jaxet5/BmEmIwkAPGcHFlU4Kzy3W4Y5BQ70tmqYfwI+WXK/IC7xlBkSVAPo9JEgh:j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785738999, "uuid": "371299e0-2f44-46af-9d74-b807ed8ce778", "value": 3191554, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785738999, "uuid": "dee00a61-084e-4621-b5db-5b13166d985c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785738999, "uuid": "0ffa34c9-5ebd-479e-8775-9f39e1f180f7", "value": "VESSEL_INFO_PARTICULARSpdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9b05bbe-8f5d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785776920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785776920, "uuid": "58c14396-0b41-4343-8cde-23f6f4904e0a", "comment": "Malware payload (Mirai)", "value": "69757f5c455f68bec4cc89b1db1b9d5d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785776920, "uuid": "fae4a3f9-bb7c-4495-a185-589db86c2d46", "comment": "Malware payload (Mirai)", "value": "33e2bae843808e8c877c1c8b58f008f700a1ee7d47ff7ab8e7cc9ea9aa1fa045", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785776920, "uuid": "f9735c47-7ab9-410b-be77-cd6121b13f46", "comment": "Malware payload (Mirai)", "value": "9bed35100d0ffbf7492512b7e1a023024e86cc77", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785776920, "uuid": "eaedf250-7738-4c29-8f8c-49dd5892737c", "comment": "Malware payload (Mirai)", "value": "8a6ce7ae1d0f93062228ba4f5b35dc5cf85bdc2088e56ea9b822a256e958eae51eba06897e59ba13fc2102c5563997bb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785776920, "uuid": "d240f1aa-20ff-40e4-87b6-808c597c30c0", "value": "T1D0041B42F8414F16C5D211BAFA2D128E37231B78E3DF7212AD245B707B8A96F0E3B955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785776920, "uuid": "7fd9276c-7f59-41e3-bd5d-dca6888b6f92", "value": "3072:fZQOShtixZg4+AtQTFjxXsIa51U0T0BJcbZ0ZNNjcZf6hh1pCYas:RQJhtixZg4+04rXPa511T0m0zNjIICYa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785776920, "uuid": "d2a04344-f3b9-4818-bcf5-fb056547630a", "value": 178836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785776920, "uuid": "7cfff81f-b246-4f01-999f-a5991dc9b5d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785776920, "uuid": "a718c4d9-5c47-4b8a-bad5-a21eca03d929", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bee07867-8ed4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785717981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785717981, "uuid": "4cfef3c8-b942-4bc5-abf2-b774076ec79e", "comment": "Malware payload (Mirai)", "value": "4768b5df89b877414e044e154dc79247", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785717981, "uuid": "789bb91a-a7e2-4fce-b0f6-e6b96171170d", "comment": "Malware payload (Mirai)", "value": "33ede9583b474ce942e4fe36f7336b9b09552209230b4576860342ed56bd0d76", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785717981, "uuid": "34b2c4a0-4627-45a7-a90b-d13bb4aace85", "comment": "Malware payload (Mirai)", "value": "d5eb05efff86af9eb62559cb98e48c7851257a08", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785717981, "uuid": "ce2fd25f-adf5-4cc7-bf87-0ca6c2473879", "comment": "Malware payload (Mirai)", "value": "f33fd836b3c4d93b4a062fc7501820202fda2f605ec05be9cd7994acc342b46981527f664be7ef6aa9821e92372a2d93", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785717981, "uuid": "3ba15656-1e86-4dc0-a697-49eabb451613", "value": "T1BFF3F805BB610EF7E85FCC3706E9270128CDA51622A97F36B534D958F64B28B26E3D70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785717981, "uuid": "1b103def-5341-4707-8d91-376aa5d23836", "value": "3072:Wdrx+Fzsw8TONAdQLty5l6Gm7UxbiuyZ6RlLP4FQQm8DrfWH6:WJx+FzXUONAdQLtKlTm7UxbiuyZ6RlLm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785717981, "uuid": "76b7cf81-8a33-4099-8cb3-ac3969d2116a", "value": 161084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785717981, "uuid": "f7a0538f-3a81-4e33-b919-1dcceeca17e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785717981, "uuid": "21194801-60b6-48ce-90d7-f3776d2f64d4", "value": "nz.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc2e1a46-8f87-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785794910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785794910, "uuid": "a818d6fd-36fc-4a33-9a35-a8ac05d33e76", "comment": "Malware payload (Mirai)", "value": "887e59c441101dae2fb4477e881af763", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785794910, "uuid": "d506fc48-be1d-4710-8dc5-e3cef93cb8c6", "comment": "Malware payload (Mirai)", "value": "33f338a8ebdb7204ee6022c919c4ce30d8007b43531a714a9de77c8a91afab5b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785794910, "uuid": "42488aac-00a0-4e23-bddc-3f5632a1f752", "comment": "Malware payload (Mirai)", "value": "8c561fc6a3a9ede83316e01eb6cafeb28ff42b81", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785794910, "uuid": "19913395-e994-473d-b439-03419a3ef5ef", "comment": "Malware payload (Mirai)", "value": "f7955ebbd7dff950ddb1d54abe47d9f19d1416d5e50421ca11aa55382977808a12d6bacfad3dbc368b13e0d6548a6480", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785794910, "uuid": "2e571f8b-ec3e-48cb-9ced-21cd9267c91b", "value": "T15944F70EBF610EFBD86FDE3702A90B0225CC940762A97B363674D518F94A64F49D3D68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785794910, "uuid": "9bdb36d2-e634-43e4-a20c-011712f9df7b", "value": "3072:tNod1dGlyGtDb9pLb9LTMoP550nREaqWZh6zIPpEbSXHZd5gN:tU1dGlRX9p9LgoP55oqWyQ0AH/O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785794910, "uuid": "58d1bb09-c30a-44d2-949b-854d0bdcf03b", "value": 267268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785794910, "uuid": "945bc35a-0370-4b2e-aab2-86fe49ac69a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785794910, "uuid": "85e974dc-1232-494d-99ec-7779fe72309f", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "003d7906-8f41-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1785764476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785764476, "uuid": "384897fc-9fab-4641-ab53-84428cbf54b6", "comment": "Malware payload (CoinMiner)", "value": "7c5419873016283ae1eeb580bde1d6b0", "object_relation": "md5", "Tag": [ { "name": "bash", "colour": "#CC62C8", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "lateral-movement", "colour": "#299C86", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "shell", "colour": "#705F77", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785764476, "uuid": "88f43029-fef0-4d3a-917a-5dc1d8aba657", "comment": "Malware payload (CoinMiner)", "value": "343d40b06b48e6eeccacd630ce8d30bb3db7a78629fa48446823161d7e9e95f6", "object_relation": "sha256", "Tag": [ { "name": "bash", "colour": "#CC62C8", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "lateral-movement", "colour": "#299C86", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "shell", "colour": "#705F77", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785764476, "uuid": "433eaaca-5401-4c68-af75-390d5b53a9d8", "comment": "Malware payload (CoinMiner)", "value": "44075b1801a1c0265e04e8bf20ab70df7718b76d", "object_relation": "sha1", "Tag": [ { "name": "bash", "colour": "#CC62C8", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "lateral-movement", "colour": "#299C86", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "shell", "colour": "#705F77", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785764476, "uuid": "b6dd272d-1240-4ce7-baae-860f649a668b", "comment": "Malware payload (CoinMiner)", "value": "62ebd6004dc6bcfacfa3a95b24b6427b2cd9928eff3c4961ac151bdf51f526dc0bb893669fa4b254d92ceed49646a1ca", "object_relation": "sha3-384", "Tag": [ { "name": "bash", "colour": "#CC62C8", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "lateral-movement", "colour": "#299C86", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "shell", "colour": "#705F77", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785764476, "uuid": "d112a7f5-219c-4273-9680-d7ceb89a5420", "value": "T1B7C151E4FC349A33748D8138BA6C5585AEBB593F06603C95B083AC9C237C529B27D735", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785764476, "uuid": "9b39de4f-fd28-4450-8414-1cd9075e0104", "value": "96:9vO4cARMk0XWVi4sNymW/bTGJIBCgd4Rlu0vL9yX9MOd:hNRhHU4sNymsGJaCgd4fvCd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785764476, "uuid": "c3bc7b50-d6d7-4b5b-9b74-b19cf902226d", "value": 5986, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785764476, "uuid": "98fb71a9-9c43-4fa8-b436-a8a043153a0b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785764476, "uuid": "697cf2b3-67ff-4dd0-898a-d0ece4c133f2", "value": "343d40b06b48e6eeccacd630ce8d30bb3db7a78629fa48446823161d7e9e95f6_from_31.56.52.52.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b323a751-8f39-11f1-bd95-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1785761340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785761340, "uuid": "ab7145f8-bbde-43d5-a7f5-11c01074da43", "comment": "Malware payload (ValleyRAT)", "value": "2d4f738279d1874f4ef642c9ce57f8aa", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785761340, "uuid": "d8b3b792-2977-4436-99a2-a255dfdcfa47", "comment": "Malware payload (ValleyRAT)", "value": "34eee38834cb6b7cc705b35a4287eaef76ce8d4e71deaff48a0414c4d11290a3", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785761340, "uuid": "2e9172d8-b044-4886-a85d-846903a003f0", "comment": "Malware payload (ValleyRAT)", "value": "d16163cf43f7cd5bfe3043a0062ca4f9fafbab52", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785761340, "uuid": "aa467ccf-3a9b-4194-9c82-ab23c97cbdb0", "comment": "Malware payload (ValleyRAT)", "value": "754e431254008c1c15ae72264dc7469bd275863ade10476f9c07fed9c5a9de1af3a9e7a3db5e3eb4f536943005c869fa", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785761340, "uuid": "b5e53823-1d6b-4d58-b65e-44611a1ae52b", "value": "T1B9A633E77C8327B4C097C770514355AE3E3D3F4AB6AA8C06174D3A149EB362986BB385", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785761340, "uuid": "c9d2fc15-487e-4eaf-ac6d-ce63f54a00bd", "value": "196608:X8rHZSpKhlUUb2Ct6j5yuAQPivM0A1bTZBPsb9h9EI:XuHDlICtS5ykd5BPwhD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785761340, "uuid": "5c115489-0605-4c35-8f10-50720136d5fa", "value": 9699328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785761340, "uuid": "d0a6659e-e4d8-4e8e-a472-4421a0d44243", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785761340, "uuid": "6ef1f0ba-81b6-4e2f-93df-878c9c0a541b", "value": "install_n5w012.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9534b038-8f3b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785762149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785762149, "uuid": "6852f774-b6a6-468f-93f1-9c7a4f5121c4", "comment": "Malware payload", "value": "18cda64d99dd577d5a1e8a1eac4f6ffc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785762149, "uuid": "ec9adf9a-fda0-4cb4-afa4-89527dae2ce9", "comment": "Malware payload", "value": "34fc2444fdaa59e603cbb6924b2bca28bb483308db3b11829c06438fb76184a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785762149, "uuid": "d0b28eea-3dfa-4db5-9b00-ca8ba1df9ee3", "comment": "Malware payload", "value": "118984eb8f0320302e518babadfeeac794cc7dc5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785762149, "uuid": "3c8d900a-bdd8-4a3a-9c5e-50eb2c9e11b6", "comment": "Malware payload", "value": "d8435c1f4e060b5c32304232b19b452664ea95de8a6b12fb15479cb077a14b4571062e4959f0f6f485dd6a5209f2601b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785762149, "uuid": "982cd389-e8a6-4175-bbf8-48201c270533", "value": "T11CA394277293CB78E8C57F7839CF91A58811FCF09E7811AEBB568D1A44928C8537E391", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785762149, "uuid": "83d44b0d-7588-461d-8133-34217929a3ae", "value": "1536:xc5eKVkt82KNm2Iao/JtItgyhvy4r9wvHO8VNm:xc53Vkt82Ko2/kJtuLvDSh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785762149, "uuid": "ff7cfd4b-bffc-45e9-a303-737b1dcafb64", "value": 98352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785762149, "uuid": "b94256b6-b5f5-455c-ade8-a57169f88f4e", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785762149, "uuid": "79dcd9e9-e7de-4e0e-983b-7377927ef455", "value": "bot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81ee63f7-8ee7-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1785726039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785726039, "uuid": "b0b28813-cb82-4981-9d2f-80669df50527", "comment": "Malware payload (ConnectWise)", "value": "f1baad0bd794724693201b43a4202050", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785726039, "uuid": "325635c9-d6cd-4603-b3ed-db318dd2dd62", "comment": "Malware payload (ConnectWise)", "value": "361fd82dba53c49c5f1cdfc1b3ca658339726a60a1e921ad52d437c0e62a6f85", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785726039, "uuid": "8d0011bf-bc68-48cb-8dee-dc58e48f9ae2", "comment": "Malware payload (ConnectWise)", "value": "e94f92514df496ab0a3be24261325124bc7372af", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785726039, "uuid": "b3705eeb-613f-4919-922f-12d51521b3da", "comment": "Malware payload (ConnectWise)", "value": "47f69d1f3b1deca09e61b7be0b9c81f63a1ab3db074c1762cba0be083d6e2e341a146fcebd021523f11e417b80216edf", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785726039, "uuid": "9966c665-7835-4a7d-a996-dbad8fe78c4c", "value": "T19372FD3D22003AA617EE4A1A8E2F11812E76444F0315BDD571AE917FDB72F947BBE1C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785726039, "uuid": "f42dacab-6301-4aec-b172-4fa1e46b0284", "value": "384:BMWSSOYIJ1xmPjC+U+ps6VpftQG6OncDa:vstusxGVncDa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785726039, "uuid": "6c94a145-4fc2-4bb2-821e-45f074b2c400", "value": 16394, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785726039, "uuid": "99e3de8e-a959-4b66-b5b5-2002a26b8bcd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785726039, "uuid": "1312848c-7567-4727-a6ea-609d9f1dbd0c", "value": "Adobe_Reader_uk_install.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2742a008-8eea-11f1-bd95-42010a9c0009", "comment": "Malware payload (Joker)", "timestamp": 1785727175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785727175, "uuid": "79d41e66-78a5-432f-b072-00244e6e6694", "comment": "Malware payload (Joker)", "value": "49eb701418e071e0d0363dac415162c4", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785727175, "uuid": "483908d8-127a-4775-923e-a4fe652dedfc", "comment": "Malware payload (Joker)", "value": "36cefed9bdb1d3c2bdc91aca29ba6f8b06002019ef6432df922a106acf371177", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785727175, "uuid": "e574d7cc-eee6-4703-bf6f-b93b3ccaf794", "comment": "Malware payload (Joker)", "value": "4941cbfc6a934c514fd84bc8feab47ff9886186d", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785727175, "uuid": "81a84bff-b2d4-4f53-bfc8-f493d082d890", "comment": "Malware payload (Joker)", "value": "75d4de2ed8c5cb767796831510947e77d3b96f2282709f41b6f00f241b6bbf0f2ccc30ff6612b778f6ca8ee6356bb272", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785727175, "uuid": "5307f6e9-8a47-467f-85ef-e3123b81650c", "value": "T1AB5723CAEB18FB2AC87E1037C956563772424E360682577A750D3B0935B34E6EB49BCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785727175, "uuid": "0f6e9f04-dfb8-403b-a658-d5381fca8c59", "value": "786432:44mDiJz7LXhsU3XSWUGUodxqG7JNtNLGv2EWbE:nmDi9LRsU3NUGjdUMJNnGvTWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785727175, "uuid": "e28aa6f5-65d0-4837-92a2-1fa15912ee3e", "value": 28928391, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785727175, "uuid": "6d7dc72d-897f-48ab-9448-7d48db81a959", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785727175, "uuid": "8fbf90c2-baea-4147-9277-8d90b59adf38", "value": "com.easytexting.messagingme.sms_1.46.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f03f3a6a-8eee-11f1-bd95-42010a9c0009", "comment": "Malware payload (Joker)", "timestamp": 1785729230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785729230, "uuid": "60847c62-2b1a-4b3a-a0ce-f9989470123f", "comment": "Malware payload (Joker)", "value": "1af860f02ca4bb660259dfa083f18437", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785729230, "uuid": "c9418467-d502-44ca-9005-581d9879b104", "comment": "Malware payload (Joker)", "value": "36e7192787f1d6b26b8f285ecfad5d719a37b9dc2882fbce735477a29867de9f", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785729230, "uuid": "30697732-7d75-46e2-b451-0dcd6e74ea59", "comment": "Malware payload (Joker)", "value": "1b3af55ba9372ec73ae7cf82dc0d7e94909b17f6", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785729230, "uuid": "37202bf6-79dd-4815-9579-090687d05d13", "comment": "Malware payload (Joker)", "value": "7e4f06b953d4b0de73da85e752104dd147f62df0dcbbadda71305bd1d1b57c9cc72625398fdab8cc2f00f02f0f6c5e9b", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785729230, "uuid": "4ba0e17c-c49a-4893-b397-9f6301d577d7", "value": "T134D6F143EB42CD37C8AED63458B687117B326547AB93470B210CA6B8BD977D06ED93C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785729230, "uuid": "31f4aa9f-0635-4a67-88e7-c83a5f6e59f2", "value": "196608:US9K5IzVUXQuqkiedHeYVK5IzVUXQuqkiedHe1A:US9sIzuoYVsIzuo1A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785729230, "uuid": "1315bb19-72bb-4d97-bedd-4947a116a82b", "value": 13047822, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785729230, "uuid": "8049c822-1e44-4a99-b42f-7bdf38c43a49", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785729230, "uuid": "3ebc6262-198f-48d3-8a66-529cf7ced947", "value": "com.mrdu.forkap.phoneclean_1.0.2.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4acba7a-8ed6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785718876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785718876, "uuid": "68811a21-9e0f-4fae-9d37-732d10d91e0e", "comment": "Malware payload (Mirai)", "value": "9d8ed4734b02eb26951c0cd5c37e3632", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785718876, "uuid": "4d68998d-1439-482d-8ea3-0bb998e147ba", "comment": "Malware payload (Mirai)", "value": "3799f7600cb8a8e0582bacf44e373ab26f414f456ebeab4f0d6095a239647813", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785718876, "uuid": "137eb566-9dee-49f1-8172-af4e4800e205", "comment": "Malware payload (Mirai)", "value": "30853410f30e04b26e7863c3c7cab2cd3934ab3e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785718876, "uuid": "8f5bde4a-d369-45bf-ae4a-7c6cf0363514", "comment": "Malware payload (Mirai)", "value": "2f2f5fe5488e5046bc3d585f54c223adb0552af16012172df56196b2d2e08d54cf7fe1f5651f10be2727133d8b930ccd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785718876, "uuid": "39e2897e-52b3-4778-8b9a-08088cf6dc25", "value": "T1BB23F19937434509E0FBDD73E688F184EB9646B0EABB25BE309C45ECD1C080378F95A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785718876, "uuid": "9a297c52-e7b4-4442-93ed-3134aefe91b6", "value": "1536:ELqlspf2tTov/xftB9gQfIC506oO9CMzk:DlsN5pftj5fICf9CMQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785718876, "uuid": "e748abf2-60ac-464f-8244-51ed0fbc4442", "value": 49288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785718876, "uuid": "719a940c-790c-4ea0-a7b3-286def263490", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785718876, "uuid": "a78b843b-dacd-443e-9732-13c8a18de44a", "value": "nz.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7162040c-8ed6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785718710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785718710, "uuid": "4496429c-0019-41ec-af3f-9059ede83eaf", "comment": "Malware payload (Mirai)", "value": "c84cef5b1d460e635eb3f21190ce8134", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785718710, "uuid": "fac98143-3913-4147-b662-b133604d057c", "comment": "Malware payload (Mirai)", "value": "379d88307d819bdc60fd02afef40a9ff593bfb637f463daa21e42248b24fda5d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785718710, "uuid": "fa605fae-3a3e-4b6c-b71f-1ee1a27abdad", "comment": "Malware payload (Mirai)", "value": "0ecb6b6e96c9f9de1819a8c32bfb2436f2f0c633", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785718710, "uuid": "36fefb1d-7661-465d-847e-01af38e8c3c7", "comment": "Malware payload (Mirai)", "value": "4d65cbb78639722fc72383f88258d26ac85662f56bb647ea30aee35cab70f7d02ad8dd66dea39d935f45b6cbc2590297", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785718710, "uuid": "4c4ff952-6bed-45d4-8127-3617d2e3c4f9", "value": "T19CC36C22B4391E27C4E0A47A12F75366F1F657C915A8C65E7E720E8FBF112D02A07BB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785718710, "uuid": "0b30f4dd-0ea5-4d52-8225-75d03cfc49a1", "value": "1536:dyjL/F9rOYI9P3PKRHTceSkPr1KEpXF5F2r+FFgJafJj2QAhwIiDlut4gPYm5kkY:UP3HI9azceJ1jchwISgiOYOkoNKX0sks", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785718710, "uuid": "22390567-fecb-4b36-965f-a2c9cf530214", "value": 124416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785718710, "uuid": "b4d1f6c4-6652-47c9-b40e-0cc905560ccd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785718710, "uuid": "4f400213-502b-4ff1-964d-e1669128d677", "value": "nz.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3daf715f-8f3b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785762002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785762002, "uuid": "a4e8818f-f6cb-4eae-a4ed-36376ea05016", "comment": "Malware payload (Mirai)", "value": "edea8eb4a025a40d385ceb83108714a8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785762002, "uuid": "94376290-cfb1-4ad2-a1d9-1d67b4ae8307", "comment": "Malware payload (Mirai)", "value": "38059feffd41f7edaf407a9f3b4a4efdc6b42effd600f72125c55260b59287f9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785762002, "uuid": "d07b1f55-3ee0-4ea2-9d93-e76ccdc01b37", "comment": "Malware payload (Mirai)", "value": "052c5ef28a2d2f1a1062d4fdf24407ce5db4a74d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785762002, "uuid": "58591737-fa80-475d-8b89-8ab8a41bebe9", "comment": "Malware payload (Mirai)", "value": "1b3c93863ec3718d42a68b8f45aaf8e418acb021e049dad059e61b403af1259c12316300a160b6de6e4ebe67ece63cff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785762002, "uuid": "8f4ef5c7-1f27-4f5d-8e1c-5c7bcf8118c5", "value": "T183B31A45F8504B17C6C652B7FF8E428D7B2617A8D3EF320399256F21378B99B0E3A146", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785762002, "uuid": "cea17f7e-08d1-4205-acbb-fcf2146a2813", "value": "1536:n2zAEeaqPqOsb0Jl4m4V/vTJ4LSzafWNAtl3cwywh6itl07wXpOAcAyRNDbJe/ch:cPTqyb0R4t147oXwcGdv47N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785762002, "uuid": "a930b574-763f-4f76-b4c4-f7aacbb2fb85", "value": 113184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785762002, "uuid": "88df61a0-f081-4ba0-aff5-c96437da1bfe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785762002, "uuid": "90adf810-b73f-479a-b002-cf25e78fdc8c", "value": "miron.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeec6b3a-8f2d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785756179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756179, "uuid": "59405c7f-7151-4ea9-ae31-f792fbd8c0cf", "comment": "Malware payload", "value": "b83f3fcda7fe28ca3b2b4484440a60e9", "object_relation": "md5", "Tag": [ { "name": "dn-pdflite-lat", "colour": "#BE5FA0", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756179, "uuid": "02516a93-db2f-4fb7-8a52-e890749de1f1", "comment": "Malware payload", "value": "38bb1831d95ac4f136f8eb907e8497551007bab8c74125b4bf102465c9f874a8", "object_relation": "sha256", "Tag": [ { "name": "dn-pdflite-lat", "colour": "#BE5FA0", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756179, "uuid": "a166372a-6579-4f5f-b8cc-10d2030a4128", "comment": "Malware payload", "value": "5b65441e6bfed25beedde1bc11d8bdcf72aadb1d", "object_relation": "sha1", "Tag": [ { "name": "dn-pdflite-lat", "colour": "#BE5FA0", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756179, "uuid": "f75393fe-2b51-42fe-bdd5-e367baa5dd7c", "comment": "Malware payload", "value": "8d2f6929acf6294b2991d884ccb3fe53354a6214f7d79548fd62f0b2a80c8b986956ecbc56da963ad97711ab6f03a2c6", "object_relation": "sha3-384", "Tag": [ { "name": "dn-pdflite-lat", "colour": "#BE5FA0", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756179, "uuid": "f354e04e-cac7-4644-931e-57bb1bffd281", "value": "T1DE2397F76E4652C5FD3149BB5A2F719D14C46A4213A5D0B8F2AEEC00EF88F5945383E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756179, "uuid": "09b45df3-407f-4243-abe6-e1f804485d40", "value": "48:5OXdK/Sxif3ZRwQ2OrSbbJb7JXjD7GRQQpXfFX2DN:5r/SxgRwfaSbVb7JXjGRzfF2R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785756179, "uuid": "bf6e1b19-7aff-477f-8d65-a647c605ff28", "value": 47104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785756179, "uuid": "10cd2681-aa53-4b00-ad9b-120785d8e7bb", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756179, "uuid": "a632ff59-d079-4fca-88cd-72cde24b10a4", "value": "Nota Fiscal Correio-T3YW4T.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cddbc8c9-8f05-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1785739051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785739051, "uuid": "183f7bfb-d54d-47a2-8ffe-cad1e892ac97", "comment": "Malware payload (ConnectWise)", "value": "d87d1c453d5ef6158a995d4ca26b8204", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785739051, "uuid": "810066ba-f555-43ff-9667-cd14c4e30a40", "comment": "Malware payload (ConnectWise)", "value": "38bf7608d7a7ac4d5d5a0ad1d47f38330d648dc287cca978d11d1c32571839a3", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785739051, "uuid": "12e7b5eb-91e8-4965-970d-f08dcefa660d", "comment": "Malware payload (ConnectWise)", "value": "770b19a1987c4cbff943416c51ddb54a455401e0", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785739051, "uuid": "085e8b8c-ae63-465d-92a4-3428ec3bb980", "comment": "Malware payload (ConnectWise)", "value": "abcb29434e9cf99bc04bf30e3c350079b2d45ea93084b311ede70c1c16fc756a80eda78841d7bd463bbe26af49ac8c28", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785739051, "uuid": "a6e1f2e8-963d-47d6-ab15-a58e915d3244", "value": "T1E4647D11B9C48432C273383107B8E2B28DBDB8301D655B8F57A81D7A9F745D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785739051, "uuid": "170dbf2b-4f9d-4b60-8a3a-83b56a5699f1", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785739051, "uuid": "a3bddfc7-60dd-4bba-ab7c-319b228d35c5", "value": "6144:6mlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9sM:J1iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785739051, "uuid": "a3e19da3-6262-4b3d-a4d8-98aca0716b42", "value": 312568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785739051, "uuid": "65ae621b-16df-4982-9495-bc387e21aa23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785739051, "uuid": "84048e36-7c96-429e-8372-26dc002ed3f5", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac3bd185-8f5d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785776790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785776790, "uuid": "bae10fd0-ed43-43e6-9a09-a5617c292333", "comment": "Malware payload (Mirai)", "value": "a86f5eb5e634fcf2bca34df8f5b3a97a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785776790, "uuid": "6aa9d78c-067f-410a-9499-ea42c2115dc7", "comment": "Malware payload (Mirai)", "value": "3a33cd1573d30b6abb08ad7831d395221fae52158ec895fec050ba76e72bcf48", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785776790, "uuid": "3f191d54-409a-4d77-ab70-a582827aec78", "comment": "Malware payload (Mirai)", "value": "5424424afecb427f48cd45129bdced07264a568f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785776790, "uuid": "eeab72ef-8d22-4cb8-8512-b00b8f921621", "comment": "Malware payload (Mirai)", "value": "1efe555f54863ada2f6407021917d0300a847bd3bb29f8ee8641cc7fec02968443efd221e798cdb14225d9b3ca4a68e9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785776790, "uuid": "c8d1144e-1147-4c10-a6e9-007bc88341c6", "value": "T1DA430291D8DECD94FEE699340D83A8CA7FB20F4602F08F695614F291EA4ED295748781", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785776790, "uuid": "9d5580c3-5a61-4e53-9807-da3fb732564e", "value": "1536:VICBahBECNqv1SBY1BbVR8lL24u+qgw09bh:VICONuIYPpX4u+qgws", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785776790, "uuid": "b47faa52-7c99-4a62-88ed-acf0c06e5e3b", "value": 56916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785776790, "uuid": "82f25286-3e08-4a8d-9472-06ab04101cdb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785776790, "uuid": "bcba1ada-c8c0-43e1-b30a-3a85591015da", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db8e939f-8f3c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785762696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785762696, "uuid": "66a086ac-d746-4c5a-a0b3-8e568265558c", "comment": "Malware payload", "value": "de57ce657171a839c3f47dd4c3d8c322", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "PixRevolution", "colour": "#D632F0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785762696, "uuid": "e91ef6d8-17e6-4047-b07a-5e0201c37e8e", "comment": "Malware payload", "value": "3a59035ce30ac0f26bf49d3a0175e530812968614d3870099742258fb336ce6b", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "PixRevolution", "colour": "#D632F0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785762696, "uuid": "913a826c-753e-4f95-93f2-535f6f21d01e", "comment": "Malware payload", "value": "96778b7990e3087bf1c26bdf36ca9a64c4a24100", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "PixRevolution", "colour": "#D632F0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785762696, "uuid": "362a2795-3f37-4f76-94ed-678b8a1958d2", "comment": "Malware payload", "value": "3bcfef71b844e5e88b1efcd667e6066d88f0f38d9d41a9dd475c89a08cd04fe5dea549939f0f5eb63c73729ba5b5f7d0", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "PixRevolution", "colour": "#D632F0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785762696, "uuid": "fdaad014-a1eb-4d92-9780-99b48d94f794", "value": "T19015BE82F7E55E2ECD7744360F9A833112129E03CD56DB07A8A8772C683B6D94F4ABD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785762696, "uuid": "a7466a3b-1077-4247-a9bf-da727dad95af", "value": "24576:QIKERcAUIzzvDHMU4zgdFERp+2/yahgm6+7w:YERcAUIPvDHMkdFkO4gJYw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785762696, "uuid": "431e6c2b-fed6-4c19-9eed-04e2b89292f6", "value": 887767, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785762696, "uuid": "99640749-f11c-42c0-b2f9-2dbfaf7144d0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785762696, "uuid": "76f48b87-63ac-4b52-8d41-f4f942a21118", "value": "3a59035ce30ac0f26bf49d3a0175e530812968614d3870099742258fb336ce6b.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a8547a3-8f20-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785750347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785750347, "uuid": "76dd15fd-07d8-4bf4-a19e-024cf5f2357a", "comment": "Malware payload", "value": "7448a3ff5f2e8c4704de7129fb6d3d39", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785750347, "uuid": "483780d9-f97a-4315-bd57-c86e4af7d5b3", "comment": "Malware payload", "value": "3aae231e32cbc8a89677f31793ee23fa2425ac47ddfaf03a2064cb6144ba587d", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785750347, "uuid": "c4df0acb-1612-41f0-9ce7-76c62cb4a956", "comment": "Malware payload", "value": "42dcf807cc93832bf08470b74f0af98a53447fdc", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785750347, "uuid": "2402c33e-3840-4e63-a7a1-ebeb6bf7e4ba", "comment": "Malware payload", "value": "911927ef19e3a0e2c0b3877fbd19a557adecff13227d45a3a3f7f469905d08fceba569d40682a64a5507442d7f9cfe38", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785750347, "uuid": "1108c684-2168-4f2a-b403-b8d09f2af04e", "value": "T1CE164817AD9948F5C099E731C4B78256BA24BC0D5B3123D32E50BEB82F723D2AE36754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785750347, "uuid": "34ace96f-ccd3-4d64-8735-69d02488d382", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785750347, "uuid": "365050d4-93b9-4e38-9798-a78154ddb881", "value": "49152:6qsgCrvH+2TEDAaJLQSJ7W4BagxREt+oDJ9u+OBAPKUBv:6Mj1S4BagxREtLXgm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785750347, "uuid": "60542dc1-83d6-415a-b7ff-e743891f5775", "value": 4152688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785750347, "uuid": "fbc65620-dd9c-4b3d-be76-87207b801408", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785750347, "uuid": "5de6fae4-a337-4d96-9f30-e85f794c12e5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74a081dd-8ed5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785718286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785718286, "uuid": "cc4bff69-2985-47cf-934d-9749294a667b", "comment": "Malware payload (Mirai)", "value": "68386c6a758146d50d31714c0cdf0b6a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785718286, "uuid": "5ddced47-ded7-4693-bb2c-2eba8ff2140f", "comment": "Malware payload (Mirai)", "value": "3be39d081294ea74566be909ab5eeb988ba85d16b1c137b3a4bfd7dc728d52a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785718286, "uuid": "074ec04c-cd57-4658-abdf-91ef8223374e", "comment": "Malware payload (Mirai)", "value": "d665b281c6e7dbdaf7eaa3e1be808262a5bd8f1e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785718286, "uuid": "a05c9f4f-cc31-4b2a-85de-387bd1c0ae37", "comment": "Malware payload (Mirai)", "value": "edbe76af81c2ce75d86d1a27944fe39c6371e353b595bc80dcdc7b322bec54227c1415efce98219a59bcab6ee8482191", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785718286, "uuid": "5b9ccd32-0af4-4518-ba68-bc22519fd025", "value": "T1AEB31907BDC08CFDC089C038477F753ED832F5ED0239B2AB67D4AE26295DEA11A19A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785718286, "uuid": "e6014673-72f7-46f4-af24-7560d2b3d312", "value": "3072:U30FlN2APZDK9V5TgkDewBayOPCv8R0PTIc2UZXYHkN+:FFlN2APZDK9fTgkCgaqrLIaXYHkN+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785718286, "uuid": "78c5a345-2e99-4d5c-93f7-2cbd649d9d83", "value": 117712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785718286, "uuid": "322139e1-acdd-4d34-adeb-2c96b5895884", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785718286, "uuid": "79d3b815-58b6-4dc1-ac87-21fb6ea6185c", "value": "nz.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35a8573a-8f3d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785762848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785762848, "uuid": "9285cd50-531b-4658-868e-62bf047e17b6", "comment": "Malware payload (Mirai)", "value": "e03ab058c859e23a687938620124d433", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785762848, "uuid": "55cc9952-e76f-437d-b6af-3ecc76201555", "comment": "Malware payload (Mirai)", "value": "3e19207d02fc6a121c12446c12a514ee28860bc64c6d0afdb597f8786177550a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785762848, "uuid": "40583089-de39-4dea-a00b-0c46cc1d2dcc", "comment": "Malware payload (Mirai)", "value": "8f953fe8d78de5d6c3f832873059c9764912cd0b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785762848, "uuid": "93661db9-4d53-4b30-9cdd-42fbd2f3571a", "comment": "Malware payload (Mirai)", "value": "98e115a6b8db745a8442be13782a4ecb362b772a2fd600c88cad7f00550c0ee7e67f7c584105c4836b710c26ff53b35c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785762848, "uuid": "512084a0-9744-4ad6-a610-8f5d274df353", "value": "T16E33194AFD819F01D4D521FAFF4E114E33135B6CE3EEB102AE255B24678A96B0F36906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785762848, "uuid": "d75a3edd-3584-4cdb-bd07-6a3d67ea64de", "value": "1536:1Nn8wXSLqu1GiZHH0KrH8mhpr9R7ipXN:uzGGHH0KrH8A10XN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785762848, "uuid": "4b45137c-5b80-468d-9564-41ae725a4bc1", "value": 54788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785762848, "uuid": "d3fbd794-4aad-4906-9a9f-f61bbb5d5620", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785762848, "uuid": "be22424f-7442-41a8-a14c-d948dfd3f7ac", "value": "miron.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c5ee12f-8f0b-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1785741411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785741411, "uuid": "3a2e7da5-5a30-4df2-a7ba-48c8d21a316b", "comment": "Malware payload (ConnectWise)", "value": "cdddc4e30d13d4d7682ee91b63fe1c5b", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785741411, "uuid": "cefe8d43-14c9-40f2-9a64-542940d33724", "comment": "Malware payload (ConnectWise)", "value": "3e4e88255066faa5d0bcae00b6dfd75d2ae4fd13c4d28109b814a9b126f8ef63", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785741411, "uuid": "bb49693c-a8ba-42bd-b70f-f9a155a60462", "comment": "Malware payload (ConnectWise)", "value": "2235d3872b3954450dfe66e07bf78cabfb196876", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785741411, "uuid": "3417c771-f447-44b9-92d2-dbc11ddcc00b", "comment": "Malware payload (ConnectWise)", "value": "b3242cdce7b63a892233a2bd501115600baa0167cfb482af021468dddb78ad8da9a1ee50547cd974ca35036e3c8d2a01", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785741411, "uuid": "29b1779f-4305-431b-9ac0-96bbb510b1dc", "value": "T1C346E101B3E695B6D1BF1638D87A56656734BC048312CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785741411, "uuid": "35789723-df90-46b9-8132-a9566bb9adc7", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785741411, "uuid": "3feea580-78e5-4cb8-a4a8-ee0ae93df783", "value": "98304:1zIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:1hfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785741411, "uuid": "9ff85dd7-2d6f-4791-8f86-2ce3b7f5a1b9", "value": 5733704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785741411, "uuid": "c480f409-71aa-4efc-8c00-103ae58cfe04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785741411, "uuid": "007dcf3b-4b22-4cba-a167-5ac82081a7c3", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42ae481c-8f38-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1785760722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785760722, "uuid": "c2fa5dbc-2249-4a84-8514-2337defbda6b", "comment": "Malware payload (PhantomStealer)", "value": "b2b11c1f09062f6524ef9975e0b76e08", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785760722, "uuid": "f7963932-5873-40cd-a1b3-f1bd6417f096", "comment": "Malware payload (PhantomStealer)", "value": "3e526d038238bcec2238d7ca14df8d1394fbb15c8b0ff7a58c84b924b5b2b99a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785760722, "uuid": "ed3c4113-2232-488c-a69a-98439fa34ce4", "comment": "Malware payload (PhantomStealer)", "value": "f3d4c5a6f076e653f1419a083ecd834a59de39e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785760722, "uuid": "90bf0624-ed58-4b7a-8e5a-419412011cac", "comment": "Malware payload (PhantomStealer)", "value": "0c9a3e9fb5cf9fec481fd0528c8178bffeae9abdb666cc6769d8afb41176e04518b6c6c9267b86ab2b98ff11492bc04c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785760722, "uuid": "67958d89-2710-4da3-82bf-963cdc42e33f", "value": "T18106E751A354D472B27EA76CC136CE214569229710C9EF2E30BD430CB7AA93B635CEF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785760722, "uuid": "6a1a8f45-fd46-4894-81d9-77efde17ed04", "value": "98304:afb8ojr/gZsRFDjRRwKwalW0RD2iE3a/u6Ne7QhMSkz7FXx0M0D8P4pwFh+Qyf:afb8oX/GsnRRDl32iEKGo7MSkzEyFh+F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785760722, "uuid": "1a37a99a-d9c8-4998-b40a-cbc9ecebcd10", "value": 3869009, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785760722, "uuid": "00d668d3-8b64-452a-8d01-49c528f38a5e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785760722, "uuid": "0faffb15-2e86-4f3d-9202-0705a90bc091", "value": "INQUIRY_APCRBC152.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34a13202-8f05-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1785738794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785738794, "uuid": "df1132c4-8345-4703-8718-ad5b49f648f0", "comment": "Malware payload (ConnectWise)", "value": "3e1044f5df0a377f39bac7e4531e2b72", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785738794, "uuid": "fb270307-410d-4978-9e0b-3042d165a3b5", "comment": "Malware payload (ConnectWise)", "value": "41a492d3a954e29d968f13dda4f7d8cb5dad6f3a0d7120e598053a2efb0ebdac", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785738794, "uuid": "2ca979c9-393b-4596-a6ba-4b673dc0f840", "comment": "Malware payload (ConnectWise)", "value": "c35f4636955028bf5d940d682b3232c28d247e3c", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785738794, "uuid": "db9df15a-b86a-45e1-92d5-3d688311545f", "comment": "Malware payload (ConnectWise)", "value": "ef575c87eb7d15b8df2d300c62c8a6419d505caaecbd1fd6ee75e3ad372d7bfecd944302192602846cb10982d0cebeb3", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785738794, "uuid": "86a40854-a3c9-4b45-8daa-a2dd7120f2cf", "value": "T12A836C43B5D18876E9720E3118B1D9B4593FBE110E648EAF7398422E0F351D19E3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785738794, "uuid": "dc3150f5-52ab-41c5-99c7-6c4768f90fa0", "value": "37d5c89163970dd3cc69230538a1b72b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785738794, "uuid": "1d87ca2f-3d46-40e0-a043-9dd703f069fd", "value": "1536:6xoG6KpY6Qi3yj2wyq4HwiMO10HVLCJRpsWr6cdaWPBJYYT77JR:IenkyfPAwiMq0RqRfbaWZJYYTxR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785738794, "uuid": "84e1d476-7ca4-410c-8d66-e45c16b1a5c6", "value": 83184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785738794, "uuid": "a50ae69a-736f-41ad-9feb-125f6ffc350a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785738794, "uuid": "2b3841a0-3ad9-4f3a-b7e8-83429a78e7f5", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81e7e60f-8ed2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785717019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785717019, "uuid": "bb1c828e-8e72-4f47-bf7d-40fe205b12d5", "comment": "Malware payload (Mirai)", "value": "9ce987f55bf2af048348022a7c2a9a17", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785717019, "uuid": "788aa109-e3ad-4cee-be25-c65038ecb327", "comment": "Malware payload (Mirai)", "value": "42496537fd1dd885373c5a0b513e17965aee0302816527907a7c9c0967029873", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785717019, "uuid": "9798037b-2714-446f-b276-ab21054fff34", "comment": "Malware payload (Mirai)", "value": "e956f68a202f118c84233562d24984790a1bbbf2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785717019, "uuid": "81d4dec4-d784-4b77-ba57-9801b675db5f", "comment": "Malware payload (Mirai)", "value": "beadf891051873100ed5cc98dce5117063e9bc3c2dd6d85b446f8b5371ecbd4524fa35bb3b0d05ca8e2cdd31a55ac6bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785717019, "uuid": "e66f4d9c-e0e2-46a1-92e2-6d37f3792693", "value": "T117632965BC819F1AC1D5167BFF1E838C332623A8E3DA7113DE1A6F6537CB51A0E2A141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785717019, "uuid": "4253320e-50f5-4b3e-aa38-963d73ebe33b", "value": "1536:VszjECNeiyj+LWdU+GtMh7Q/tvvsQsvbnRY6GZcGoFXEo3RBFq:VszjECciq+p/tMpQVvvsQcnZIFoFXEgR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785717019, "uuid": "016e27d0-1a8e-4bdb-9aea-8126e8d6e600", "value": 71140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785717019, "uuid": "39c2e558-d230-4877-a2f5-c72277062101", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785717019, "uuid": "02a29895-bc72-4f47-b8e7-6203d57e5c58", "value": "Qtj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a6b4527-8f11-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785744092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785744092, "uuid": "d0764f8b-6ffb-4d6d-bcf4-1fc5a9a03b6c", "comment": "Malware payload", "value": "e36611e2fc7098b97245156b56c3e5f3", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785744092, "uuid": "4ff5362a-2a04-4d8d-b828-4395077d968a", "comment": "Malware payload", "value": "42933b3047117a172ee0371e9946ff2d5d7c4ec67dbb26bc730c5c2858caf5ed", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785744092, "uuid": "b9b83bb5-f235-4ecb-888c-cd02622407d7", "comment": "Malware payload", "value": "ebcd713d4fe47f0a0bd19b05e90b7b661b2a0f5b", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785744092, "uuid": "50f96921-df3a-4e2b-9c9e-cd1a24fa9bbc", "comment": "Malware payload", "value": "fcffaf6c7e1b60826cad8646f3bac2ff5017040565b9bbc56b2a763f8fa2ce06bbfb63a47813cb273c46154e7bfd6dd7", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785744092, "uuid": "514941c2-0fcb-49a7-98da-2dd8b8d0d4ad", "value": "T1F051DFB857E40215FAF75A37E97EA001F671B81A7811ED4948C501DE54B2A087A9733F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785744092, "uuid": "7a435dba-a28e-4674-801d-ec53062511ca", "value": "24:8lvQCx3DZI6098b8cCXn68NqCUx4I0wVmOV4I0bbRhz/CXG:8lvQIFcib8c6n1NqCUOImOqI2RhO2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785744092, "uuid": "4aa6be99-205a-4e3b-a110-e8721b52feec", "value": 2735, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785744092, "uuid": "cfc63794-ed57-4e56-b4d2-ab1b9a9b438d", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785744092, "uuid": "15e86d65-e615-4a10-bbb7-2620105281b7", "value": "photov_798543304791.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd8bfb76-8f2d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785756230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756230, "uuid": "89da907a-e779-4486-8a9a-d57e55a04b24", "comment": "Malware payload", "value": "d484d20b387b4311e909cc5f71d27a45", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756230, "uuid": "b32e69a8-25e6-43b5-889a-7f71b34cb4f4", "comment": "Malware payload", "value": "433e1c94b455406da531f30595696b564d1a2f720ef808eb3cc7f7e9b1c6b0ca", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756230, "uuid": "f7b5bcd0-1808-4c21-8837-167025702f80", "comment": "Malware payload", "value": "3516e2255dab927ddb98e567f2f4191b9f3b858b", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756230, "uuid": "dbebd442-f29a-4b5b-89ad-fa12a930f46e", "comment": "Malware payload", "value": "8be4921e0409e74b58f132bb26f33591d75ca43d1eadc98b73ec0dce8e9cb80a902ab60eefbde9683d9feae51ced058c", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756230, "uuid": "e0701307-af53-4098-9b56-adcf37afb40d", "value": "T1B3123BC8CD0489E08EB5F976814A2E7868A1EC6E25667D994AC7C9450DDC48BCF8336A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756230, "uuid": "4b263d39-fef1-4c59-8dad-a881e1a552eb", "value": "96:FVYj9rdEyRCN6yWPdd1y7TFFrltvnFZlnXyCGoV:HYjldEyRCN6yWPA5nXbGw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785756230, "uuid": "fd9ef4b8-9cd0-4f6c-a855-15dd9685e676", "value": 9381, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785756230, "uuid": "af15625f-4df5-4bb3-9d69-655e840fbc3f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756230, "uuid": "0de60431-fb2a-46aa-aef2-c9f7c01885e6", "value": "PO-0001334282.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d105a75-8ed9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785720018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785720018, "uuid": "4926f7b6-8c13-486e-9b96-3b383edd9e87", "comment": "Malware payload (Mirai)", "value": "4dce131015e855a98ab4a0a2adfd5ed5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785720018, "uuid": "ca7ebfcd-8e00-4a39-aade-d3708a3d6ca4", "comment": "Malware payload (Mirai)", "value": "443f9eafda59dc44d6da1c0d0363e02d3cee019405c872676ba45e11c03b39e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785720018, "uuid": "cee55f30-be77-4025-a02c-a4e0771564d0", "comment": "Malware payload (Mirai)", "value": "fde78486dcb9fb810b79cb667113906e69309f1f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785720018, "uuid": "8d7e32aa-5760-47cb-9107-7d8882ad2f00", "comment": "Malware payload (Mirai)", "value": "1a92bab364a5da294f3c963c832fed0d39fe9759a1833dce5c2b0d811e6df344e4bfe53518a55ed8ceb1e069e18d1278", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785720018, "uuid": "4f1477fa-bca2-44f8-8682-428a2191b407", "value": "T18BB3AF32D41568E4C15E4578B9E4BE7D0BA3E08052A31EF71AFAC5B29457EE8F805BF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785720018, "uuid": "a6c5ceda-5948-4267-987f-e353bce865dd", "value": "1536:4/KNSYcgiWv/jo/bICvRirenKXBz17Ykm0B9Crv1VV5oHV:4yNS7/E/EECwrZXDtm0B9mXzoHV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785720018, "uuid": "fb082def-53f4-4092-9631-10707b0d1882", "value": 109800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785720018, "uuid": "a4c31ee7-8ffb-4f88-b639-4b4ccce23670", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785720018, "uuid": "4c1fa90e-320f-4e30-a2b1-44fd462325bb", "value": "nz.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "720ba262-8f07-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785739756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785739756, "uuid": "b6fee327-9304-4549-923e-a0b0a8630d3d", "comment": "Malware payload", "value": "062c66bbd1fa5bd0e085a85e185a58bd", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785739756, "uuid": "ffc37618-cc34-4523-8675-0288ba2b8603", "comment": "Malware payload", "value": "44ab4d3946237c4af43adfe4aeb7bc1a486d901a4255868fc4eb8eba8f54c4ac", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785739756, "uuid": "f8b56c77-1695-426d-98fc-45a02b427df7", "comment": "Malware payload", "value": "44349e6c217522951cdcf88fbefd0a02b53cc754", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785739756, "uuid": "44f36bd0-9e5e-4e7c-9120-1e5cb32875a6", "comment": "Malware payload", "value": "81c4fd892d0d9563be88cfdcdb87d1d18db2fcd89e2e39633f807c977db3bfaeb39c4fea5345e9ee64a81e81441788b1", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785739756, "uuid": "2ff4cf6c-ddf9-4df5-aec4-8806adfba69f", "value": "T1E131F99689D49571F55781385360D5600E3915740E2CB0AB8FC58C5678332CA6B5A625", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785739756, "uuid": "52bab0a8-0669-43b6-a719-62f7f53150af", "value": "48:9cI8Tl0Li8B76Gf4HTXJTVLvDivFL03vV:u/0OECJhroMV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785739756, "uuid": "63b6ecd5-ec9d-4759-b6b5-c32daa920561", "value": 1570, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785739756, "uuid": "0e9d6250-94bc-4b3e-bfac-e5d1b5963042", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785739756, "uuid": "ff46fde2-8059-4e8c-b3b3-7b67cc1499ed", "value": "photov_774815578701.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad027826-8f5d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785776792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785776792, "uuid": "4917c20f-6f26-404e-bdf8-7aaaf96c57f3", "comment": "Malware payload (Mirai)", "value": "cb128b3db574dc3d380852d71fbdecff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785776792, "uuid": "38563a74-c3a7-4259-9c61-292f558cfc9f", "comment": "Malware payload (Mirai)", "value": "45dfcd594bb62bef5ca1edbc9a84ae9bda7069360e34545d8a2bc0ec272a505d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785776792, "uuid": "5eddf48c-3d01-4f30-bbc7-b957f2b6d86f", "comment": "Malware payload (Mirai)", "value": "71a8a1588c2d5dfb0f837f2c96ac216bf8bec572", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785776792, "uuid": "fcad8250-0601-4b68-a477-0c03925d340a", "comment": "Malware payload (Mirai)", "value": "97fd9681874a87f34bbbf3f45e67471f139cb73cb4ecd1dfe2629e91f01d7fe06d5472ddd28a47d584d51eb4198d9632", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785776792, "uuid": "09d0ec5a-6a53-44e0-a1a0-9a11c84f59b0", "value": "T151044BC7FC00D9BEF80BF77B04170915B630B7A210925B336257796BEC3A1991967E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785776792, "uuid": "79fa82c5-5019-454f-b14f-bc203294e3c7", "value": "3072:3eLoU2OjM2SMb7ylEy6f8BD16SVvqrIFbTxVojbiaLrF+z44uh/Fg9eo:OLoW3beey6EBD16+vqubTULrot9eo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785776792, "uuid": "fddd4bbb-90b8-41ab-8016-b01360adb63f", "value": 186872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785776792, "uuid": "49bbc5c6-e381-49cb-a947-c1f7825de431", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785776792, "uuid": "25d47c38-768a-40b9-a2da-eec07947c1ba", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71bf0c1f-8f22-11f1-bd95-42010a9c0009", "comment": "Malware payload (DDoSAgent)", "timestamp": 1785751352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785751352, "uuid": "229ac2bf-1969-4a3f-bbde-bfb826ece0f6", "comment": "Malware payload (DDoSAgent)", "value": "fbf8bf6af952052b8da17852f45ba4de", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785751352, "uuid": "231d7b0b-a3f8-469d-842b-3d93c2128858", "comment": "Malware payload (DDoSAgent)", "value": "4777f57b2d2ecf0ae45e0eb96a620eac4c072a86a767005fd2e328b3030a285f", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785751352, "uuid": "9736ca32-088a-4199-ac13-b89e8f1b72d6", "comment": "Malware payload (DDoSAgent)", "value": "f6b03e90533208ab7f745baf9799eeb87b76143d", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785751352, "uuid": "1f5d3663-3f10-4fb8-9d72-2b01828544bb", "comment": "Malware payload (DDoSAgent)", "value": "d832d9aa7f13dc4222fd0bc278081ca6647a6410a52f31008ee000767221c99ec73023910ff6ac2ae4073e5c911b3c55", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785751352, "uuid": "3ce58dc7-f41b-41e5-8eae-698d4da433ba", "value": "T120664A47F8A115E8C5AED634C6639263BA717C494B3127D72F50F3282F72BD0AAB9740", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785751352, "uuid": "6c7e4a02-949e-4b4b-8a8f-0e10f1c4dcc7", "value": "49152:Z89lNVwm/OUUzL8WQXU8mO59Z3wEITPEg6xWT2J3be+dJNK3zYoQA5EYieLTmZAB:q9b/7UXdQW4Z3wVTPjIlJsLEYFelXHW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785751352, "uuid": "1bb59c85-4aa3-495d-96e6-92169510eb73", "value": 6983832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785751352, "uuid": "287c0a85-8d7d-40a1-bb2f-b764ba22a99e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785751352, "uuid": "f2ef7ccc-f4c7-4590-bfca-6b0decef8561", "value": "bot.linux_amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d31ce676-8f39-11f1-bd95-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1785761394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785761394, "uuid": "aaf8198c-e497-47c6-9682-0efded4f37e2", "comment": "Malware payload (ValleyRAT)", "value": "b2ebd74499b6725e146187075d00008b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sa", "colour": "#E6B81E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785761394, "uuid": "7a175606-7fa5-48aa-8df8-5f9ff5b230f0", "comment": "Malware payload (ValleyRAT)", "value": "47fee9267fb82c1457a560624110062b7a3cf9457b038e6ab85b1476112c0ceb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sa", "colour": "#E6B81E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785761394, "uuid": "43d5a3ef-2083-4b3a-9d09-ea6d42258233", "comment": "Malware payload (ValleyRAT)", "value": "e47b804f644376bfbf4b5b23a6e6b9189ee6e3c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sa", "colour": "#E6B81E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785761394, "uuid": "01bce16e-8707-414e-8f3c-adf5aed9b6c6", "comment": "Malware payload (ValleyRAT)", "value": "91305d2c62a626b5e7344e0f700e30045f85f2d7fa6c5951c528355facbf5d374b84eae46fdd14a5225ad8c37a6975a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sa", "colour": "#E6B81E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785761394, "uuid": "a46c66dd-d6c6-433d-b168-a0ef7d3b8e5b", "value": "T112D633429F49EC8BC5B2183BECBECC451EF65C191529EB32CD26FBA15172126E933358", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785761394, "uuid": "ef6297f9-eb9e-4b2a-987d-953270ec8c4e", "value": "52389d1a831c842049afb271517f0e4f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785761394, "uuid": "f5378f00-32e4-418f-b80c-5ccaa82a6c6a", "value": "196608:9BI9mZY0xjpOHmhEMfOLNiATxbcNARoRR3Z51hLCERHLCNKsjFF3OWTZw1zuvQbk:40jxj30LNV6RR3ZNLCEh+jFAke8obk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785761394, "uuid": "b8528615-3647-43a0-84a4-7e7a976848ef", "value": 13272159, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785761394, "uuid": "f453d679-29bd-4029-be9d-568781bfc0bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785761394, "uuid": "22abc224-178b-45e3-bb7e-0610e03c2044", "value": "tt\u9632\u95ed\u9ea6 \u4e0d\u53ef\u4ee5\u8df3\u9ea6 (2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54c4c3cb-8f00-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785736701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785736701, "uuid": "a32ed852-7f0f-4cf0-8114-76dfcb28bd08", "comment": "Malware payload", "value": "12e2b94bfc720bff3086330d7aca792f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785736701, "uuid": "76951801-6f5b-4a67-8b6d-f149d893bcdb", "comment": "Malware payload", "value": "48c4ed98b0a197da7bff704de8b25ad17a61868f63e0fe8ff92baad52a0828d5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785736701, "uuid": "0c6de5c6-c343-43db-891a-9087c74dc4d5", "comment": "Malware payload", "value": "70731c5ea64e69f4a8ddafc5377a9efef9856a01", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785736701, "uuid": "165cea1f-4be2-410c-bc32-36f3b2448cc1", "comment": "Malware payload", "value": "5141f31ac7f38d1b13902ddc5ab8d0ed6b4ec448569ff1c727ed578e0b2f87594ac15b14d6fedbe052f5111f27d2a28a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785736701, "uuid": "5bd8e94d-e3da-4893-bca4-8f3c6e1a64e9", "value": "T14C018CD68900AD10502ADA5D72D76190B411C3CF454B0B687FDC5D39FB98914B077FE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785736701, "uuid": "58b19c62-6041-40ed-82d4-939f1fdae062", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkaANFCAJDjkRFC2/bSCaRCwkxCsCZ0auD:kXCKysE2hi0ziQvZoha0FhARFv/upSF7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785736701, "uuid": "11dcd443-6ae6-4419-ac69-5e848ac6eedd", "value": 835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785736701, "uuid": "2351a1ba-aa22-447f-a1ed-871b49cd8a15", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785736701, "uuid": "c2fe9b78-a5e6-4d29-a047-25f006613485", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6fffbc3-8f87-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785794928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785794928, "uuid": "00b4c072-38f2-4948-bb48-0de9e554e997", "comment": "Malware payload (Mirai)", "value": "36588e7f9d0ffa1b1ef58d7d5acc74c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785794928, "uuid": "c45bda39-b721-429a-b29e-e9d984f8eabc", "comment": "Malware payload (Mirai)", "value": "48eb68c0d94d2aeb3a36f7fdaf776fd771a80582d2d6355d784d9154f6722dfa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785794928, "uuid": "e990766d-44af-435e-b774-eb131e8dec2b", "comment": "Malware payload (Mirai)", "value": "53db239dd5bf7fdee0efcb4b44e398a7566c39d7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785794928, "uuid": "88acdfd5-7d90-4bee-a3ee-aa3604354559", "comment": "Malware payload (Mirai)", "value": "78e8d2983b618c02c447ade5fb50822358047087907dae2ba19134f397c4ec25f9b9e022c7ce1cdfb0fc9ec4f9aa8f43", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785794928, "uuid": "3f85a7b8-ed9a-4eaa-bc61-cb72f80e13fa", "value": "T17A143B85FC40AB26C6C622B7FB5F428D372A5798D3EA3203D9241B64378B95F0E37645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785794928, "uuid": "591daced-a24f-437f-b986-821de5bc2de8", "value": "3072:xLGSNxTWSe/r4Bjk5FleSA3v8DW4KagboNCKRWe4C6UOoLRXbeu:xLGwTocilRkMW4KzboNhRW3PUvLFbP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785794928, "uuid": "520d208e-e00c-4236-b409-72d64beb4bec", "value": 197984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785794928, "uuid": "1172099e-6bbe-4ab9-b623-4df353f11497", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785794928, "uuid": "c4f2a6c1-38f2-4cde-ae02-c70144e4f3a7", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "492881b9-8f07-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1785739688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785739688, "uuid": "6133fa93-9221-4dfd-a1b1-a65e9feb40af", "comment": "Malware payload (ConnectWise)", "value": "2e74d93ffc6ce6e3e9b13b482246b0e0", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785739688, "uuid": "6fe14168-2400-4d3f-9461-48eb295f4cf6", "comment": "Malware payload (ConnectWise)", "value": "490bafa762d08b68c7e82cced00deb7a699ab7d8995d8aa5ebe5cf84b07ba694", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785739688, "uuid": "9b85bd85-b3b7-4d10-8c5c-6ba545040c01", "comment": "Malware payload (ConnectWise)", "value": "67f139ae7ef2d4076a730683e68d942efd8d4e57", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785739688, "uuid": "5a79e963-272d-401a-b9ee-236dffbe6d17", "comment": "Malware payload (ConnectWise)", "value": "71c5a8b74f2a333a2b64688f56890ef25e6579dc2b91fba0a661ff684fada3caea4994ee68b8afa1deae09de5fbf0db9", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785739688, "uuid": "ae5793b3-924a-4297-8e43-1ff0a467abe0", "value": "T17E646C11B9C48432C673383107B4E2B28DBDB8302D655B8F57A81D7A9F745D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785739688, "uuid": "eafe151c-6f97-45b0-bd57-2f86de190d45", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785739688, "uuid": "e9013a93-94c3-49ae-8061-e877800e4d84", "value": "6144:ymlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFti9FT:R1iw7gryNkSV1hy1Z1u2JLI9l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785739688, "uuid": "2a613c6d-9806-490e-8f1f-12bbfacf8c3a", "value": 312576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785739688, "uuid": "604112a0-8ca3-492f-b9a9-50f3df93c00f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785739688, "uuid": "ed45e1d3-14cf-472d-8701-d2ca193f2bc3", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0216c8ab-8ed7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785718952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785718952, "uuid": "d7556d3f-c2bc-4478-91de-692961496d14", "comment": "Malware payload (Mirai)", "value": "bf077e4bba64c807686980efcad7b4b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785718952, "uuid": "9c517b88-24e8-40b3-b66d-57385a5a7a25", "comment": "Malware payload (Mirai)", "value": "4d8329523495fd8ff834bd5ec68964ca7eb896010abcebb4238dff3900d7f63b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785718952, "uuid": "a17198ee-1bd3-46f0-8850-620c1e2363d5", "comment": "Malware payload (Mirai)", "value": "45c49a97ab3971468aedd0dfa11359df98693173", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785718952, "uuid": "fcecae5f-b390-4215-9a19-534f78f0c9cb", "comment": "Malware payload (Mirai)", "value": "6e40d8d63dfd3297bcf4ca497e5c382ef2bbcc79947a5e27d56dd3135d5d1b5c7f5424429e5c4f7130240fba76321ea3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785718952, "uuid": "4e97faf8-a562-4b8d-b363-1035d7ec5fbc", "value": "T194B35AC5E247D0F9D91209302276FB375E76E1BB1329DA83D7F49A32AC12AC1D4167AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785718952, "uuid": "6514272c-6e4f-4f36-9c03-2c10e172513c", "value": "3072:ONyJqCDagG4/4NRWFR7+66Ul8zDs3SUBN1H0CFB3:ayJqCiq4NRGR7RzQw1H0CFB3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785718952, "uuid": "1823dd1f-3d85-4be3-856e-506ee7d5ad2c", "value": 115988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785718952, "uuid": "de131f50-42c2-4135-9a35-ebd72efd7396", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785718952, "uuid": "be660fe3-f5bd-4492-b78f-ef0f122ef0ec", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d221adee-8f6f-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1785784585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785784585, "uuid": "3565cbba-7b1c-4d2e-b8de-fab26a390154", "comment": "Malware payload (WannaCry)", "value": "6f94ed80916bae7f55aa85debcdcee85", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785784585, "uuid": "4323cf5e-ddbb-4438-9713-d9ab1266cec4", "comment": "Malware payload (WannaCry)", "value": "4e788a167c4ad00064776a6f1c45b8c29c9012ce6e01ebf39b861cf842666473", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785784585, "uuid": "d6c52dac-2df5-4a0e-8438-a0530fe7ce5d", "comment": "Malware payload (WannaCry)", "value": "a85c22a34b8b2092bfbc6cc73abb9bb3ee17273e", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785784585, "uuid": "219b1a6d-28df-47d7-a9e6-6dfe09415947", "comment": "Malware payload (WannaCry)", "value": "9901edc1132917f7f332257454c209fe590033cdb5fdbaf2e9437cf240aaccae7032e87040f5886b934dc1e525724f4f", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785784585, "uuid": "dbd6642f-d1eb-4cb4-b3d4-a8e2769c2db5", "value": "T19836235932A8C0B8C003157444F7CE62F2B3BC6A27F95A0F7B544A7E2E63791E725B52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785784585, "uuid": "f426fb9c-46bb-44b9-a9ee-1e3746309796", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785784585, "uuid": "87c998ac-39b6-444a-a7dc-563307996d01", "value": "49152:jnsn8EM2UacBVQej/1INRx+TSqTwHkQo6SAARdhnv:DM8lfBhz1aRxcSUak36SAEdhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785784585, "uuid": "32ac605d-4875-4603-8699-399fc25152c2", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785784585, "uuid": "d23d7a1f-2b34-46db-a440-f8f34cd1db2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785784585, "uuid": "ae9bf53f-2b8f-4b63-b37c-f537b513ac6b", "value": "4e788a167c4ad00064776a6f1c45b8c29c9012ce6e01ebf39b861cf842666473", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdd66fe6-8f63-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785779424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785779424, "uuid": "6b70715e-0378-4164-aaf8-d76a721d5f8e", "comment": "Malware payload (Mirai)", "value": "d767b96d5742c1ddcb55dee832168711", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785779424, "uuid": "468620f3-1051-40a9-88b9-5e81fc6538b2", "comment": "Malware payload (Mirai)", "value": "4f162ee65d2ade2b7c2c5049190473f0e0a3f1f61e7e28cc58af95a09ae6737c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785779424, "uuid": "d8cccc4e-1662-41fe-b517-5d9a19805d0e", "comment": "Malware payload (Mirai)", "value": "f41201ee33c529464bdfc64abf44f6c2545fbfe7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785779424, "uuid": "e0545aa6-ec2c-4b0d-ab2c-4464fe78fbc6", "comment": "Malware payload (Mirai)", "value": "2a850c03382cc55cc4cb28d482b189c45382fe93113032128dfb7bfcc30af7ff7bb7a3ac3ed396eed457eb1475fedc15", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785779424, "uuid": "4a04e05f-9876-4830-890d-7f7fe9c0af96", "value": "T19AA35B26B834192BC4D4A47A22F74722F5F647D925A8861F7EB20D8FBF306403653BB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785779424, "uuid": "cca4d9b5-2596-4f00-baea-c0327be00649", "value": "1536:a7ZplgBBGSbrmrOHTvOO0Re+lbOZz30U7eFe0glM5RD/QPDqt0boD:7brm5zNON30rFeRl8BkoD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785779424, "uuid": "bcd3e690-68f9-4f1d-bfc1-1f9ed8151be1", "value": 100176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785779424, "uuid": "f3840d2d-95e4-4ab8-bfb9-8e19e99b021e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785779424, "uuid": "8ca493ec-d934-4aa0-87b7-e6c3d5611bce", "value": "lkxstress.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee92faf0-8f3e-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1785763587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785763587, "uuid": "d52bd723-6e78-4a27-8d89-db35f4e94b4b", "comment": "Malware payload (RemcosRAT)", "value": "19e74ab173fd36e23ea4f3749f355fe9", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785763587, "uuid": "6c0825f4-e7d0-4b11-8ced-597f004f7372", "comment": "Malware payload (RemcosRAT)", "value": "4fc76388750726065c5a0379b68327f38da529edbc603e36401063ca138f0b41", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785763587, "uuid": "d09a5975-23d1-4bf8-9e5d-1ac169798964", "comment": "Malware payload (RemcosRAT)", "value": "b78af51bf4ef893099869529503861bde017952b", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785763587, "uuid": "465cf225-7931-470e-a9ac-9cf22d758da7", "comment": "Malware payload (RemcosRAT)", "value": "5d9c4c83723e14e5983802b0a99082ed104a0006cc2fb8cf417f0d03a10fc1c6765897b9383e6919aeda2e1df8de6b00", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785763587, "uuid": "e60ecd57-a0d7-4874-8336-dfbf00140c3f", "value": "T1F662233D8E74FC949B6BB6F6090A62774A48CF7F45251E0DF85C08723316928CAA874A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785763587, "uuid": "0a7857c1-d357-40a0-88c2-869d4fb6dc7a", "value": "96:rPctwCQcjQwCn+gBaqZaqnyccTcEwCTc1:rPtCQICnS325OyCTa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785763587, "uuid": "543aca31-76e7-4a7c-bb5b-18c8b29e42d6", "value": 14625, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785763587, "uuid": "fb32514d-9146-4ac4-b0c1-b61899f54890", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785763587, "uuid": "5881c642-aaf3-4604-8d06-c0161ba8247e", "value": "verygoodthingsarecomingentiretimeforbest.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f48182c0-8f93-11f1-bd95-42010a9c0009", "comment": "Malware payload (NanoCore)", "timestamp": 1785800105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785800105, "uuid": "9aca7910-d186-4ea0-80f0-78015b0e3611", "comment": "Malware payload (NanoCore)", "value": "77f1e3ac2b75501d87191d8af820c8bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785800105, "uuid": "8aef4f3c-4f20-4767-9997-e81a5b9fb25b", "comment": "Malware payload (NanoCore)", "value": "50c73ca933a5d95e73a74b83d62084c85ad3f8acd39af2d218763a9270825dc2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785800105, "uuid": "271f0298-fe34-44e7-afa2-4ef29c8135b2", "comment": "Malware payload (NanoCore)", "value": "2a48db509ba0284448c911b87e6b4768bb152b22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785800105, "uuid": "c3fe82d2-ee55-4f47-98c8-5cd111fafa21", "comment": "Malware payload (NanoCore)", "value": "c0502275c3a1a4e481698aa21bee5a699708bb3432d769e0a4aa0087a7f47dd74a53c9fb3769a23fb0fc321f32267439", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785800105, "uuid": "f9367ad2-099e-41f3-8b00-29ce185b2b6b", "value": "T1CE14CF6637A88A3FD2DF8679611202538379C2E799C3F3DA28D455B78B227E10B171D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785800105, "uuid": "1780e9cc-705f-4167-91ee-0610b9914f4d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785800105, "uuid": "17f31877-d9ae-45db-870a-db3ac2e1e97f", "value": "6144:MLV6Bta6dtJmakIM5sNLiVdjyTMyIdWufA:MLV6BtpmkpkjyIfMu4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785800105, "uuid": "46efc1c1-f853-415f-8f3c-44fae3a2c2c3", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785800105, "uuid": "15656da5-5860-4a77-98ed-afce5ad1c274", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785800105, "uuid": "32981635-56a4-4238-9186-d1a1ec8a021b", "value": "77F1E3AC2B75501D87191D8AF820C8BF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de77316c-8f87-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785794914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785794914, "uuid": "bebd74d6-d1b4-41ee-b511-ac42c8c3303d", "comment": "Malware payload (Mirai)", "value": "6892f99faa2fd2b4df54110b05f116ef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785794914, "uuid": "37002a29-ca4e-4de9-9e93-c03b9e4b79b7", "comment": "Malware payload (Mirai)", "value": "51a1dfb301d5f2bde8a824ab3852677fdba245c43aa20b82ff71ac19c71fe2cb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785794914, "uuid": "4dae0040-f9ca-4b5a-958c-939bf39a9764", "comment": "Malware payload (Mirai)", "value": "3ab9292999adaa5e0204c11f151c23e08b013c32", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785794914, "uuid": "e1933bd8-6557-403d-b444-d55e12978a75", "comment": "Malware payload (Mirai)", "value": "2de5fbcd07b4df99df7aa9ec547e928ddbad20c627e93085713b4b194e0f11e932e84bae1dc2f6cd92318865f087d12e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785794914, "uuid": "4a4f24a4-d503-4ab1-8901-3ed1cc4c17c4", "value": "T11BD38EC1F143E5F1E85204B9126BD7369F33E176A136EA47E3785934EC62242E60A7BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785794914, "uuid": "2d3c5830-94bb-4d68-ba15-621449f05d71", "value": "3072:r365Bac7YaqDQlPi0Y5zkqeDn90yfeAQuSjj:O5Bac7YNhcTuKjQuO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785794914, "uuid": "2e69476f-04fe-4398-8812-99f32c6866fa", "value": 139576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785794914, "uuid": "db76daa7-ad84-44cd-b8ff-48280d54d5c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785794914, "uuid": "c23d41a8-2c0d-4e99-bc2b-46a10f621bee", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30286cde-8f0a-11f1-bd95-42010a9c0009", "comment": "Malware payload (GuLoader)", "timestamp": 1785740934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785740934, "uuid": "32149de2-6997-4ddc-8086-ece9502a4ec9", "comment": "Malware payload (GuLoader)", "value": "bf9be51077f45cffb4cce75496001622", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785740934, "uuid": "374eb9b7-200d-4163-a8b4-d0dbf927b95d", "comment": "Malware payload (GuLoader)", "value": "51c942f983332c2b50562d2631f1d3fdaa3006d43c37f5c7b68d2070bec35d9a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785740934, "uuid": "636d6233-845c-4277-b205-81d40acc7041", "comment": "Malware payload (GuLoader)", "value": "de1d1085a0c1355308ff6897e5ae130c29bea3a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785740934, "uuid": "87ed75d5-f08a-4d90-ba9b-fcc8e9528473", "comment": "Malware payload (GuLoader)", "value": "d6adaff8c61e2b9275ee1f36599521041a322174345791c5c672ffdbc4b48edf19bdc4ee051780242e531f008a73d10a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785740934, "uuid": "3e146af0-d4d5-4d69-887a-77dbc7e52075", "value": "T1CDC42311EBD0E8AAC4591432CE3353F2CAADBD61D32816D367403D89BE767839D2B785", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785740934, "uuid": "ca02ef57-7eb7-47f9-9253-e558ffd0a0b7", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785740934, "uuid": "03204d0e-9341-412d-8c35-5ccf552cee9b", "value": "12288:pfYPo/gfgMUCixJ3SscVcwSPqItJSfgpf6DtdzfW9K:pfYPo/cgIixJi9rwTpat9B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785740934, "uuid": "c49011ec-9ac7-4f46-951f-d350a5efee75", "value": 594248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785740934, "uuid": "fcb7246a-3f55-478d-bb93-2b7765fcd79c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785740934, "uuid": "eee309f7-bdf0-435d-9cd5-44b5d3b4bd7c", "value": "Factura venta.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a20d5253-8f2d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785756158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756158, "uuid": "ac6357c3-07ef-4dcb-bf27-4de541c542ba", "comment": "Malware payload", "value": "a96c5331271ec9d9c5ddfcd85b37d70f", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "reservphotoinstaynow-shop", "colour": "#DA98F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756158, "uuid": "b65afceb-3097-41aa-8fed-5a67e870cc35", "comment": "Malware payload", "value": "51d276434c6dcef938495d9b27f3ef6715598f8417c5eea050753a75f15f1305", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "reservphotoinstaynow-shop", "colour": "#DA98F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756158, "uuid": "26d98f23-6d23-41fc-9f90-f5144da32ebc", "comment": "Malware payload", "value": "fcf97e7f00e593f06bbc4cffa90de824ac206ed4", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "reservphotoinstaynow-shop", "colour": "#DA98F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756158, "uuid": "1eaca6fc-1d25-42a7-9a29-5e3c51fb142b", "comment": "Malware payload", "value": "210c9fd1ad403b0fbdaedb4b3868d5d75124343ea2d2ff6ded128cf903dc8e255e65fababd28f89d62f8fcdc90287ceb", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "reservphotoinstaynow-shop", "colour": "#DA98F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756158, "uuid": "e7f14006-0ca1-4586-bccd-227fee51f4f8", "value": "T1DAD42331EF22095A8F55822B80EFE85E63515F46940DB5EFE7CF84D10B98783AE4F468", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756158, "uuid": "958e09d5-9f2e-4697-994a-f63e4712e7de", "value": "12288:j3Rc52DepxZmfeWSB0fTl+1mARiff/Qd2op4YhgmrB5rSQ/pPoG:dc9pxZmGWSBeTl+BWHZKdWyoG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785756158, "uuid": "1bfa5ee1-e265-4c8b-904d-e2b175f616c2", "value": 647862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785756158, "uuid": "45f13902-97fd-459d-a5cc-8159149de4f7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756158, "uuid": "2cc09b67-2f95-44a5-948d-36f5d7e8c476", "value": "reservphotoinstaynow.shop.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a5bf0f2-8f3a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785761648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785761648, "uuid": "11d7078f-dcfb-494a-85bc-60321306311c", "comment": "Malware payload", "value": "9f48e16e62c80c48f35f0d4b29222036", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785761648, "uuid": "8f463184-2494-4f34-8b4e-90d775d6d1e3", "comment": "Malware payload", "value": "5204b96a9a12099748ecf5e64527cbadc0feb2967d2db3d5155b468133b00346", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785761648, "uuid": "046716d6-306e-4a67-97a8-c577406a9aa7", "comment": "Malware payload", "value": "e04a4203aee1a3443d60fd09a2d432e1f3c3fc9a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785761648, "uuid": "5d47d091-6695-4f9a-9f85-c389f7c531a7", "comment": "Malware payload", "value": "5cae3a159ddd4d00aaebeabbf1d0b322aae198ed7aa8abaeaba16ec82a349b5d6077a94e6f11cc26e2848c14a34a2940", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785761648, "uuid": "b7da2e26-aeca-44c3-ad42-002ec99b88df", "value": "T177C27D966A867C44BEC94A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C12F9CD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785761648, "uuid": "8567d556-e692-4d24-a0ee-b3ce266bf519", "value": "768:48vCB+25j6es8Rq9FYpMSUpi+20qUpi+20YQX:48l25Jcd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785761648, "uuid": "f02c94f4-c061-48ee-8633-db6969564ebb", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785761648, "uuid": "ad23a5e2-123f-4814-9119-a0975d8ee113", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785761648, "uuid": "dd1f25af-a37d-43f6-81f6-3e8557a060d4", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e785fb25-8f5d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785776890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785776890, "uuid": "77eed5c1-4c82-4452-a3df-0e42dd0e22cf", "comment": "Malware payload (Mirai)", "value": "329822228e142c266f04d54c5fd63f16", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785776890, "uuid": "56aa8946-5a39-4548-be23-ca8d3fbbffe9", "comment": "Malware payload (Mirai)", "value": "5411d557b2ad40f6b0b3ce68662897a98e54b4fc845a9c17dd9a347b43ee9388", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785776890, "uuid": "0efe1ecc-d2a6-4bef-964c-d66c57eabea7", "comment": "Malware payload (Mirai)", "value": "c58e69cebd20d950873d9dc381fdc64ac886c596", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785776890, "uuid": "dd863fda-abe4-4f72-a80e-3a7270fd2947", "comment": "Malware payload (Mirai)", "value": "a0313ba5ca211cabed56897e0500f3720bfc73fdf0865f4139aa113c45b6294e7ffbbedef75f632979a57b2df07b88d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785776890, "uuid": "91a5c06e-350a-4d61-9a58-dcfefddd46f5", "value": "T15DE38C73D8259E98C611D4B4B0388F751F13D1A982476FBA69F6C2B14483C8DF619BF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785776890, "uuid": "9e3ff4eb-93dd-44a5-a79d-f3f9a0fb1002", "value": "3072:JypSK/8jV5Qwtbx2OzCYyQ/WaqNozf6hh1kZ0f:J2SKaVtbx2OGyuaqGz+f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785776890, "uuid": "5118cdc0-afba-4f7c-a49f-9b60ae59f3ae", "value": 148664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785776890, "uuid": "263b7249-e8f7-4e59-9024-dabb312d3d45", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785776890, "uuid": "bf59a31c-8190-4bf7-bb21-6698df3e52a3", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8068cba-8f2d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785756221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756221, "uuid": "2b4ab48d-09d7-4a23-a222-e8f5279a3d87", "comment": "Malware payload", "value": "5de6b435a618beb3203bc262e561f9d8", "object_relation": "md5", "Tag": [ { "name": "dn-pdflite-lat", "colour": "#BE5FA0", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756221, "uuid": "732f8503-d7f7-466a-b352-539e027ab9a5", "comment": "Malware payload", "value": "5552e5b041c4ea66fb547b1d8ff3c2eca0358b87f25e3262aa8730826587b08b", "object_relation": "sha256", "Tag": [ { "name": "dn-pdflite-lat", "colour": "#BE5FA0", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756221, "uuid": "b5f74c2e-b2f0-47f5-ba1c-3ff196552b23", "comment": "Malware payload", "value": "fcc32b7571f64d3942934cd80135126eb9730fe3", "object_relation": "sha1", "Tag": [ { "name": "dn-pdflite-lat", "colour": "#BE5FA0", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756221, "uuid": "0dd38f6c-0db3-4804-866f-380b816cce4b", "comment": "Malware payload", "value": "afa83c07b688cce3b8c7940b589c607539a892845420508533ccdd160b5a9c1de046e0bd632dda0c786eba5565e38c27", "object_relation": "sha3-384", "Tag": [ { "name": "dn-pdflite-lat", "colour": "#BE5FA0", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756221, "uuid": "9592dd4e-1980-451f-855c-a7d5fe987580", "value": "T12223DCBBBB4B62D5FD3219BB177F604D20D826032291E1B9F54EEC01AF9464D84293D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756221, "uuid": "1a0b989e-9def-4f1a-83f2-327cbe59e383", "value": "96:5NLRwqdfnHSYKbAgW+mwF7YWktFM7O8d5R:Ptwq9nHSYdgl7Pxa8X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785756221, "uuid": "0d9e82b8-a667-4cf7-8433-1a294cca7f35", "value": 47104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785756221, "uuid": "a8536e8f-ad2a-4a05-97cb-a352637728b3", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756221, "uuid": "936ed5ba-49d1-4a6d-b23c-551eaf8213bd", "value": "LEITURA TAROT-KCH7GJ.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03e99d2f-8ef1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785730122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785730122, "uuid": "27201c51-815c-4c44-85ba-b170db547a87", "comment": "Malware payload (Mirai)", "value": "039f29e47ba73b09f3ebfcd0f666c8cb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785730122, "uuid": "b3c03cdf-02d8-473f-9fd0-e7eb9dd6ab13", "comment": "Malware payload (Mirai)", "value": "5631a8bec0425290ca8f34b1804334e9f9c110f07c05af808acc6ec994e82ad3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785730122, "uuid": "95a8317b-1511-451a-9dcf-2f45bc08d151", "comment": "Malware payload (Mirai)", "value": "5c4aaf60b6673077164edd81c2cbbb0fbf87cbb7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785730122, "uuid": "10874426-9d51-4941-89b3-f1fa12ef7cd4", "comment": "Malware payload (Mirai)", "value": "a321d0065747b11418217f68211488f2464ffec61f050385103f22475e4da177d76a58bf308a40f9686e601ccf80ce51", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785730122, "uuid": "470bbe16-76b6-4482-900f-73bd3ef070dd", "value": "T124D36DC9E783D0F6F9820471107BB7369771E2354136DA47C765A836EC62902E62B3BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785730122, "uuid": "763a1b0d-125e-4616-80dd-c6fea960c156", "value": "1536:ZA4rxcFcMqbAVP/7YXio+wt4D36xluoY3voUq/n7fp0cxSNyc:ZjFcFc9g6M6ioY3dqj/YH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785730122, "uuid": "961721da-108f-407f-bbd5-55faf60f455a", "value": 131988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785730122, "uuid": "0877a282-aee9-40f0-9861-ac6519608ec4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785730122, "uuid": "33abc5e1-26c4-44c1-9f15-6d5f10ddd58b", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "818de682-8f39-11f1-bd95-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1785761257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785761257, "uuid": "7101d414-411b-46b6-af81-617598e760f5", "comment": "Malware payload (ValleyRAT)", "value": "606f1310042c088ff67c9aa277d86ed0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785761257, "uuid": "9cfe7191-22c3-46aa-b9a1-87f8b905003a", "comment": "Malware payload (ValleyRAT)", "value": "564cac1227b0f75d4c48dd2ec1d36400058d6861094ec104f5e3084f4f46d242", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785761257, "uuid": "3b1531b9-cab5-4903-abbc-7e83e60e4f4a", "comment": "Malware payload (ValleyRAT)", "value": "336b46719d77722561eb5942ec1f8c5b418fa4f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785761257, "uuid": "a78785e0-f592-4994-93a5-9be6d1713362", "comment": "Malware payload (ValleyRAT)", "value": "ea6183633d6a28c99a01f82835ee405bcb3c5627c243cb2afad17c89a09d4d2b4aa8622121f5779b65676872a0a9c4de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785761257, "uuid": "1ff6f31f-33b9-4b65-a44a-e8e0c80474b6", "value": "T10FD57B3A9A6C03F9D4FB91F4E52D6267E12CB458533046C7278007E96B236D1AEB63C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785761257, "uuid": "1a286f6c-2106-40c4-a02d-b668ff1d4eca", "value": "4c9310f9eae240dd43fafc0ec9c61c79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785761257, "uuid": "d71f5822-6776-40a0-adf4-69cded883e6c", "value": "49152:MgVAhzs0NRT5oYt/Xb3oqJLlxqZOey8seyItrvktKqfUJZ8Hn:zAhYKBt/Xb3oqJLlxqZ5oxIdkgqfUDen", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785761257, "uuid": "626c33a1-dc0d-4215-81d0-e91566a6990f", "value": 2811984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785761257, "uuid": "7520130e-2b1c-4f35-a40a-6477a82ce47c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785761257, "uuid": "d61a8b28-4511-4925-8d73-508c2a7eadbf", "value": "2026.08.03\u88c1\u5458\u540d\u5355\u53ca\u8865\u507f\u65b9\u6848WPS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "703f1a3a-8edd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785721714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785721714, "uuid": "90aa1e70-c040-441c-afb1-1ad65f3483d3", "comment": "Malware payload", "value": "f4f8754aa9dcf8d062f9fe73b2f25a01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785721714, "uuid": "f5c12471-ce37-47ac-8879-b807b3cfce70", "comment": "Malware payload", "value": "565105c1ba3b1802e13798bd17e3a167e6ff4eadc19179028fa9627ab5fe708d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785721714, "uuid": "e80f8ca8-860a-4a3b-956b-3b13d4e8f911", "comment": "Malware payload", "value": "8c6c6a76359577941a6c0e412e06f8010dbb3b04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785721714, "uuid": "0d84093e-d69b-4ea2-840d-ab0122c53af2", "comment": "Malware payload", "value": "f5f82fd359a5524dae02916a8cdd73539731d275c92e4df3f9c623d82305350cd74c66d4d9ba71adc977e207401097b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785721714, "uuid": "6548368e-48de-4c78-98d4-479f87695796", "value": "T1BD2633AD34016A1EEA09E478D31D69E417234216CD083536CF6F93D764BF6CBAEB41A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785721714, "uuid": "d6ea1cfa-eaf7-47db-954c-b706ff407e33", "value": "1688a11aba03a74e45ff7fad63aea685", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785721714, "uuid": "b1ea6b29-a87b-49f6-8ca3-c70ddc1754b1", "value": "98304:KGaQ/xNNMmXbWwW5+n8Bw8WUj9xZyLYsuFrLYjwIdgNu/c:DaaCmXxE+nVPoxRwdgI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785721714, "uuid": "5dd7d1ae-4ef3-42b0-a23b-811dd7a2f5d1", "value": 4439552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785721714, "uuid": "8a5ea2e7-2bc0-497d-8bc8-d5c31fc031a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785721714, "uuid": "c3584e7f-dbaa-49d2-b2da-ff9a01267329", "value": "X-Force Essential Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71e6aed8-8f79-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785788718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785788718, "uuid": "67035b70-3fba-4429-970c-d095274fff26", "comment": "Malware payload", "value": "168e46785d7d8cd113e14aa47b191691", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785788718, "uuid": "576f4c16-4e9f-4b85-b1a1-fa13b45a9b35", "comment": "Malware payload", "value": "5668e0a9a56e051770f2074494c45db58b87202128525f1c468f55a4eee57117", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785788718, "uuid": "c5c4c3e8-4c09-4751-a767-07be3411dfbf", "comment": "Malware payload", "value": "7f62e6b0964b0d6352175e1cde8c9e04efa58282", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785788718, "uuid": "a5763909-989b-4e08-b3fa-2b101845c61c", "comment": "Malware payload", "value": "0107c1d7f30de654d6b68ccd2298309cf02adf3de75cf2063ba4f5dfce5140186fac5bc7ebdba0c5cdf6fadfcd6c3632", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785788718, "uuid": "ee6cca89-0adf-40b9-a4bd-d406bf7f5d02", "value": "T155C28D966A867C44BEC98A3E4CBD2B0D6DF5C3D1324942AC3D8B3C719C15F9CD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785788718, "uuid": "4296a492-b720-4216-b750-8a5c24e2ac91", "value": "768:I8vCB+25j6es8Ro9FYpMSUpi+20qUpi+20YQX:I8l25J+d2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785788718, "uuid": "b695a4a0-e531-4090-a058-09c4e0598526", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785788718, "uuid": "9ca764ad-5094-465c-aa8a-9a652a55e2e9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785788718, "uuid": "afcb563b-9ed8-46f2-9ccc-46b1073ea87d", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e00cd537-8ed6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785718895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785718895, "uuid": "3a58bc11-8f1a-4c86-aeeb-70ca9a83f2a0", "comment": "Malware payload (Mirai)", "value": "02b35dd0adb50524f54db3b8c39b9248", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785718895, "uuid": "e2afd3ba-b696-4c1f-8ce2-a49a10f74f8e", "comment": "Malware payload (Mirai)", "value": "56dae62fb116198deafa855c97074040505f57cff61fe012a096a50531ff4b34", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785718895, "uuid": "4f0c889f-d054-4af1-a0e9-3c36b5c95a00", "comment": "Malware payload (Mirai)", "value": "8e862cacf128efe6b77b9a8782c8dec10e728dc8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785718895, "uuid": "c22f8bd5-7333-4e23-a5f1-fd827631e696", "comment": "Malware payload (Mirai)", "value": "d6f434b3a9070c2a8a726a7c7761fee58006cc905f9a8904373dc0777cb9456c2352bb7b7787c7c0049827d6d7d6ee3b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785718895, "uuid": "52035725-9ef2-4dc2-927d-1a532c0a5304", "value": "T138245D46EA814E23C0D71779B6AF114A333297E4D3DB730699286FB43B8679E0E63705", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785718895, "uuid": "4d7f20da-7dc4-46a9-a141-90b4f0175d56", "value": "6144:CNCeEkM2ck+akkDDdYn4txaCGtLHueLavM/9Fs:CNCrkhck+akkDDdYn4DaHoNk/M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785718895, "uuid": "67d107f7-4bcd-44db-8e29-b669dcf68b2d", "value": 210518, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785718895, "uuid": "cb9f48c8-1725-4a5d-bc0b-e94c413d9345", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785718895, "uuid": "5276259b-c66b-4db0-a7a4-18e8498ac5bb", "value": "nz.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3ec28ef-8f2d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785756161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756161, "uuid": "3ea58f37-0dc3-42e0-a62f-a3c0f1d61b3c", "comment": "Malware payload", "value": "356039137ca6cc2048e60dcd405dbdef", "object_relation": "md5", "Tag": [ { "name": "dn-pdflite-lat", "colour": "#BE5FA0", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756161, "uuid": "a08de514-6ac1-46c5-865e-cfcdf469fa64", "comment": "Malware payload", "value": "58644f8ac6f3bec2ed8d6f46978dbb2b4a893d944399950100a18b24b44b75ac", "object_relation": "sha256", "Tag": [ { "name": "dn-pdflite-lat", "colour": "#BE5FA0", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756161, "uuid": "f6d92980-f9aa-4682-b87e-71b052bfdf45", "comment": "Malware payload", "value": "abe43e72da77ea66e5f01140270c18233fddf749", "object_relation": "sha1", "Tag": [ { "name": "dn-pdflite-lat", "colour": "#BE5FA0", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756161, "uuid": "fd10c09a-fcd2-43c1-8302-d49f2e60eade", "comment": "Malware payload", "value": "fe5219b5b8bc353638b1a2a34eb09d25a61497e899fa565688f27b89a8d6f7e5407a4960c41df08daba15a988dd195a0", "object_relation": "sha3-384", "Tag": [ { "name": "dn-pdflite-lat", "colour": "#BE5FA0", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756161, "uuid": "0a099b39-6648-40f7-9990-b44788cb59bb", "value": "T11A2301F7AA4A42C8FD318ABB1A2F109D10901A0253A6D1BCF39EDC11DF8DF9905783D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756161, "uuid": "03a0f06d-d7dc-48e6-9ebc-01a6c5ff4d35", "value": "48:5nYMohf3ZRwqfhCaT7FnE99sFk/RDmFX4WGGM2358knDN:5nYMoHRwsgq7ZEzsFkgt4WGGr3pR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785756161, "uuid": "52dcbca4-5691-49a3-ac14-5474767a0153", "value": 47104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785756161, "uuid": "681e2348-af73-45df-930c-ed1542c3e7b7", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756161, "uuid": "39457a23-f14a-42c8-9641-fa853b36b35a", "value": "Nota Fiscal Correio-LEBOEK.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31f89021-8f0a-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1785740937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785740937, "uuid": "a5352643-08fc-44dd-8117-ca7251604058", "comment": "Malware payload (AsyncRAT)", "value": "d7940fcb7b48f07a6949c7e3d91b0aab", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785740937, "uuid": "16845c38-cfba-4cfd-a440-f8992736d412", "comment": "Malware payload (AsyncRAT)", "value": "5b636ca0d5d324942c7ed1f8b194fa9d8ad64a8d77596e6fe36fcc4c2c2b1486", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785740937, "uuid": "241abd49-0c6a-4ef5-bbaa-f7b7cccba9a1", "comment": "Malware payload (AsyncRAT)", "value": "3961ce5c14da4ad32ae87426694d666656c81197", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785740937, "uuid": "b20fd25c-6b1d-4486-abce-3275da4077b2", "comment": "Malware payload (AsyncRAT)", "value": "05b78f4dbda0f57e1b1eb48293db2869a332342b9d4373d9e6a8ac8f248a907c89c4bcf8460ffc903d02999c04eedb7d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785740937, "uuid": "c4f4aac5-94c4-4efd-971b-02aaf02a6784", "value": "T1370512917195CB43E1A72BF459B6E57003B97E9EB921C10A8EE1BDDB3173B004E29363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785740937, "uuid": "e599ebbb-145f-4af2-9f10-4d1a80b1a6c5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785740937, "uuid": "48e3f868-5945-473c-946f-886a35ff545e", "value": "12288:qdq7uKEBaUr+3Onxr83sN+GYH1iKAkm3IPxm6/AeXYyjUlUyOeW+eQU7:qfnr++nhEGutSI5Cet2UUW+eZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785740937, "uuid": "fcbf0d8c-60ed-4570-9fd2-e458cfdea9ae", "value": 809472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785740937, "uuid": "4117c97c-54f3-4ec9-a840-1018cc3e600e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785740937, "uuid": "677e614c-79c9-46ff-8dc9-e3f702cc63de", "value": "Order no. 274419.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2826b9a-8f87-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785794920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785794920, "uuid": "f61b1839-ec04-4463-af59-c39da3762d6a", "comment": "Malware payload (Mirai)", "value": "0d3942c1b3ce9040afd3c43f5b2b6d71", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785794920, "uuid": "30527384-31d9-4178-9245-be0083174c8d", "comment": "Malware payload (Mirai)", "value": "5bcfc51337f994b6b8c31f35ac840a2628b359e315ef4a412a607611e95abcbf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785794920, "uuid": "cd03e42c-7329-480b-b7de-4a36933ff840", "comment": "Malware payload (Mirai)", "value": "71b2598d969eec7ef096874ade770be431bd3899", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785794920, "uuid": "d356ed73-2a88-4b2f-a7a0-9319651d324d", "comment": "Malware payload (Mirai)", "value": "9d55424886080df23a47f6949bd1d5cd9395ff6302d7e3525436b9b59617c4570f5a4ad3788c1cc9f32f88b84b70f32f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785794920, "uuid": "d69e1798-9e59-4bb0-95e1-c15dfc466a56", "value": "T1AE357C2EE2B2F16CE017C03417DFCAA15525B07926312D7B36C4AA353D6ADE16369B23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785794920, "uuid": "25d694fe-8895-4019-a416-6e13651b8daa", "value": "24576:mH+d6rkvq5GNgwUz3eeL6W/zELLjXSia:6+6F5GNgdzOCF/oL3X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785794920, "uuid": "15a1a27a-23b6-44c2-9ad8-bbaa152bb6e8", "value": 1074616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785794920, "uuid": "c6fb41f7-4b9f-4dd2-a289-263c8581368e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785794920, "uuid": "44f24542-c54c-4393-af31-2d0a03f3992c", "value": "dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8ff8147-8f5d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785776892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785776892, "uuid": "fae736ca-50cb-40d1-abba-9fed9025174e", "comment": "Malware payload (Mirai)", "value": "cfcfc5c2425116fc25fc63a94cbdd270", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785776892, "uuid": "48a4303d-db3b-4358-88d4-7e572a589b37", "comment": "Malware payload (Mirai)", "value": "5c6a6a316d1312eb966889f61f29eb75b6a7387c5bedb72ffe4a36a0a7f08a0e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785776892, "uuid": "0b02530b-b9f6-4443-b3bd-9f105b2c9c7c", "comment": "Malware payload (Mirai)", "value": "2fc66339c051fe4f5ea48f2bdd1a719ee8de532f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785776892, "uuid": "eeb3b199-c41f-4c51-9090-04789f16c85d", "comment": "Malware payload (Mirai)", "value": "78ea0b1f8866c7ca9f4d205747b3e69a59a61736b47740e8cc43a7a72a4bdf79675214dd630a55c52d5f052823e4775b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785776892, "uuid": "0ba166ec-f5cc-4b88-ba8e-bbb7dfde7bd6", "value": "T13053F1BD64973696CFD8703A688F67A1B858D8E173572B7073190CE0CAAC58DF89C078", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785776892, "uuid": "a3906c9e-753a-4fd4-a535-a7915902afd6", "value": "1536:r3ScpdAfPagnovtgU7tBOYVBYTA/xKNTMgXr:Oc/wn+tP7tBLBOAZKZZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785776892, "uuid": "9f4d349e-dc71-4a5c-9bcd-22fa292b85ac", "value": 64260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785776892, "uuid": "24150f6b-0132-44b1-afc4-cb114d01e75e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785776892, "uuid": "8fa051bf-c734-4e18-acc3-e2d562b1c56a", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e577736f-8f5d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785776886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785776886, "uuid": "ca5eb8ea-2075-408f-a4cd-e8f37c94cf5d", "comment": "Malware payload (Mirai)", "value": "116c710cc8b735b2036f57fdc6f2bc01", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785776886, "uuid": "5890dfb7-f5b8-474f-b021-b124aee256c1", "comment": "Malware payload (Mirai)", "value": "5c9170b6613b56562fb3ca05ee737cfd56343d3d65f751564a4bf3b2bb065d88", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785776886, "uuid": "e813e289-e8a1-4a04-b238-411031895b33", "comment": "Malware payload (Mirai)", "value": "d52a1fa402aac2d08687573e6a2d25adc4a10a69", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785776886, "uuid": "8bfc5b04-e28d-4358-914d-377816a1d7dc", "comment": "Malware payload (Mirai)", "value": "1a93d1c99392fa980e7cc4ff02d87f46741357b30753f78f89ac9650af608571671c0273ed872b6baaffc76f297a008d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785776886, "uuid": "b03c5fdd-41e2-4fa8-9ea1-7f8e9b873bc1", "value": "T14C5302B0C5AD70676C721EF3CF66888274EA13B4B2E5A05B04E420717DE3CA2499A9D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785776886, "uuid": "3f77923f-59e4-465b-87ba-f0d6ed7a5c34", "value": "1536:z5AAujqF933XVTI2CJ/ciIv2R69RXd26tJHXLs:g6QIY2RXdJtLs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785776886, "uuid": "ac580168-24b7-405e-8004-a2a7583ac3f2", "value": 62616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785776886, "uuid": "e48c7a29-c224-4302-9169-2feba24f364e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785776886, "uuid": "ede671e6-da12-4abe-b38b-265d3328e874", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95f6dd32-8f74-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785786632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785786632, "uuid": "be68ba60-7af7-498d-9f60-70543e06b154", "comment": "Malware payload (Mirai)", "value": "2d82f03a8a96c9bcc58d5d74e8f8b1d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785786632, "uuid": "5a379eea-dd6b-47e2-aca1-e6a445ec5f7f", "comment": "Malware payload (Mirai)", "value": "5d49e86f1753cc675267181e0c4ef7c51cc4b3fef31eef908bbb9f1706fd3848", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785786632, "uuid": "2e7d8a3b-92ad-43e4-a63d-669a12c07559", "comment": "Malware payload (Mirai)", "value": "6536be18df73705c25006a307749b64a16ae81ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785786632, "uuid": "487e5dcc-9d64-4bbb-a8c6-8ad78f4df886", "comment": "Malware payload (Mirai)", "value": "62fc2b03337bb798e3e405ae5d16f0a2d3a4a86da6ec793e1659f4a241f5d3af5671b6fe4fef962cdab1451741ea1ba8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785786632, "uuid": "596e724c-4d6b-4dfb-a592-29942c582554", "value": "T1A0042B80B841A932C5D09E3BFE0F018C3B199BDDE5DE7706CE285BE1768B4174D9A635", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785786632, "uuid": "d13720a2-aa03-44de-8fa1-01c6c646ea61", "value": "3072:hpt21fuH7OxFbHnY3OH8tLID85flTlCwIgdSAo/3svnVSjYVnQn:hpt219r43OH8tLIDABlbNSX/3sgfn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785786632, "uuid": "493cc29b-4c25-4ec8-b4a7-6d8003a67347", "value": 181424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785786632, "uuid": "b090f1be-2c52-4822-ab2e-2e74f3097ef0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785786632, "uuid": "050e77ee-cfac-402e-9f51-1321cf0fd902", "value": "tarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df357b38-8f87-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785794915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785794915, "uuid": "d63433b2-44b4-4dee-a73c-653a2f08b382", "comment": "Malware payload (Mirai)", "value": "03dba787cff08f3d16a58ad60e2a3b78", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785794915, "uuid": "d9406b1c-d6ed-4720-b2ba-fd060b45da59", "comment": "Malware payload (Mirai)", "value": "5db88833492ca317ff8e5ea576545876d74a3871169fd3d74b975e0f0a84a7a9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785794915, "uuid": "eb079b9a-943d-44cd-94d8-4994a91f036f", "comment": "Malware payload (Mirai)", "value": "1f9062e344157afa2bf1427130148011356013dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785794915, "uuid": "21339b39-6d57-4ce0-bc78-ec38b41e55a3", "comment": "Malware payload (Mirai)", "value": "9d6277e60a73a4fc166d07b16b1bb4a21160223f61bb1c8f8c0ae2b301e00b3f271660b6c36ae611fea8e24c34af66db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785794915, "uuid": "54681150-e55c-43fb-a8dc-1c9de5cf8732", "value": "T1DD247CD7F900DABDF80AE27A04570A05B130B79255930B377297787AFD3A199093BF86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785794915, "uuid": "f816e0ad-2e29-4066-8446-5e3e6c20fe4f", "value": "3072:OAKtU4zalAQrL/VcFR+d5rnYajivwd2Ja6V/jbidLULFvmkyhWg0hyZw:OAKC4zYrZuR+d5rnYVTJa/LULFyhZ0h7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785794915, "uuid": "b24cce76-1478-469a-b5b0-36e4668877db", "value": 223456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785794915, "uuid": "3e6ec900-d0a5-4b59-87ff-b0f6858aed3d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785794915, "uuid": "69e1e715-303d-46e4-9134-21473395a19d", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31eb8eca-8f16-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785746091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785746091, "uuid": "459accc5-f466-44eb-84b7-b3757901c17c", "comment": "Malware payload", "value": "ef6f7956fe20801bc4f2a41ea5b16367", "object_relation": "md5", "Tag": [ { "name": "424e51f31d68f573a4621aaede8044aa", "colour": "#51F4DD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785746091, "uuid": "4221c107-0207-4458-8c89-93b14c81fe8c", "comment": "Malware payload", "value": "5ec7d947edd27000fd124d2f09be065b9b81f003e69043ce490af92aacbdfb14", "object_relation": "sha256", "Tag": [ { "name": "424e51f31d68f573a4621aaede8044aa", "colour": "#51F4DD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785746091, "uuid": "e17502ce-15dd-4daf-930e-35ab424ff5d8", "comment": "Malware payload", "value": "0e9af43e29f608047b629bc6b7e6225e610fa5b4", "object_relation": "sha1", "Tag": [ { "name": "424e51f31d68f573a4621aaede8044aa", "colour": "#51F4DD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785746091, "uuid": "611768a7-1ea2-4de3-88f3-3417af3c249c", "comment": "Malware payload", "value": "bf4a433fe3d739af5dceaa532bf0564fc970ceb8bc3e7ab70ff9e1b512ee171d610cbc81a307346bf6c1c79bd4575db8", "object_relation": "sha3-384", "Tag": [ { "name": "424e51f31d68f573a4621aaede8044aa", "colour": "#51F4DD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785746091, "uuid": "71c686ab-0439-4281-bdef-a2e552c305fd", "value": "T122D523A87CF52471D476CBB68E93E07EB22A77864B708E8336CD36009C239845D75B79", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785746091, "uuid": "3ccceb1b-9f06-4dbb-8973-b511e6454bf1", "value": "f5bec796b7b3c2932293afa8281cdeed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785746091, "uuid": "7bce9e50-fe0e-412c-b9bf-141d9a71732f", "value": "49152:OLNkAw0HFEhxHsbdvq4hfSgFYzqzJ/OUMpGYwqulXAHewRsIYQDsP8FFLMj:1kEhxHsbVPtSg+2zsUqsVlXA+SrauL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785746091, "uuid": "cf40f1ae-979b-4152-bd01-42c9f639de12", "value": 2996224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785746091, "uuid": "020e7208-34d3-45f7-bc13-ddd28d6521dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785746091, "uuid": "2908a286-0bba-4852-a98a-b6e1e66cc325", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1aa7bde-8f77-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785787993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785787993, "uuid": "a04103ff-e4af-48bb-b75f-4611e83e6892", "comment": "Malware payload (Mirai)", "value": "134845f401c1d46462afbc100fb137ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785787993, "uuid": "6c3fdc49-8c86-469d-9a15-19ca02f1f74b", "comment": "Malware payload (Mirai)", "value": "5ec84242d4cffc1425063420bc31fad6f778e42743339a908e8bb38adc77e8bf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785787993, "uuid": "e36d2f40-dd2b-4461-89b7-eaf3f080ea2a", "comment": "Malware payload (Mirai)", "value": "626145ea1cab5ff0b5f80011105cff50a831f9ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785787993, "uuid": "ca70aa43-a653-44ff-bae1-7fd4bf60b99b", "comment": "Malware payload (Mirai)", "value": "c603da829dbe4d685eecef111fd0004d32cfcc25413974ea5cc2eec1436d74dfc4e3d15cab144c5755e304dd1fdc335f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785787993, "uuid": "c8c15801-9437-4352-8b4a-052c428d1c6a", "value": "T1AB858D56F6F364BCC097C430835FD753A935F4A911227E7B26849E302E66E705B2EB22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785787993, "uuid": "c27bdd0d-ab53-410f-9457-7cc33fc567bb", "value": "24576:jy2gmOCuJHfnuYMsPUZ4aJfe7FuA5PpFAluWdhuqzb8zIx0CL7:jy9mOxJHfuYYeqfe7FhPPAluWdhLgUx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785787993, "uuid": "90ef8a2a-1749-45c5-a6e4-078a4aa91a0e", "value": 1727016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785787993, "uuid": "4ae75022-21b5-4dca-94dc-eb1771dd1e51", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785787993, "uuid": "b85ab2d1-8b7f-4744-8f78-c888af1061d7", "value": "eclipse.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8398d0f5-8f03-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785738068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785738068, "uuid": "840424a2-6cad-4f19-9cd5-432b9478f962", "comment": "Malware payload", "value": "3b8d9b1b850a4be69edc3f815a5aaa95", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785738068, "uuid": "7e2cb903-d151-4c0f-9a98-ad5b1cdf0a04", "comment": "Malware payload", "value": "5f51c24d16d34f81ff5eac0f199199f7672822e70f5736316c3e0cf2e995f50d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785738068, "uuid": "57c2ba17-8fd9-42c0-a82c-eef49d823d0c", "comment": "Malware payload", "value": "18d04593e8e31c0de23f8aaf9bf1698b8f1786d6", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785738068, "uuid": "7da94910-dc52-4226-8188-e01842ca025a", "comment": "Malware payload", "value": "dc8692019253e877212988930b5780d966eb36f6b2c059ce096ffaa8dadd6a306b53ba7d52566fb3c463ffcf964841a0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785738068, "uuid": "79d49ea3-4203-4c2f-b00e-79b2fa42d78a", "value": "T146018CC68808AD1050AADA5C32D76054F411C3CF154B4B68BFAC6D39EB94D14B077FD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785738068, "uuid": "d59504fe-463a-47a5-83b4-6c07d9e6457c", "value": "24:kXCKysE2hi0ziQvZoha0FlARFviV3MjoIX:e9Qp+Ms0FlARFviV3coIX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785738068, "uuid": "43fc6698-1513-4965-890e-e983ea409201", "value": 844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785738068, "uuid": "c8dc24bc-84f0-4382-93fc-a01c8cb947a2", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785738068, "uuid": "66ca7513-467e-47b7-9894-020d88d0d866", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "697a83ea-8f63-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785779255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785779255, "uuid": "170897d7-20f5-40a2-b4a8-60b9657f9444", "comment": "Malware payload (Mirai)", "value": "73af899f7ee1e88434a6e6b5a1d20269", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785779255, "uuid": "57b12ef0-d9b1-4834-bb24-19097769bdb3", "comment": "Malware payload (Mirai)", "value": "5f92a73dec9f83f2ee863dbed55d53ae359f475236cf175d5630596427194151", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785779255, "uuid": "e391ba8b-812a-4033-93a0-7057ddfab0ed", "comment": "Malware payload (Mirai)", "value": "553cf6e48f32fd9fffb343157a777720416ca65e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785779255, "uuid": "ca771646-f354-4a17-a879-42dea916b1eb", "comment": "Malware payload (Mirai)", "value": "6e961bdeadd82d0bb1bf089353a2c0497315595014cd86c39436caaa07bb710a40372d6924ea2625f333d7810c9af79c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785779255, "uuid": "ea8050c3-9286-4055-9ed0-cda9bab0ab45", "value": "T10C933894BC419A17C6C612BBFA6E428E372623E8E2EB3213D9215B2037C756F0D77941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785779255, "uuid": "2274a164-f396-4897-86b6-9ec9bd2d3401", "value": "1536:fGYMOjagJhNLjRyvD5lQxjNtDoGorylVvSEQ4fnJGsusT8/mEJKvvs2b:fGz+h/yfuRturIVvO4fytensU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785779255, "uuid": "dd84d541-b070-491f-a99b-f32752694efc", "value": 95764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785779255, "uuid": "1cfc9050-2ae6-4acc-917f-2c1b42dfd8e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785779255, "uuid": "e9a8636a-9cf2-4f24-b594-dcf84bc09703", "value": "lkxstress.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dfb7aa1-8f09-11f1-bd95-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1785740474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785740474, "uuid": "a1863ec8-869e-4622-96b7-2aa164a2567f", "comment": "Malware payload (XWorm)", "value": "7d025132d18be3ebe844f0b1ce9676d3", "object_relation": "md5", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785740474, "uuid": "046f48af-d5ea-4627-a221-cbf50c9737f6", "comment": "Malware payload (XWorm)", "value": "6189e388cc17ffef1d807e9829668090ebdc9ee0100a845881b8887e510f6e39", "object_relation": "sha256", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785740474, "uuid": "a90eb939-74c4-4155-8c79-08f921f7d2ce", "comment": "Malware payload (XWorm)", "value": "971909eda9eef0c5c16cebb07f71af63ff4b0fa8", "object_relation": "sha1", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785740474, "uuid": "ccfb520b-6b1b-48e1-98ab-633913ee7b8c", "comment": "Malware payload (XWorm)", "value": "502b3aff30bb67144dc2a77dfd96e45cfd48666f5709a71e945c35da9b19ceec41ddac4e4ed988082ff1ed7686cda6ff", "object_relation": "sha3-384", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785740474, "uuid": "fbabeb6a-a9d7-466d-a2b9-7a379b4db8d6", "value": "T1EA22BF89A48FDDF51C0C7450C0F666437D2335F8AA60CD8FA8A641DBC687BB4E401EA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785740474, "uuid": "a603a4f6-af9b-42c2-8b43-ce83fc066cb8", "value": "192:Mv45AmbppO4Bqx/MPekoYqW/KOj6+O7t2lEazf/Kh:j5XpfBqVMPz56+GnaGh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785740474, "uuid": "98584ff4-c5e7-431b-acf7-addf1d8d0b12", "value": 10001, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785740474, "uuid": "0bf5258e-11d0-46b2-b6bf-3f6238b2f897", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785740474, "uuid": "8575136a-299f-4ec1-ac91-990e275a40fa", "value": "nPurchase_Order_No__002082026_pdf.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7c54041-8f2d-11f1-bd95-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1785756248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756248, "uuid": "ead8ec12-7a38-432d-b7ee-b7ae3b4f9ba0", "comment": "Malware payload (XWorm)", "value": "7ad0444c95a4d29d8d743db722812f1b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756248, "uuid": "a2abee18-233a-4a0d-ae6c-d01a2ffbe41e", "comment": "Malware payload (XWorm)", "value": "620b824bc1426bd64f3c0ce6fad30fb38d50a411dc70429964ed8ca65b0ff5ce", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756248, "uuid": "cd6f4f1e-9938-4abd-a40f-fe8a64d30bed", "comment": "Malware payload (XWorm)", "value": "ea736fc29f68365aca89e2654d280af97ca68543", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756248, "uuid": "d209ab71-4f47-4ae2-bceb-dd77e526df65", "comment": "Malware payload (XWorm)", "value": "189319d3ce2b70748413f917f81d8f7263c135d0c6eec8422bde7e73df33d2140fdd41287fd4b74bacb559420cdde25d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756248, "uuid": "edab7b29-f96b-4bd0-8f6f-a29dc773f135", "value": "T1AD05A7E25A5F0056C486BBC69CDDA7FF262466096C480BAD3277C6A04E0BC5D047EF7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756248, "uuid": "83f6f3a1-1242-4655-8dfd-acf22d650526", "value": "6144:27di9vAUJ8IH7UPg+uiRUmu/QuIuXgEvszF14ukkceYhGVFUQ8XEu0u78u+R4qXM:p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785756248, "uuid": "bc12cbcd-e18c-460b-97e3-44835f95422e", "value": 872443, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785756248, "uuid": "49bb92e8-df1d-4af0-9cf4-245ec55cf693", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756248, "uuid": "5ef643ed-7e24-407b-a7cb-aac89b7bb593", "value": "073126-Purchase_OrderXs.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab882303-8f51-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785771635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785771635, "uuid": "ca27ba97-f8f7-46c0-a37c-e0559fdbd063", "comment": "Malware payload", "value": "37982af530c88761fbeeee51602548b3", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785771635, "uuid": "8598cc8a-d34b-4e12-b3ad-8494029b3154", "comment": "Malware payload", "value": "62113acd384561e6f926814d8cade5579a51f4d8d3beb4eb8b69d7f8dd61f102", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785771635, "uuid": "cde1057e-d077-4fa3-8a5b-353d63ae64bc", "comment": "Malware payload", "value": "98120ec102d4012bddaad0cf1765234046b5d10b", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785771635, "uuid": "a9b54ed1-9f37-4dba-b8cb-17db51cd35bd", "comment": "Malware payload", "value": "137347a440a04c586356d08f4a23462f4b4beb3cbc4f9a53dc60d52e7927b48c16bf6de66e7d9b0f6db44a2ddae89279", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785771635, "uuid": "5e13af11-876e-4650-8f5d-b2368e88c43d", "value": "T1308402D2F6DC2EE2C115F1B08A786A16ECE4B5205F2034EF4BD8118547BBDD89F39626", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785771635, "uuid": "a4a801b5-b4ea-4d6d-ba3f-04f6bc69ac83", "value": "b1d512e9eece252c34592f0d820d532b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785771635, "uuid": "16132e8a-3104-4f33-b8bd-c2a761524ac0", "value": "6144:mpdAJrnYmR73+9IvOYNZgBt9YPvW/lNR9L9jU0UsrVtwxN9jyLHwTfJ:mpderzhuqFOYPvClPbKsrIxzjyLQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785771635, "uuid": "7086b972-3fbc-4b40-baf7-245ff52e28f8", "value": 374784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785771635, "uuid": "99eee0ff-45e5-4824-8f4e-27dcc2024a97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785771635, "uuid": "a9a59f61-e825-43ff-aea9-a4a81ea39d0b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a614fce-8ed0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785716201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785716201, "uuid": "c8f8fb93-6530-4532-9b85-6b3fc45df71e", "comment": "Malware payload", "value": "760fe8bf8cc842ba63103ed461c199e0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785716201, "uuid": "7d486619-ffef-4aea-bad8-e11843e2506d", "comment": "Malware payload", "value": "62550c7ec27b049999506513f37f06eb5e2e1bf3c8fd1d2487e15ef70cdb2949", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785716201, "uuid": "09e455a3-fe73-44ce-94ed-d05d64fb6086", "comment": "Malware payload", "value": "d5897c9f6682da07be7c6682307b30aab2c7cd48", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785716201, "uuid": "65f3b6f8-13d4-4fc9-b0c7-c5b72a0e93ee", "comment": "Malware payload", "value": "ffb210386bac0d2c1f8aaa95133ce22d86d040de377a34efb25b53da7492da5c4f04cc3eadf198c743bae30d76ce2f4e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785716201, "uuid": "f81bdf67-af38-4104-b79e-b4b6992ae39e", "value": "T133D35C85FA87C0F6F80708725027B33EDA31D228403AD956DBA69F36DD17941BE1B399", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785716201, "uuid": "6d24ac84-bb8f-480f-8e22-5f28f4006df1", "value": "1536:EuMmJNTqHggn7QQIahoTrynxW6KTQkoZOK7k+BZf5FfAU:EuMmXuHgu/Oz1noZOMvt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785716201, "uuid": "a3ce042b-1d3d-46d2-b0da-54e5c9f9f549", "value": 133524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785716201, "uuid": "d61866c0-195c-43aa-a542-012ed31663ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785716201, "uuid": "b88d67a7-4dcc-4c6d-ae59-30eccba5cfec", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92687b61-8f78-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785788344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785788344, "uuid": "0e64dbb6-64b6-4793-81c2-e952e4552ab9", "comment": "Malware payload", "value": "9cd15c3cb87b702cd6438a1665f93a3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785788344, "uuid": "84a75758-82fb-498a-bd83-77c01e0e8312", "comment": "Malware payload", "value": "6414a3635380ca1f3ae2c2fcda43f16d3d398e4344520deb7e09b04d93960037", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785788344, "uuid": "47203795-4a3c-4f55-ae7c-0f8a32b89d00", "comment": "Malware payload", "value": "cb8408d837c77cae0184698a25ac22f0b931df90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785788344, "uuid": "889a1f48-c19c-453e-a01a-178d4406b98f", "comment": "Malware payload", "value": "c549c00eee3554a06eb8ab6405037832c38b81249e466c8cfbb01a4b7bf343d12a402c18c8b332d04a7fa4816a8e23a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785788344, "uuid": "81f7193a-719e-4201-afe2-4ff5bbcfa0ea", "value": "T116C6338477640899F89F323E65C4516363E1B1320B61CADF4BF859982E672F9FE38B44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785788344, "uuid": "fc34d847-e899-4a3b-b94f-9bbd9607ad45", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785788344, "uuid": "f8cc4aae-23cc-4f02-8382-b5adff86aabc", "value": "196608:PhHAE1t6LtbW897GJr1LDsBTG9WdnW1/zwirkDCMPWhFWQGa/R6O:ZHF1e1S3sB1ErWDzCFWQhAO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785788344, "uuid": "f82f2f15-1f61-4ae0-8fbb-4a769724824a", "value": 12509804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785788344, "uuid": "49e834a8-5025-4156-a2eb-a7b43ec8bfba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785788344, "uuid": "c9cf90ff-4d18-4fe1-b0e8-f7f417d72747", "value": "nr7oczuvf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82a71dc5-8ed2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785717021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785717021, "uuid": "d4a19526-6a60-49a5-8810-59e6e30ce206", "comment": "Malware payload (Mirai)", "value": "cd4d9a4205a814bb954fc1307776a821", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785717021, "uuid": "c4ec1f35-326e-42c1-ae47-a8a0ac92ec36", "comment": "Malware payload (Mirai)", "value": "655f3fa43344394e6c4e57a769486e619339f9951092499c250ec7445c1bc4d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785717021, "uuid": "7929059c-3d7f-4bd6-9c2f-a1f5f7306585", "comment": "Malware payload (Mirai)", "value": "8ccb5ece553691199a52fb662450d5cc7dec86db", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785717021, "uuid": "da222fbe-779e-4bf4-a0fb-70833c6d7a57", "comment": "Malware payload (Mirai)", "value": "421bb9e16d8ad7cdf6ee328ceeae2e340f559e76cd08969ad1b0f83ea598d67c1d10604adbc48086209ade3f778ed91c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785717021, "uuid": "a2120bf3-7ef2-4ec3-ab61-69b4c838bc1c", "value": "T1B783071ABE419F15D4D526BAFF1E534933132BBCE3EE7112EE146B25278A91F0F2A401", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785717021, "uuid": "7fef1ab4-18d9-4d2a-9b36-4aac11bb2cc5", "value": "1536:UbnIR8TuYEHi0VAeq+2Gr6wRZAdV0771IcDsWBqiG0XKdlH7izOiwQTV:DR8j0i06UfAU71IcDsWBqidwCnwq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785717021, "uuid": "5a0313a7-6cfb-4a51-8fd6-ee5faef2af44", "value": 83776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785717021, "uuid": "44317dd1-835f-404a-975a-5bffafae2efc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785717021, "uuid": "40bd16ac-6002-4101-97ab-a93a150c2ae7", "value": "mkno", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c6400ce-8f63-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785779260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785779260, "uuid": "798cea7c-376b-497a-92fc-28424ddf04f3", "comment": "Malware payload (Mirai)", "value": "8c5699700fbf0d3c475eabf1990bb407", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785779260, "uuid": "3f990a2b-c46a-43cf-b80f-696f1df9be70", "comment": "Malware payload (Mirai)", "value": "65e78491657d59311a840210a20358a1bba58665c7078486cd402aaf37003d62", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785779260, "uuid": "2763a043-b442-40eb-bff8-978ace33f6a5", "comment": "Malware payload (Mirai)", "value": "42296d8acefebbe5246d63fb860ebe4c991c3b33", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785779260, "uuid": "38a8e210-4984-4551-8abf-71041cd2e151", "comment": "Malware payload (Mirai)", "value": "19f8c38fee6361ce4bd8881a3756f335bbf9a8342fbc753a0b353c85072b2f82c983f1667b702d684517e5c1c6b9c990", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785779260, "uuid": "0074664c-87c3-4d65-99aa-999a5b60be89", "value": "T1F183AD32EA292D48C1455470B0B58F3A5B73A5C083476FB66AF9C6785047DACF90AFF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785779260, "uuid": "b1a26a96-8399-4006-af52-5557466f6900", "value": "1536:kenMpsd6H316K4sdoNJTZZ9bOKJ45NXq/wuLaJ+WC7X:keAsdukadoNJtbhJsq/fWsWiX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785779260, "uuid": "3019f36b-9c54-4a2e-bb89-becbe00b093f", "value": 83532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785779260, "uuid": "528b1fd2-0ce6-4a7c-ba99-70e4dba18fd6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785779260, "uuid": "939292ba-37f6-4fc9-a610-3c5f8ee25c83", "value": "lkxstress.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21efbabe-8f3a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785761526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785761526, "uuid": "9f0f84bd-dd4b-4e30-8926-916c2b6fa1bf", "comment": "Malware payload (Mirai)", "value": "e3a2eeda2d94126c896d7dd975984ec1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785761526, "uuid": "c3c547a3-9c8b-4d89-a761-def757ceef43", "comment": "Malware payload (Mirai)", "value": "683417ac512190247fd16c48664f471a0ea830e691c392aff6a881db1c34c9bf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785761526, "uuid": "9c1315f4-7252-4dc2-bb7f-a52f155ba8b4", "comment": "Malware payload (Mirai)", "value": "87bc2efedb00cab4e257d43caddd2390a2bcbecd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785761526, "uuid": "673d0409-8d38-4119-b48c-1faee7805b46", "comment": "Malware payload (Mirai)", "value": "63e46462d05b7a79a01a8750f8c9042bf04ab91373934a0bf8be95b6b676a04b8e07ce10175a9900cb5ffbc4c015d0c6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785761526, "uuid": "39861289-5125-4854-a4bf-f0e5eef64489", "value": "T15F23F1F328825CD2FB259C3F19EB00A9999861342BF2B51D94FD846765291CF336CB27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785761526, "uuid": "031c3735-b49b-43ad-8e6e-d17ff4f399cc", "value": "1536:nV92GlrAWBmP3Py9zHvVoIqxO7liyUbRZ:ny4rAWZ9Bo5xiliBf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785761526, "uuid": "928545d9-3977-4855-9aba-2cd940d6288d", "value": 49408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785761526, "uuid": "719e1424-63b5-4739-881f-9747cc09d8f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785761526, "uuid": "3e4be348-e639-4a2e-b6ac-6ef0eb3b2d62", "value": "miron.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00ff7e1c-8f0e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785742573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785742573, "uuid": "b31df915-9831-4b8d-a191-c242f74b9a85", "comment": "Malware payload", "value": "753eb17f84f5a05a32bb5820e707124f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785742573, "uuid": "c97bf12a-1094-4802-829e-3669abe91dbb", "comment": "Malware payload", "value": "686beb0e5ddfd737e10557303ee6e7e12e6a1cbb46d2e1556cd13291d70bc4a9", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785742573, "uuid": "08ca0b4e-5f0a-4450-aed0-067cfb7e3a4e", "comment": "Malware payload", "value": "862a41945eaf47cd500dc8999512b5c31a409b6e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785742573, "uuid": "53350796-8900-46eb-b330-738294858e97", "comment": "Malware payload", "value": "b41a673fa51f535bb6d0af0a9750f2e34506ef13dbf67c0651069be50e470bec71aa066230f6b01887d17f9fc89a10ba", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785742573, "uuid": "ea28eac2-88fa-4fc7-b9e3-2c7bd590951c", "value": "T16BC27D966A867C44BEC94A3E4CBD2B0D6DF5C3D1324942AC3D8B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785742573, "uuid": "bbc257d6-563f-4d01-a2d3-aaea113c9d79", "value": "768:f8vCB+25j6es8Ru9FYpMSUpi+20qUpi+20YQX:f8l25JId2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785742573, "uuid": "e38a260c-5a1a-4ab4-bf2c-b002fb28b77c", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785742573, "uuid": "cb844872-42f3-4508-b194-f39ea90b732a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785742573, "uuid": "7b1dacc4-aa95-449b-8c29-d67f899d2279", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38b1a379-8f16-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785746102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785746102, "uuid": "a6aa03da-f1bf-488f-a716-12cc6c5c6bb1", "comment": "Malware payload", "value": "cd88721c0f6a665e7c33832f24c74373", "object_relation": "md5", "Tag": [ { "name": "424e51f31d68f573a4621aaede8044aa", "colour": "#51F4DD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785746102, "uuid": "a3bfca3c-e582-44ed-b222-0445a654f362", "comment": "Malware payload", "value": "690650578100544f260abea3b5a7c6279ff52c281032d58e9b51bdfe8ce2fddf", "object_relation": "sha256", "Tag": [ { "name": "424e51f31d68f573a4621aaede8044aa", "colour": "#51F4DD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785746102, "uuid": "e28a3699-a361-4b38-86d1-b46064f8349d", "comment": "Malware payload", "value": "ab89fd431aa74fa19e8bde361091b3db04226411", "object_relation": "sha1", "Tag": [ { "name": "424e51f31d68f573a4621aaede8044aa", "colour": "#51F4DD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785746102, "uuid": "8a9b0f95-8cb6-45a8-8756-db5c3051aebd", "comment": "Malware payload", "value": "107b810f346be2c7fe1aba7c201d060f8a1ed86f4f78a0932c346d92a4f9aab46b78b5bdce55b9eee062fde1039eb843", "object_relation": "sha3-384", "Tag": [ { "name": "424e51f31d68f573a4621aaede8044aa", "colour": "#51F4DD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785746102, "uuid": "8397b9e5-b026-4484-8649-ed52e17d66ad", "value": "T148D52289BC963271F472C7B7569328BD716E77418A744C1F36C9AF001E628287C773AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785746102, "uuid": "7aa50105-b368-4c2a-a1bb-a3cb1ec4b086", "value": "1799eb3c1092391ae174afa4eee4cba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785746102, "uuid": "6623ee2e-e582-4b92-b58b-5661165dde92", "value": "49152:canNmSBc+q5k4PEjQC4SJT4reBwG4bU6X6C+5vDMRdnNudB8QWjv53Gc3japII+O:curBc+q5hPl+4rkwxh0vDMHnN+B8Bjxc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785746102, "uuid": "a565e138-844d-493e-b76d-fe6c59d60f88", "value": 3003392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785746102, "uuid": "b1f2c497-8ab7-4e3d-99d9-26f884dd013f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785746102, "uuid": "b3a750ee-a416-4789-a070-4cc3a3bdedfe", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8698b671-8f43-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785765560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785765560, "uuid": "dcda551b-04d5-4ef8-97cc-82440b0dbffe", "comment": "Malware payload (Mirai)", "value": "e23adde80e8ca50e8199a6e2463370de", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785765560, "uuid": "a4ed757b-7adf-4cbf-a925-64825713860e", "comment": "Malware payload (Mirai)", "value": "6990bb4d3a3a27aa726fc7fdb1cf3748cbfc6fe228c9436add711b5412a1c677", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785765560, "uuid": "63c7926f-e412-4042-9a7d-fc1b8904ddb0", "comment": "Malware payload (Mirai)", "value": "8e7ea442fe1599e393ca425d9aa3df9cb83aaa3e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785765560, "uuid": "2b7623b3-18f4-4956-b1ba-1c1626965548", "comment": "Malware payload (Mirai)", "value": "41eeda2e98ebc8210d2e6f3231f1b23592f1d94d60d7ad758177fe9f2d6a721469febddf1cabd5f2cdb38a57d9d32b35", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785765560, "uuid": "e57a5460-1451-411e-83f8-ee25f329fcf4", "value": "T177E39A596F328FAEF26C873447B74E21A75D23D623E1D684E2ACD1105F2028E545FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785765560, "uuid": "a49df81a-fe57-4fff-8a1e-fe34cb9d21a6", "value": "1536:sqocwvjrvQ5orbF7APMnoV+VyhoHkl2mMIDUTDmSHitw8ekWpa:sq9wvjrp9APMpcPl2qRSHitwtpa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785765560, "uuid": "052e2c2c-eb32-40da-a3e9-4a242b191792", "value": 149676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785765560, "uuid": "c7bc0257-e302-4544-94a9-8a2b30362330", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785765560, "uuid": "65a28f1a-8e47-4ffc-a5a1-0b6aac162298", "value": "miron.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57a14b26-8f2b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785755174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785755174, "uuid": "ff00a568-ea14-4878-9bc2-762c7e490b83", "comment": "Malware payload", "value": "36cc5ab60d3b644faf6f34d685ca8320", "object_relation": "md5", "Tag": [ { "name": "dn-pdflite-lat", "colour": "#BE5FA0", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785755174, "uuid": "c8c2b80a-a0ce-4dbc-8aa9-1e1a427793d6", "comment": "Malware payload", "value": "6ac307e0375de5b2e6032e43172bbb1251a54fa1bae9587e758070574fe7ca55", "object_relation": "sha256", "Tag": [ { "name": "dn-pdflite-lat", "colour": "#BE5FA0", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785755174, "uuid": "094e9fc0-eb96-4f07-bdb1-1437ca59ba11", "comment": "Malware payload", "value": "9d9943ad3cff7a3e5bb926df6c597bea921aed3c", "object_relation": "sha1", "Tag": [ { "name": "dn-pdflite-lat", "colour": "#BE5FA0", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785755174, "uuid": "8a1b4b68-e965-4e54-b66a-e3902d98d65a", "comment": "Malware payload", "value": "cab58ae0f1e4fe11495362675a48b6b28b9fb8dec96fff2ac4b8df8669200e632a6bcb3d86aebc08980eb5ddff4e7114", "object_relation": "sha3-384", "Tag": [ { "name": "dn-pdflite-lat", "colour": "#BE5FA0", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785755174, "uuid": "731a1b40-d41b-4540-aa73-b0a4ffef652c", "value": "T1A313CB007FA205A6C2B2CE3980EB372486BAB141DFD1871F300C05092BE9204DAAAE76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785755174, "uuid": "c5b6dcc1-5852-4de0-b589-1a2c7d86d304", "value": "12:5+faWf1WpJI9qYslWm/VnEXzQK9+a+Uo0MyDjLKmzoil:5F5pJjttneka+G3LK1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785755174, "uuid": "12e01c32-61c6-4cbe-be86-2701ab393eeb", "value": 45056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785755174, "uuid": "9f40e9b8-24cd-4668-9fde-e5f408ba700b", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785755174, "uuid": "54d45a16-c7e1-4f42-91d9-3b38393eeee4", "value": "Chrome_-N42P0V.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea789a5f-8f5d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785776895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785776895, "uuid": "987ea715-7319-4636-a6be-4aa046444acf", "comment": "Malware payload (Mirai)", "value": "2c3adc449f059e1848805c222a774ee1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785776895, "uuid": "49201a78-a111-4015-855a-5a22e8017ec0", "comment": "Malware payload (Mirai)", "value": "6bc17f9f0a1cda1924abfacf2aec3db6d996e0dd53b12ceb63254279aee0cc73", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785776895, "uuid": "2dd35224-deab-4a67-ade3-75c19499cbf3", "comment": "Malware payload (Mirai)", "value": "7076dc40622ac62b947c5b73a344873bd8f7573c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785776895, "uuid": "b2ae48ec-5c39-4f9b-be39-5cc29cb1f138", "comment": "Malware payload (Mirai)", "value": "916c52251a11228c34a2ba74ef71b9ba6011a336ed3a33870517d965206fa262bb66503c8d5c854aa3df09ee17bf0a70", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785776895, "uuid": "f2420490-6cef-4850-8690-54b5311b0c3f", "value": "T1DC53027819561EFACF5AF2749AC050757A020FC2A493684B7D1DFA93EC4E364BE25AC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785776895, "uuid": "bc146437-813f-4683-9d74-807568ff5e7d", "value": "1536:qeud6KHRqBUy4dN4WCXSKG8Sio1zm7dsoGxaT6HVJuF:qeuUKHRqBUfdkXSKG8SioidA4T6HVQF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785776895, "uuid": "2a621f7f-2313-41fd-b6b2-c98e2dd59a81", "value": 62420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785776895, "uuid": "56ffe721-77c3-4584-acc9-3f9079a6a3d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785776895, "uuid": "7c5aea9b-237a-42fa-8b09-b099f6a3a81b", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fdda5d7-8f11-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785744021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785744021, "uuid": "d12aad58-a2fe-4bb3-8ec6-db2fe0971778", "comment": "Malware payload (Mirai)", "value": "5a8e69cfeea56a73ba82b510b6516e3b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785744021, "uuid": "4062f581-6f71-4757-b418-4e8da2d09ffc", "comment": "Malware payload (Mirai)", "value": "6bc5a031131d30d056fd21d268c5e2978667f8cd811f7ed4e726177118778f61", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785744021, "uuid": "0af5d0e3-2809-48b9-ad87-8e95a6dcb083", "comment": "Malware payload (Mirai)", "value": "18cfd699a1e9673c975a35f73e3a47e32b5ccf1f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785744021, "uuid": "678f1879-0bd0-4748-8061-b5e7178982d4", "comment": "Malware payload (Mirai)", "value": "bdfcfebba4408d42ed6ef1b8821f8630a5d8eafddf65ff2ac91e390d0f90b8457b387a8fb33d1ef5e4d7275aee54a826", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785744021, "uuid": "9dafb713-d4f6-42f3-bb19-adec49241791", "value": "T10724E8099FA20FFBDC6FDE3702E90A4225CC944722A93B753674D528F54A54B4AE3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785744021, "uuid": "c263c8e7-dd93-4146-b45d-04e186041112", "value": "3072:PcFcnpFAub49a+S+PZ5vdCRrog4VOd8Lqr5L6UfMC6PuxezghaNUNbyLNaXYO6AU:PcFcw6Og44iLqT0dKevNU4ZaXYO0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785744021, "uuid": "dfcc5cca-31ce-4422-a010-b544659d1c69", "value": 230292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785744021, "uuid": "0beb8225-798f-42d5-95da-d18edd2b3e63", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785744021, "uuid": "928ba3a2-b6e9-410a-bc3e-b669e946e002", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcf23cf7-8f87-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785794911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785794911, "uuid": "91fb4039-67f1-4d27-8867-0ae507eeeeb9", "comment": "Malware payload (Mirai)", "value": "d634548e6728f9a24cf6d09a6a7fa9d7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785794911, "uuid": "5437a890-3278-44e2-bc1b-cb81242e0263", "comment": "Malware payload (Mirai)", "value": "6c5602b09a7667ff0163ab0eab39c89743ffebb12d1360282caf81a21e00a7b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785794911, "uuid": "e3b24861-3c05-4668-9436-0248329bb5b6", "comment": "Malware payload (Mirai)", "value": "1e2cc947298a8e6d7d794f07d803052791e431a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785794911, "uuid": "ec06e17e-54b8-44bc-a0d3-caaac3eaa9e0", "comment": "Malware payload (Mirai)", "value": "c1b9ad07e6901978ee895bae9353563d9c61d208680472aa27be048569b877aafaaf9f0dc6e9e6cd8aebe63651a2ad35", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785794911, "uuid": "e106ca8a-d701-47c4-b518-d1246c8af2e4", "value": "T19C144B02B31C0D47E1932EF0363F2BE183EFD69125E4F645651FAA899172E325986ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785794911, "uuid": "28ed2289-01ca-4ea7-9cc5-9c87510807ab", "value": "3072:II238eWUhJ9LnpaLkc+2d5MziUJXxaq7aJTzEZaJAPhAO9tBHSuM:C8eWwpi+ziUZxnaJTYZaApjHNM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785794911, "uuid": "00b85c7a-67ab-465f-85bc-4dc117dec2a9", "value": 204292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785794911, "uuid": "bb247389-18bf-428d-812e-81ee201cddd2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785794911, "uuid": "fee56134-04eb-4569-b146-b3411e216650", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f782db13-8f5d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785776917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785776917, "uuid": "b9724c7b-df94-47f2-af91-9c3d9e38233a", "comment": "Malware payload (Mirai)", "value": "7a2d6753a6bf8f7a576d13fab60c559f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785776917, "uuid": "a41c91a0-6654-492f-a523-3ed24e0cccec", "comment": "Malware payload (Mirai)", "value": "6cc6a7a4cd9e7d8d309c09128575114b552879d58f326b32637ad0932a2dbe23", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785776917, "uuid": "e9de0893-2225-4461-bdcb-4295160ac0ff", "comment": "Malware payload (Mirai)", "value": "139e1facfa9ee3566eaf7f5a989d8d821f37e11d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785776917, "uuid": "35928c69-fd02-48a7-8dd3-66ff4904b1c9", "comment": "Malware payload (Mirai)", "value": "0890e8da0a57d9e897fe65962cd9d93c2afc6305cea22355179ebc9cbab7ecd05432c84246dc56054395348f15424d34", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785776917, "uuid": "1e0e8460-433a-40fd-8668-d936ec9d3856", "value": "T148531992BC82462BC2D402B6B5AE5A8C376213F9D1CB7227DD514B407BC591F0DBAFE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785776917, "uuid": "e7f90924-6040-4665-b279-5fe464c7a008", "value": "1536:ebbYHKTccQqJ5GeVkPU+FH5mOLrI04S2IymQY2AUm6hh1P:eXYHKgNqJQ6hh1P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785776917, "uuid": "30e47180-c26b-40e0-85aa-5c12d6871e9e", "value": 64060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785776917, "uuid": "7ae744ad-99cb-4831-8a82-8280b99c6c6b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785776917, "uuid": "c41773eb-5ec0-4a09-8cca-2c9d6df71cab", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1fcf523-8f6f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785784585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785784585, "uuid": "f0148f96-4e4a-4541-9b26-0f9e86b3ac45", "comment": "Malware payload", "value": "315e7ac99c482021add914572bea3eff", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785784585, "uuid": "e80cd1c0-6f1e-4036-8ec2-602587e3c511", "comment": "Malware payload", "value": "6cccf8e3196b5e5d91aa2c785376aa8a2fad2b2fa4b090d4058e34121c0322c0", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785784585, "uuid": "059c5f73-5824-4f09-a01d-2d44e56a2a1b", "comment": "Malware payload", "value": "84380b2b0a467214f950d0b835abb53fa4073de5", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785784585, "uuid": "3e08ec5d-6109-4b03-bbc8-cc10b7b5eb53", "comment": "Malware payload", "value": "5dbdab7fc903bde806ceb9d388f431601ab74f92d77fef7095c32d3c720efce4a3b82b5c082a6f4cf49dbec51bf0e3cd", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785784585, "uuid": "ef508d97-d0f6-4524-83e3-b5cff53f1465", "value": "T1AD235C6516857C24AE98C4361C7E2F0CB9AD43E6324452EEBFCB3CF68C4A69DD109B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785784585, "uuid": "357e1d15-2bc3-4f02-9ef0-fda834434ffd", "value": "768:1+G9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:1+jcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785784585, "uuid": "24088c8f-7f51-4325-a8bf-a4e04c1d6a7f", "value": 50071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785784585, "uuid": "d59beb40-9c01-4cdc-8908-131e32693266", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785784585, "uuid": "26f7cd0e-5b68-48de-90de-c9b0e471ded9", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4fd0fc1-8f87-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785794925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785794925, "uuid": "883dadef-3c9c-4808-9d27-a793a36d785f", "comment": "Malware payload (Mirai)", "value": "c63f643091cec806d7044f3a126cdabb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785794925, "uuid": "7f15d7ec-13f2-45e5-bb51-c4c434ea150c", "comment": "Malware payload (Mirai)", "value": "6cdc6333fb83f8dd8e4d86498122ff1845fdc0da46f616ed0e51a140f8d6eed9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785794925, "uuid": "1bde71dc-7024-436b-9090-7b9e00733c17", "comment": "Malware payload (Mirai)", "value": "ea82247b31fd8efaf8f856a61ce81e648b04a101", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785794925, "uuid": "172c8d0f-3807-4844-a560-5d8e302fbfda", "comment": "Malware payload (Mirai)", "value": "a1554df0cf82be8f6f14fa48842e51635bdb89049f8ccfea356ed22f0a706f4e0007a6de246b71e632601894d4d5da30", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785794925, "uuid": "9afd658b-4245-40b4-b96b-cac11417ba8c", "value": "T198832B1A767C2A1AC4C0757F10E78362FAF267886AA0C24F7D750D4FAE553002D66BB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785794925, "uuid": "22416334-06bc-4125-86fe-0faf9fc65c43", "value": "1536:dUm1qxPnOxcRhYStfMb71fMuFXsb7k3vnK0PZna2FOn7IO:igzmVtf8I7YPndaL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785794925, "uuid": "dc087c34-71ea-414b-849f-f590b273ace3", "value": 85240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785794925, "uuid": "ee9e599c-f84d-4f75-9a24-cf50291f189b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785794925, "uuid": "7f089fd6-5e20-436c-b124-8683385337be", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43dcf7be-8f2e-11f1-bd95-42010a9c0009", "comment": "Malware payload (LxBaseRAT)", "timestamp": 1785756429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756429, "uuid": "1fe8957d-6b27-4eb9-9dd2-5162e27bf043", "comment": "Malware payload (LxBaseRAT)", "value": "5b1ecb218f51730dca6a4efdd022fd02", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756429, "uuid": "bf2d4336-ddf5-4aa8-b16f-2a3dd439fb81", "comment": "Malware payload (LxBaseRAT)", "value": "6d1d682be71ae048aa3c54806590c97efb7ab2e824f1a5ac98819f166903cf93", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756429, "uuid": "0d1ebe59-f965-4eaf-b401-e6c363eb5afa", "comment": "Malware payload (LxBaseRAT)", "value": "92dda72d50f18282b81e944a52114c19f4ae40e4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756429, "uuid": "dbbae1c6-64e9-4144-b6cb-8fc619d97cdf", "comment": "Malware payload (LxBaseRAT)", "value": "e6d2da5dd2c4cbe4b0b7f49ba44ef184c1ed1ef2c7f56aaa4a20db4aa5a526c302b49214ee498201c688218ceb9acae9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756429, "uuid": "f61f5362-401d-462b-8864-9446eb3bce76", "value": "T1F5957D503690B103C5F9986BA75DA7C9FD7FA1AB6F410F17217403276A09C228BD2FAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756429, "uuid": "1e67dcd5-5ad5-4406-93cc-5fb085b566b7", "value": "24576:g6Ewos5nfq3UTWiW7a6cS4Dh9ygM9DJz940IUM3DnqSYsFM2qhDgwoveefcRCh2G:iezJPN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785756429, "uuid": "4607070f-005f-4ecc-98ab-73446bd5ba2c", "value": 1909131, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785756429, "uuid": "ce1eb747-3398-42b2-bf33-ffb38258b232", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756429, "uuid": "29ac3dbb-3622-4c44-abf3-a9d239fa49c8", "value": "\u0417\u0430\u043a\u0430\u0437_17954113028072026_Azotny_Zavod_LLP.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e9d1bbb-8f63-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785779264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785779264, "uuid": "5631b3ee-d656-425d-9e48-745337192dba", "comment": "Malware payload (Mirai)", "value": "ffe768f6d5db3ade98675c0a3948f363", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785779264, "uuid": "626c75be-da37-4a07-86d0-0db8d1900526", "comment": "Malware payload (Mirai)", "value": "6d2ec37961bfd82e44a8d571d57bfd9b9e9ef8ebdbd261fbf536eea5fa98acfd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785779264, "uuid": "e2042b76-aad6-46fe-a329-6fb6d1484699", "comment": "Malware payload (Mirai)", "value": "24e0f38835ded5bbc5e2e79ac9df8b3a6eb9550f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785779264, "uuid": "84d8d977-7b48-4050-81a1-f33869affc2c", "comment": "Malware payload (Mirai)", "value": "383bc8e75e7284a9a867c352b55c2b0888d89ba263d610946bac0c94ab626934cdf6c779ad48194c0c484d229e4e0ef8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785779264, "uuid": "f88abb4d-5d4c-4051-a34e-51659ac0e525", "value": "T18F934B02B3080E47D0A71DB0353F2BD197BEE6D121E4F689750FAB9692B6D335486EC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785779264, "uuid": "0f8d99d6-8629-4934-b682-f368f02e9c3c", "value": "1536:3efrO+xXyy3U+M8JekB3pdfd5LUCnJKwBWkQtCeiS9RsGPtqnv+JINu6:3Gptyz+VJzB3pdf7LUkFZeiSDmu6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785779264, "uuid": "95ecdf02-0d86-4ba0-b753-4fe4e24ad063", "value": 95864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785779264, "uuid": "0385cb1c-2052-423d-a883-281316f30f6c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785779264, "uuid": "ff02845f-aaa8-43e0-91da-c5c7a8cfab0a", "value": "lkxstress.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b43ae56-8f11-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785744013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785744013, "uuid": "c91c6436-453d-464d-99b8-acd1dd8d52fa", "comment": "Malware payload (Mirai)", "value": "f6ea7871e9b6caa957235628c3f8294e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785744013, "uuid": "3f9e1e5f-4d2a-48f9-9551-e26f93312b1d", "comment": "Malware payload (Mirai)", "value": "6ec5efb339a2245d1f851077a603fea742bddf17fb88072a6ba0281cf43b392f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785744013, "uuid": "b5a7c534-7515-422f-a452-b86cfcbb938c", "comment": "Malware payload (Mirai)", "value": "290831835ac621894da71478e795ec68c0e99f87", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785744013, "uuid": "3b52c0f4-e7f8-4155-9ac7-4050486d7b28", "comment": "Malware payload (Mirai)", "value": "268347971de1ff552920d2f6b3488fbdd7dae481117ff23ba3ec0d588e3f45db2ad1e19c3198a879d416d88d4b72cf2e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785744013, "uuid": "cf1f5bf3-3993-493b-99b4-a53d88d1f14d", "value": "T170044A02B70C0943E1A73EF4373F2BD1D3EFDA9015E8A644255FAA8991B1E321646DDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785744013, "uuid": "1d00150c-4558-4f13-8bbc-9c17c686e042", "value": "3072:3TKz2cOjaJUDYcF0ZRhJDTxx0lLglLEg4zsdyG2:3QhP6VF0ZRhJDTxxWLkLEgWs0G2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785744013, "uuid": "cfd60bf4-e7e6-457a-91fa-135048c86c91", "value": 179016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785744013, "uuid": "6ecbc4fc-e056-4304-8868-749d148e65a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785744013, "uuid": "0e8db09f-0eb0-4691-b3df-e15b140409c0", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a3ccccf-8ed9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785719906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785719906, "uuid": "9fc399d0-27c9-4c9f-ab86-5870f834c152", "comment": "Malware payload (Mirai)", "value": "fba46ccd1790d7462954eafe7bfad008", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785719906, "uuid": "ce10fb6d-bce9-460c-ae8e-2fd4e8149814", "comment": "Malware payload (Mirai)", "value": "7229420792cf2ed0803b978655c0afc86e543f5343d73af490c097db9e021fbc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785719906, "uuid": "65d40af7-4640-485d-8b25-103317aaf7f9", "comment": "Malware payload (Mirai)", "value": "b1b2a4c52f611bfb014dccfba764b889e9023ab7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785719906, "uuid": "a8bc1cff-49ef-4f5e-8ec7-009df44f2a28", "comment": "Malware payload (Mirai)", "value": "6eb9e9e6770ebaae19a0b870b1e09d3e5a68b2294044afd885f7a65a2a8a402627cda064636b3b56836dfcfc37cf0137", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785719906, "uuid": "c9321f8c-7f2f-4290-b2bf-6ca12b56017a", "value": "T17DC32AC0F98B81F6C40B88305166F63FDF3199A85163DA9DEF999F72DA73981912234C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785719906, "uuid": "9a27cfa5-adcc-4d7c-9da8-f8a2c61fd8db", "value": "3072:6ncCIGcJvNoHW8/ySBV/tI6QyK4BUlsWrhKHHT:UIGcJvyHh6SH/tf1K9wHHT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785719906, "uuid": "da2ae5ef-585f-42a9-b761-89f0b3d0c425", "value": 120084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785719906, "uuid": "4ea3da66-2957-40b4-a06d-604b801e5e44", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785719906, "uuid": "493bdb05-3df7-4e39-8e93-b0d1dff93db5", "value": "nz.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5db0d1ae-8f11-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785744017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785744017, "uuid": "baf2aff6-d1f6-4186-9016-76c421ef1b09", "comment": "Malware payload (Mirai)", "value": "3a71edd9da263f2f5045c3927155ee28", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785744017, "uuid": "dcc2b8b2-da00-4f41-8fd7-cd37f6737353", "comment": "Malware payload (Mirai)", "value": "727bb0d66f46ca65b38bb39eda4e98fe35a9da523a9af0c6dee5855f345295ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785744017, "uuid": "5e5e5cce-f8bb-4241-8ff5-c78574cd148c", "comment": "Malware payload (Mirai)", "value": "ab201bad0cdbfc6d1764cc0f543fcd363c145138", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785744017, "uuid": "78141e6c-f10c-4262-8c3d-b5451c426495", "comment": "Malware payload (Mirai)", "value": "5531c414113744b94b49509aa2326649b3fabc45958b5bbfe03f448f51e8c0bfc3abc72288dda1b56c6544a4b00fc6f5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785744017, "uuid": "47d463e5-2ab4-4232-9316-d466125fe3c6", "value": "T108042A95FD415B13C6C216BBFB6D4288772B07B9E3EE31029E259F30379A45B0E3A641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785744017, "uuid": "0fb4f0b7-a611-44c2-bb56-ae4f2c55d136", "value": "3072:NiyZ1hyLt6XXvsyRdA2CqV55CAF9L31SI4RQE2Ug7zZ/l5:NiyMLt0dAXQ5gAF9L31SI4R52UgHtv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785744017, "uuid": "3a709a52-8ecf-4605-aad3-5d0f9d3c7b69", "value": 181152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785744017, "uuid": "d54c68ed-240b-481b-8841-1042322d9dc8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785744017, "uuid": "a89af6f4-7200-4f0f-9daa-b478f1d2e47b", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f4685ae-8f87-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785794781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785794781, "uuid": "f73e78a6-ddfc-4cb8-a027-4b71abc4d654", "comment": "Malware payload", "value": "e173177f261ef05fb9ee3a3ddeb3bfb0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785794781, "uuid": "55f814f2-3fd2-4bcf-a975-a57f244d607b", "comment": "Malware payload", "value": "72c6f11a7d813d7fde1aec7b444c9760b15454a9e9b1d3f86c0a0c941d52dde1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785794781, "uuid": "a473759c-1516-4e62-930b-ce6776f76691", "comment": "Malware payload", "value": "91a0de4e035812bdea32fe8ad142f371cb06d314", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785794781, "uuid": "20e80c4f-af7a-4ee6-b097-7232dd55c7d1", "comment": "Malware payload", "value": "6a79468d7e7e5f9109d2528e3f748280c1d3954a68266db11332162de3d2e1ae813a217753a6949b101718ebd673d956", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785794781, "uuid": "36bb1a47-5140-4e3e-87a7-765e9d743f99", "value": "T19505C05203489FB6D7E80EA9C98D658E45D25A074931E038BFB22CF5FD3A7826E35F11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785794781, "uuid": "e32d9aeb-1920-4a75-b4de-ba481db7d3d9", "value": "12288:QfRvYcnCeZFlVMINxH2lKgrJ3vAQRUstPQpet38BbYE4qwasrrocRGZdj9eKNl:QfRnZF7NZTLOPLhBaL5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785794781, "uuid": "ea18f223-a27c-4c0d-a6e9-2032b0b52c34", "value": 845676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785794781, "uuid": "848113c8-68cd-4ed9-b83e-8bf825d2fe69", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785794781, "uuid": "12e908b3-8885-45d5-bfc7-7fac5f658196", "value": "ORDEN DE COMPRA.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feba6654-8f06-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1785739563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785739563, "uuid": "eff0a805-a6ae-422e-a26a-36810771bee6", "comment": "Malware payload (ConnectWise)", "value": "dc0971abf91fae85d02440230185b98d", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785739563, "uuid": "02f82ea4-ab69-462d-a8a4-3ba3d75c01c7", "comment": "Malware payload (ConnectWise)", "value": "73250e0cd4cf516b62d636fb17492598f68d5c30f32d849b7148be2bd4237e99", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785739563, "uuid": "a578bf02-8541-4277-baf2-c0b14f796cfd", "comment": "Malware payload (ConnectWise)", "value": "1693ea03664b0ffa5fbaa9f25c8a58710c31745b", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785739563, "uuid": "8e3596e5-b5ff-4919-96b7-b4b01865927a", "comment": "Malware payload (ConnectWise)", "value": "4cdbdc9922314123741027285a7a0c7bd2aebdcd66e642a1703904baaf682db380ddd2b6b929407ce709d3ba49f22bfd", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785739563, "uuid": "4e31d0ee-6308-4045-8069-52887006be05", "value": "T1C446E101B3E695B6D1BF1638D87A56656734BC049312CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785739563, "uuid": "6fae2ee1-4f9f-4888-bef6-a35f9ef783e9", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785739563, "uuid": "9d91eb22-094f-4fed-a532-153a4494cc75", "value": "98304:LzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:LhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785739563, "uuid": "0f33f24d-a183-4dc4-8927-b310ef9a9709", "value": 5734184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785739563, "uuid": "69a5d0fb-9dc8-4ad5-95c0-67491afbc212", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785739563, "uuid": "78968d3a-d42d-4927-99df-603c7f0651fd", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d546677e-8f14-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785745506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785745506, "uuid": "a104d6df-8eb8-4344-8896-1367565002b2", "comment": "Malware payload", "value": "11701f7787f832d1a8220996b77c3181", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785745506, "uuid": "606d1906-cbf2-45d7-9c3b-3243b1765f16", "comment": "Malware payload", "value": "74c7e21c349ff8b853ec4220867429593d3afb335ccaa8ff50f983cf7f8910a3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785745506, "uuid": "39741d80-2d30-4d10-808d-cd7f3e75079b", "comment": "Malware payload", "value": "3cef9c4e32ea9fb48200455994208dce818c7de2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785745506, "uuid": "080ec406-8352-46d4-bb86-7f04a9c98891", "comment": "Malware payload", "value": "c0c467c569c28e1997dab9ebf086281e70da42157fdb80834b2bbd38c64e23def8683e87209ef37f4ebe4a712e99cee3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785745506, "uuid": "43589854-8b95-4b90-a354-11a20bf339e8", "value": "T18031CECDCCD28571A948451A7A7AB3A1FB0A494F1CD9185CB00D9AA0EF0C934B225776", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785745506, "uuid": "520cb349-373a-4d07-a1bf-e6123ae92069", "value": "24:8e9g9MDsTbnFrMd8S7jbU3FFDs2UUXHK5eB6jYwxD:8Gg9MoHZMd8S7jbU3zDNXq5/jYwt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785745506, "uuid": "a5892c57-bf40-4008-864a-5c236a2fcbe8", "value": 1468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785745506, "uuid": "f5ac0af7-51dc-4356-9d48-c26c8eabd352", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785745506, "uuid": "2ec0036a-3c43-4bed-8cc2-6fac896b29a5", "value": "gpon", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f0f997d-8f11-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785744019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785744019, "uuid": "45cc60b4-c9f9-4c81-97ff-c3da96296349", "comment": "Malware payload (Mirai)", "value": "d5a754c8555662411c0489975702343e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785744019, "uuid": "1e7bfc50-6820-49cd-8787-cd59d5d22312", "comment": "Malware payload (Mirai)", "value": "76750b809eeafa56c877a2b31af1fd62c05244a0cd6438aedfbc9c385c771abc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785744019, "uuid": "e4b2ad26-4624-4681-bc7b-7af9d4cecf37", "comment": "Malware payload (Mirai)", "value": "3bc66dcfa84f12c82b0135383509544f2acc07b9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785744019, "uuid": "9a0c1e9b-e38f-40c3-9211-1153cc99d78b", "comment": "Malware payload (Mirai)", "value": "ddf44e77a65e3c6d3466830a37961b100e56db295e8806e73e6605ec6c170aaeb96aa30af44d8032a02b2985dab74f37", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785744019, "uuid": "e045f9d0-4668-4e79-886e-3012b90861a7", "value": "T12B24A75A6E628F7EF268C73047F74A31976D22D627E1D644D2ACC1141F2039E642FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785744019, "uuid": "8dceb265-b763-4fef-8a38-0229fcfa6dfc", "value": "3072:DjXtzCfgW6z6JFynCJd7IzyrkWPrp94T00380Y0Gon:DjlL+JcCJdAWl9r0387U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785744019, "uuid": "3c4148eb-3c61-4d94-91a4-e86bd8e02287", "value": 228532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785744019, "uuid": "5429de01-4d3a-49e4-9bd5-8bef01a7e175", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785744019, "uuid": "123ffdc3-db91-4fee-9d04-9348829d94b5", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "319d2d64-8ee0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785722898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785722898, "uuid": "e82793cc-9324-4490-891e-f33651f5b5c9", "comment": "Malware payload", "value": "e6b4aa6734a025740b12b09f9a8bcee5", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785722898, "uuid": "5d526184-c3df-4c90-b731-2b07c4fc96e5", "comment": "Malware payload", "value": "76c488739cdb46ae9bea8ab5d34fb49e7345fba3bcdb9cf3b24cc2e7cd7667f2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785722898, "uuid": "0b459563-6947-4018-bb73-57ba84c7186d", "comment": "Malware payload", "value": "d31af00c35a2640d9f9a0a748d2e29b966f50993", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785722898, "uuid": "922d59a4-6efa-4d13-b9b6-60c4a1875565", "comment": "Malware payload", "value": "5459eb0e3f88ac99d433f8c06052d73d8304d1e4639de7a7bf159dfa643dd50613ef5b6c5bed6e26ba57c56c24226701", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785722898, "uuid": "8b26ef31-9695-4292-b7ee-e26e6a6d7051", "value": "T11A236C651A957C149E98C4371D7E2F0CB9AD43E6320452EE7FCB3CF28C8AA9D920971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785722898, "uuid": "474d1286-404c-4e9a-9e15-87abf4728f04", "value": "768:QVEJVIhtMq9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:OEJ2M/cr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785722898, "uuid": "9183bcf3-b9dc-49c2-a428-d228c4a1c4a1", "value": 50051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785722898, "uuid": "dc9ed035-4aee-4468-a095-7c5ea01f9042", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785722898, "uuid": "605c39d3-9602-46aa-8bbe-563a664625c1", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe9b6aac-8f06-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1785739562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785739562, "uuid": "5a0b1908-753d-4ef8-a89a-b91b3bee71b8", "comment": "Malware payload (ConnectWise)", "value": "725bb937dc72a0161ef31edaa7aac160", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785739562, "uuid": "2c1e4ae7-f296-45e7-8916-435c50b89bf0", "comment": "Malware payload (ConnectWise)", "value": "77f9a78789f7822cd5bdeed4400800c86d6bd2989f325cd312511744d72f1a4c", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785739562, "uuid": "779d5955-21a8-4ab0-bed8-2acc846ee7c6", "comment": "Malware payload (ConnectWise)", "value": "ffa240d2c0b98fd02814ea02a1bf00e79a69af33", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785739562, "uuid": "1c98595c-6b24-4ac6-ad76-ddff249c4a6a", "comment": "Malware payload (ConnectWise)", "value": "a3525b97d002912a585dab2fb0b44f2aadbeccf24b47fb4f608fbed016dc5efd9c3c0796b86fee3c91e9ed37bfe32007", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785739562, "uuid": "9a4a7a11-cfb9-4ced-b532-c10b16c45af9", "value": "T1C1646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785739562, "uuid": "d6aac821-e9c8-444e-bf80-c3ca5f4d121c", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785739562, "uuid": "571c11ce-4d1e-4aec-8b11-a0fbb451ce02", "value": "6144:ymlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:R1iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785739562, "uuid": "43635c52-c669-4ea3-bebc-ef6225df2b5d", "value": 312544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785739562, "uuid": "c6b6b274-5022-4c10-b0ce-ae0ae27ba608", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785739562, "uuid": "32f608a5-904d-4668-be44-ef0f4fbccee9", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68be578f-8f63-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785779254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785779254, "uuid": "dbe44f28-27af-4ed9-b52d-6d9f4eeb9968", "comment": "Malware payload (Mirai)", "value": "5791a16dbd60339ff59625b1367c4dae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785779254, "uuid": "dcb8dfca-b9b9-4975-a513-0276a5576229", "comment": "Malware payload (Mirai)", "value": "7b88290638c2513612c51d6b5c8112d07e999e11b6c03e88c04ab442317629bd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785779254, "uuid": "ff5d1053-2042-4046-9e9d-0b45f9216682", "comment": "Malware payload (Mirai)", "value": "8007594de8e194d7a4c73f6a63ff8d04e335177a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785779254, "uuid": "2c6790bf-8230-4d2a-ae52-c212e09ca7fe", "comment": "Malware payload (Mirai)", "value": "e301e1394beb088534ad782e5fd4e0b6d8e656d6e408ce98ff6a6c7741497fe05dcd39e879a28dcf816267300cb98790", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785779254, "uuid": "2ad5cadc-75a8-452a-aeb0-a5dfdc42c53a", "value": "T1E5A35DD7F401DEBDF80BD5BA04670A0AF970E3A51B934B2A6357BD67EC311A50C26E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785779254, "uuid": "6aa281b4-9196-473f-bf2c-ebc625942a16", "value": "1536:CPBhJrOJJpeR1TG6jiM3t8fwgIRhvJAuj7wVnW9fdsgZlQSK:CpKJfC1PB3ZDhBzR9fdsg0SK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785779254, "uuid": "792d95f7-2760-435e-9cba-8a1dca1597bf", "value": 106744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785779254, "uuid": "93613682-14d5-48f1-8510-c5be2d66abc2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785779254, "uuid": "5c7e1933-c940-4dc7-a7fa-c88d6d1e42a0", "value": "lkxstress.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f76ae96b-8f48-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785767897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785767897, "uuid": "8da8627e-55e1-4e14-8239-ec0eb3ab2621", "comment": "Malware payload", "value": "05c1e11edd088b3cb22fabbf83fcbaaf", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785767897, "uuid": "7952315b-cee5-467d-8b86-704f04ffe102", "comment": "Malware payload", "value": "7bf6f7ad07897fc1668997a9af3eea751fd6166f691f6db5acffc892b953ec40", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785767897, "uuid": "dd48775a-19e1-4448-96d6-49fb25cff4c6", "comment": "Malware payload", "value": "16151214c7dc38e6dee3fb2bfe96e8347d7ccecf", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785767897, "uuid": "b0e9669f-6dc5-4714-88d9-dd9cb9ad160b", "comment": "Malware payload", "value": "c79f6fb39191120aeb718f1d9189fedd7f96b187bc29e17130da1013eeabf18b52e1bb89c26b08d0f00d699454a247e5", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785767897, "uuid": "6a7d68bd-855b-4b7b-92cf-9518d84ce552", "value": "T159236D651A857C24AA98C4371D7E2F0CBDAD43E6320492DE7FCA3CF28C5A69DD10972D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785767897, "uuid": "3a50bc99-2577-486a-a400-2d93dfed1185", "value": "768:1XRWNGxV69GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:flx1cr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785767897, "uuid": "67421d75-4b55-4c94-98af-164c72607c31", "value": 50035, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785767897, "uuid": "e2876c08-c2de-42ff-90f6-c013694f8d14", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785767897, "uuid": "f60e95cc-bc99-4733-ae83-9cf2db9af1c2", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36a0ec95-8f70-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785784754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785784754, "uuid": "b6e393c7-7f5a-4a2f-a4ce-648a7c770e02", "comment": "Malware payload (Mirai)", "value": "fff2664f85163b4b958196c7b28bd813", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785784754, "uuid": "46ece65f-7aea-4d3e-8f0c-a5567b253aa3", "comment": "Malware payload (Mirai)", "value": "7c3be436c9041afe3156b3ad5c8b7629dafaa200cdf9ada25052ab30d3fdf609", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785784754, "uuid": "2453760f-1805-4ec6-a372-bfe6267b65ea", "comment": "Malware payload (Mirai)", "value": "6f612ab72bad2d07d15444dc683b94eda270b46c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785784754, "uuid": "c644e930-3cf2-4268-9fcb-0c80375073b8", "comment": "Malware payload (Mirai)", "value": "e795dc913d289ebc1130e34c4da22f8aca58fdd924bfd0e1c0a6132ca25acfd7facbc660a87a7ebafa536a20011d57e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785784754, "uuid": "b03ecd6e-4281-4860-ab43-8cd5ac0010f2", "value": "T1827312E017B5178C1276E8393BDD306E8024722A339A29246D9751CEF81B713A573DBD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785784754, "uuid": "170bb6c7-a328-4314-b700-696f5287e35f", "value": "1536:87vbq1lGAXSEYQjbChaAU2yU23M51DjZgSQAvcYkFtZTjzBC:8D+CAXFYQChaAUk5ljnQss0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785784754, "uuid": "19d6096f-2c46-4840-b3d2-7e97357be48e", "value": 74836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785784754, "uuid": "d12f7d9e-a809-4660-bc29-1b58cefca5b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785784754, "uuid": "4f3831c0-18a2-4281-ba61-56d48f631aa5", "value": ".i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0343d71-8f08-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1785740263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785740263, "uuid": "3d6589e3-8570-46e4-967f-10ba2d533edb", "comment": "Malware payload (ConnectWise)", "value": "757abb3547b0acc97406fde1040b4355", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785740263, "uuid": "dd8423ce-00f9-4c47-b3ba-0e2fda43af3a", "comment": "Malware payload (ConnectWise)", "value": "7c4fb856263c296cb133bab86a652e80b956b94f10c9e1873db8f35891b823f9", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785740263, "uuid": "9a46baec-bd3b-41e1-b5ef-49905be837ed", "comment": "Malware payload (ConnectWise)", "value": "efe0bea4a9eb0535435f39a117bd5b1dffabe0bc", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785740263, "uuid": "62d603ce-2688-4b6c-a76d-ac7ca8cc76f7", "comment": "Malware payload (ConnectWise)", "value": "0a214fe2b2e7ae67c6c530d33e99885ae82f1ceebc0cea3bbec76541913ec16d3040be0fe59a645a6f6a8371daaa5cf8", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785740263, "uuid": "76643675-f017-483f-8e2b-febde06e8184", "value": "T120646C11B9C48432C673383147B4E2B28DBDB8301D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785740263, "uuid": "d735d744-db90-4918-9863-b106af8c8aa9", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785740263, "uuid": "9bf11f54-6440-406f-8a38-5fb5473dc288", "value": "6144:KmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9sW:51iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785740263, "uuid": "372097cd-4d90-4599-b26d-66d3dbea07f5", "value": 312552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785740263, "uuid": "4690aede-2e51-4052-be57-3684f68efd7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785740263, "uuid": "9f86dd2d-7417-495b-8a7e-bdae345d00e3", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4adc99c-8f2d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785756269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756269, "uuid": "1aa0dff6-8e99-474a-912e-37d0a7d7eb83", "comment": "Malware payload", "value": "ce3a4c7806c527b8465e62f99d400cce", "object_relation": "md5", "Tag": [ { "name": "dn-pdflite-lat", "colour": "#BE5FA0", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756269, "uuid": "05e986ce-ea10-4d65-9d09-9555a2446a04", "comment": "Malware payload", "value": "7c65c58e0a72b00b1ef2e15dfb1bfe8cfcba4561e80b70ee9b00b005b8f841ed", "object_relation": "sha256", "Tag": [ { "name": "dn-pdflite-lat", "colour": "#BE5FA0", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756269, "uuid": "c57f760e-2f14-42b8-9ea1-5cdea028cbd5", "comment": "Malware payload", "value": "ef696e18dba9a098aea502151d5a3c504dcbd1e3", "object_relation": "sha1", "Tag": [ { "name": "dn-pdflite-lat", "colour": "#BE5FA0", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756269, "uuid": "861b4396-e54c-45ee-98b3-37ccfaf67080", "comment": "Malware payload", "value": "9ee959faaf9e1efc7bb9d83c29c2a5295c50ae7697ee8adaec1097d6a5ae5498774f6a6b686a8b3194bd3577534bacfb", "object_relation": "sha3-384", "Tag": [ { "name": "dn-pdflite-lat", "colour": "#BE5FA0", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756269, "uuid": "02ab759d-2c8f-4fc2-82d4-504eb745bc0a", "value": "T18C2379B77A4642D6FD3288BB596F608D24A51A0223A5D0B8F2DFDC00AFCCE8D49747C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756269, "uuid": "f03c79af-5894-4787-9c19-17127f219c00", "value": "96:5VkRw1r3utHPmlyS2bxCBmGiUnydy5/R:7sw1r3ut+lcbzGiU/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785756269, "uuid": "9753141e-575f-4987-bc00-af46d62eb77e", "value": 47104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785756269, "uuid": "0a1049c6-e469-420d-b3bd-83879f4bc059", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756269, "uuid": "e355a2de-af3d-4485-9ab9-9f1ef08cbb82", "value": "LEITURA TAROT.pdf-AHFCQ7.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a49a2bd-8efc-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1785735045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785735045, "uuid": "a46fe2a4-731b-42bd-8910-e559e7fd2c93", "comment": "Malware payload (AgentTesla)", "value": "44cb9623531e798323d094aaff54d973", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785735045, "uuid": "8b1bbca2-3035-47e2-9d00-a443d367cbf7", "comment": "Malware payload (AgentTesla)", "value": "7ccef409f9449f533035536ce52a82ec3d668b61f3152d66a5e0d1233e6ab973", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785735045, "uuid": "0b28fe7b-febb-4d9a-9555-57de55c09a73", "comment": "Malware payload (AgentTesla)", "value": "9b374d7e9d721fb04ee61f433bb066d39c46aac1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785735045, "uuid": "c0b9a9f1-dea6-4719-bc01-86bf2b8d6053", "comment": "Malware payload (AgentTesla)", "value": "8ffadf30c7f37a55d8e323d6d15d43d10376bc30ff6fcd414a289254048e8448ad80e209c28495a1e8613d6de0406619", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785735045, "uuid": "b5de52e3-3c42-4d9d-8eef-3abcf2f7a23c", "value": "T167F5299917C691233730FBD94239FC31D11A5E931195CE1A38BEE629BB2DD08A714FB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785735045, "uuid": "d173aee5-105b-4de8-b6d1-582a69054dc6", "value": "98304:a1nnO9W8RcZFnqa/A6KWjPYGS7M4rFM/dM0l+V7MgdFqY9OQlzVOMxvZYrWumMdV:a1nnO9W8RcZFnqa/A6KWjPYGS7M4rFMR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785735045, "uuid": "e65c2a56-9de5-49d5-ac84-330e083f7e7c", "value": 3408724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785735045, "uuid": "b9fb5383-7e16-46d8-a1a2-7c335469d60f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785735045, "uuid": "5f8f6979-4c65-4ce8-af0b-56c7ed916393", "value": "Invoice2203.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce5a2747-8f05-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1785739052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785739052, "uuid": "9f82c866-efd2-49c0-a987-01050b840c54", "comment": "Malware payload (ConnectWise)", "value": "cf0e4752110843072b8dd62821cc2211", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785739052, "uuid": "8bad9870-7817-404e-a196-6f2f9bac5085", "comment": "Malware payload (ConnectWise)", "value": "7ce380e768617653d430e5547b5988516f9bc72020a7deaf79b7e68127b20688", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785739052, "uuid": "67ce3532-3a51-4835-a3d4-755d55694874", "comment": "Malware payload (ConnectWise)", "value": "15bbc99389c6f2fef1b035f39f1113800a30aeef", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785739052, "uuid": "51db80e8-67f1-477b-b5a9-828eb54f8400", "comment": "Malware payload (ConnectWise)", "value": "262d7c6ad2f63e53ebed1eee6cdc8c2df99958f2772d312a7264328b2427182a5acf0987fb8e559b76ea910a6e004bb0", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785739052, "uuid": "1fd0f2bd-f806-4207-894b-723cf718474e", "value": "T14246E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785739052, "uuid": "1eaa7842-a2d9-46fa-b310-f3c23d443e62", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785739052, "uuid": "233fe9d0-c93d-49c9-a504-0ff327919025", "value": "98304:IzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:IhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785739052, "uuid": "165b170c-0f68-409f-a023-4d9a5c78d923", "value": 5643008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785739052, "uuid": "c8af6896-117b-48ff-8f2f-d9db9281c11f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785739052, "uuid": "ef8f900a-8bf5-4050-9524-4cfba34107da", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b80703f-8ed6-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785718646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785718646, "uuid": "c09be824-1e9c-4456-bf3c-f99f975a39bd", "comment": "Malware payload", "value": "81da3ae86d90a32028a6538ce1cb53b0", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785718646, "uuid": "a850a6ff-92d1-4712-b1ba-2a5f69f6e939", "comment": "Malware payload", "value": "7dd3530e0ca2e0bbe2852f09685019c2e38c70866213d937539ff2060d46e819", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785718646, "uuid": "e24bee0e-bd19-43f2-b517-2d7f45d60f75", "comment": "Malware payload", "value": "d649e53bb2afc44404187477bc1b6c3b54a7541a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785718646, "uuid": "8543e82f-7748-4b84-a9d5-1687e8dc70f8", "comment": "Malware payload", "value": "fb40dbb5e5c68399ce8be8d76729fc8c5a9a7921ab0651cc956234e1342fc911eb0d48f6f2550fc2cf7c0ea0718ccf17", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785718646, "uuid": "74a1ecd4-77e1-4243-800f-f00e98aa4865", "value": "T15901AFC6E1109500409AD55D2AE75455F821C3C71A4B4BB9BFECAC3E9B98D14B036F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785718646, "uuid": "14244c5c-5d91-4a4d-9874-d93a5eedad7b", "value": "24:kXCKysE2hi0ziQvZohau6FyQEZVSEpUSdX:e9Qp+Msuuy3ZVSEpUEX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785718646, "uuid": "f2b8de4c-0864-427c-9e26-0f00b5e35ca5", "value": 848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785718646, "uuid": "fd9a3fb6-8b8e-4b4c-b483-2133119f6b12", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785718646, "uuid": "6499213f-0fa8-48ac-b4b6-203c81027470", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a08b3611-8ed4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785717930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785717930, "uuid": "068ee3bc-5662-4ddd-a5d3-6c70602e934a", "comment": "Malware payload (Mirai)", "value": "291d80a4aee0ef703af75ef933af467a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785717930, "uuid": "37ba41d4-fe62-463d-aa35-ef42f9f9b121", "comment": "Malware payload (Mirai)", "value": "7e149890b2a6443eaf6d2569c824d5d578c7f6f1a55452e552a452c4f930d922", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785717930, "uuid": "4bd2a0dd-4ecd-4a22-98e6-2b83d5684e36", "comment": "Malware payload (Mirai)", "value": "d8bfaa78073e0dc39003b9870218c6a86c0d99c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785717930, "uuid": "5cebabf5-1177-4bbb-b5ab-7e60d8745ff9", "comment": "Malware payload (Mirai)", "value": "636aa53f9a3715178b59d4c6bcdcd58a4c0b98dbd731f39198a1d038121d9f07844656800f2fc7d2b21b0a5ce6d883ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785717930, "uuid": "ffdb19a4-c564-4ecc-b8cb-e4f98f7afd6b", "value": "T18FE2F12002BA5E75D02089FD6779C7194B6F0BB4C7E63671692BC53CA94800DE6BD7A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785717930, "uuid": "7549d87a-7868-4868-a1ea-a76ef6b2615a", "value": "768:5Z+aFyUpi8s74xEOo0gYqLQmF78H+jPGfW8s3Uoz3P:5ZVs73sgJLQAdaQzf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785717930, "uuid": "a60f8616-9d52-4e40-be29-0c9cd3c7793b", "value": 32844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785717930, "uuid": "bcadcd27-9993-432a-92ae-9d507ccffc1d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785717930, "uuid": "2e6ebd7f-0941-4d10-acd3-2281c43940e4", "value": "nz.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baa24d4b-8f68-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785781539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785781539, "uuid": "78fb4c38-56b2-4660-b172-7884f37fcd44", "comment": "Malware payload", "value": "d94b1e7289fa5005075033426f69651c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false }, { "name": "wacatac", "colour": "#580106", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785781539, "uuid": "50186275-8783-4f8e-908a-3b340420d66a", "comment": "Malware payload", "value": "7e4977e65e02f14000a305ddde3e28792603ea9cdf0fb40e6671653f720cdd56", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false }, { "name": "wacatac", "colour": "#580106", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785781539, "uuid": "bbdaa60b-6f7d-4cb4-b748-4e651a580db9", "comment": "Malware payload", "value": "826d6fcdb8ab24f3e68b38c1e7987c086dff11c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false }, { "name": "wacatac", "colour": "#580106", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785781539, "uuid": "d2720807-8565-46cd-b333-210d7772cf1a", "comment": "Malware payload", "value": "c502e65d951dfff0a9aefa8b4ff4f9b816c8ab58210f93ff314adf6e86859188a41190b6d0e7d079458b5d40f534d367", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false }, { "name": "wacatac", "colour": "#580106", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785781539, "uuid": "d7068524-3281-4db6-94e1-8b071b62ceac", "value": "T141D623EA95D522E4D5C30AC0B64E53CE71D0611E46EDAC2D3ADB2C42AF26D6F410EE73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785781539, "uuid": "d2fac59f-4fb6-4662-89f7-9920add9eda9", "value": "9c52722bcb851682eb2fe8dcf6c933af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785781539, "uuid": "75a8e0d8-f63e-4638-88dd-f8cd352d309f", "value": "196608:cXUcCjqUcG+klmJRfKyZmLnSMMxAA8qtM0k8ddfMhPPfsW+XHCD3y1WQXlwqorV7:cEcuCkwJR/mShxaq1Pfm3fVCwZtl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785781539, "uuid": "366f3915-a061-4104-9008-61bab2530ee7", "value": 13412352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785781539, "uuid": "bc53074f-de27-44f2-bb18-3bb47f473353", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785781539, "uuid": "92e43530-3351-44d9-aacf-d4a97f9bd101", "value": "SecurityGuardService.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7b808e4-8ece-11f1-bd95-42010a9c0009", "comment": "Malware payload (NetSupport)", "timestamp": 1785715499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785715499, "uuid": "2118f276-43b9-428a-b527-0a14acffc006", "comment": "Malware payload (NetSupport)", "value": "ce65b3efe7b1bdb095ab16ad58083901", "object_relation": "md5", "Tag": [ { "name": "216-158-95-194", "colour": "#1FF850", "exportable": true, "hide_tag": false }, { "name": "45-227-254-179", "colour": "#A1327D", "exportable": true, "hide_tag": false }, { "name": "89-34-90-203", "colour": "#158A76", "exportable": true, "hide_tag": false }, { "name": "jpgomd-com", "colour": "#EF52AD", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785715499, "uuid": "d87266b8-4701-47e7-aaf4-76b18ff5311f", "comment": "Malware payload (NetSupport)", "value": "7e750d93404ccb98bfab8ca03c5b64e09ac4933a404d6f4596ff9897ad3b43e3", "object_relation": "sha256", "Tag": [ { "name": "216-158-95-194", "colour": "#1FF850", "exportable": true, "hide_tag": false }, { "name": "45-227-254-179", "colour": "#A1327D", "exportable": true, "hide_tag": false }, { "name": "89-34-90-203", "colour": "#158A76", "exportable": true, "hide_tag": false }, { "name": "jpgomd-com", "colour": "#EF52AD", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785715499, "uuid": "e9ed9bdd-fcc9-4f0a-9965-6524b27ad095", "comment": "Malware payload (NetSupport)", "value": "0f834a421edb4cdf3ff51c175664b3e5cf37a7ce", "object_relation": "sha1", "Tag": [ { "name": "216-158-95-194", "colour": "#1FF850", "exportable": true, "hide_tag": false }, { "name": "45-227-254-179", "colour": "#A1327D", "exportable": true, "hide_tag": false }, { "name": "89-34-90-203", "colour": "#158A76", "exportable": true, "hide_tag": false }, { "name": "jpgomd-com", "colour": "#EF52AD", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785715499, "uuid": "cb8c88dd-7300-4782-90ca-0a09000c446c", "comment": "Malware payload (NetSupport)", "value": "2de4e2491364d891157fffd8b56b19426ca6b7def46ba63402f0b6bdccea0f7d2e98873996b3d11e9f4d49e56fc3c1b3", "object_relation": "sha3-384", "Tag": [ { "name": "216-158-95-194", "colour": "#1FF850", "exportable": true, "hide_tag": false }, { "name": "45-227-254-179", "colour": "#A1327D", "exportable": true, "hide_tag": false }, { "name": "89-34-90-203", "colour": "#158A76", "exportable": true, "hide_tag": false }, { "name": "jpgomd-com", "colour": "#EF52AD", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785715499, "uuid": "2cf5d6f3-d2f3-4a2a-a6e1-70b75ed60560", "value": "T183B53378C801BBF1DA773735080B9B672E3A9F35AC248956D9243D9347FD67E680E428", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785715499, "uuid": "c59d52c0-0ebe-4058-993e-06dbffa91f4b", "value": "49152:Q7i8f2FbXks7Wq1V+rbmeu9vRoooGR7hgT37nupwcrUU:Qu8f2hkEWqsrbJ6DoGRlgT37SnP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785715499, "uuid": "b2f5dac0-bd8b-4f8c-bf3f-eb34024f6c17", "value": 2285290, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785715499, "uuid": "f126cf45-bea5-4f7a-9c80-3a519b9bc885", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785715499, "uuid": "f352ac1f-84fd-4933-bd9a-1914ac83d0c6", "value": "nets.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1ca28b9-8f2d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785756157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756157, "uuid": "aa2efc83-4a11-4e3d-a157-e5d7f7bff1fe", "comment": "Malware payload", "value": "d2cf8f90000aa3ce7424e74075354abb", "object_relation": "md5", "Tag": [ { "name": "dn-pdflite-lat", "colour": "#BE5FA0", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756157, "uuid": "52d79fe0-7188-4372-8929-cf4925633eed", "comment": "Malware payload", "value": "7f0ffa5db89d4c32a43a839ebf81879b39a533ed8fa8e68719473900bf83af54", "object_relation": "sha256", "Tag": [ { "name": "dn-pdflite-lat", "colour": "#BE5FA0", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756157, "uuid": "99ae33fa-e681-49b1-b975-419c640bcbe8", "comment": "Malware payload", "value": "c1c2b09923b6f219b2ff28b1d5153daa9e00e834", "object_relation": "sha1", "Tag": [ { "name": "dn-pdflite-lat", "colour": "#BE5FA0", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756157, "uuid": "7b751730-96b7-463a-9775-dfe7703b5c65", "comment": "Malware payload", "value": "a28e805bdb383e80d540ec3699fd0089cd4a94309fe2cb95fd15927cefa55d5013e4be0bcd9cae16f642a7c38b041ba6", "object_relation": "sha3-384", "Tag": [ { "name": "dn-pdflite-lat", "colour": "#BE5FA0", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756157, "uuid": "346416d5-926c-4ae6-97b7-2b6897b04fab", "value": "T1FC2367F77A4652C5FC3199BB1A6F219914A0164223A2D0B9F3AFEC00AF8CF5945783D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756157, "uuid": "44285198-dfd0-4c09-8f05-64085c149e2f", "value": "96:5JJwRwqN2s9Sf3Lfc/ZOHZbTzOCICd/R:rJww42ssPLfc/ZOh3OCICd/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785756157, "uuid": "763b6c0c-5012-4be0-a56b-5944e7fa06e7", "value": 47104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785756157, "uuid": "bfe81065-1bf3-41f7-bb6a-a32af7bb61ef", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756157, "uuid": "7c371a98-c5d5-43bd-adc7-617d54af8056", "value": "Nota Fiscal Correio-2PVMRH.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df624412-8f6c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785783319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785783319, "uuid": "091ba6de-5ab9-4b54-ae2c-b4bd3c0ff974", "comment": "Malware payload", "value": "b345b8e24e513bb4e8b8ef37a3aacf22", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785783319, "uuid": "6b82e044-6ecb-4d93-803e-b4b2ce7ec735", "comment": "Malware payload", "value": "7f6a4ca56a7e18601ffcc7def9c4b3bfb1eb7ad143cc89d0c85dff367ee19302", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785783319, "uuid": "a92f00ad-67a1-4256-9805-e966708f7168", "comment": "Malware payload", "value": "fc8824b541ff90bf390e4425bb213a3ffbd0475a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785783319, "uuid": "9c9c7e29-23b2-49da-b621-8d0979fc1a05", "comment": "Malware payload", "value": "f291c7251a6d12b9d539b54a86dbc1ac5903ea739b3a11fecadb106eeb0cf58771923e2084cf44f84c3124b8ac69f0c9", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785783319, "uuid": "af4124e1-c3ec-43c0-a820-bee407daec66", "value": "T1FF016BCAC320AD004059DA5E629B55E0B411D3CF154B0BB87F9C9D3DFB98804B127F98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785783319, "uuid": "093a17a0-7783-41e8-8bf4-c6748394681b", "value": "24:kXCKysE2hi0ziQvZoha1SMiWOFKXeoXsI7:e9Qp+Ms1SNWiKXZXsI7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785783319, "uuid": "af3a9af5-9392-4362-b052-2d0417e02ee1", "value": 839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785783319, "uuid": "50c1b80e-c823-4d7a-939c-749cd4116154", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785783319, "uuid": "8c0ca03c-0544-4631-b76a-fcf1ccfd7416", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ed87716-8f3f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785763641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785763641, "uuid": "149e964d-b9a5-47aa-afc1-9ec3f8966af9", "comment": "Malware payload", "value": "fdc08d34e3ae8eec63d581c607f42091", "object_relation": "md5", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785763641, "uuid": "5a331707-b53e-44fd-bf57-460c2ed1ca4f", "comment": "Malware payload", "value": "800bc5607e398b3233bbe6cf6601adf757766ce68460eb3dcf808f975ce40d9b", "object_relation": "sha256", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785763641, "uuid": "c7942e39-f668-4c2a-9ddd-036fcd667d6a", "comment": "Malware payload", "value": "ea21bcc2f9dcb5cafc2f9cc1d409d8b8494ef991", "object_relation": "sha1", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785763641, "uuid": "4251285f-6647-4db9-9370-49af97294373", "comment": "Malware payload", "value": "1480f0b733e710e94d5e101c6ebe18ee4a8c545e801dea2f3a17d2fb954e4ac7c1c44657c3d40642aaaef9a68b63c0f2", "object_relation": "sha3-384", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785763641, "uuid": "1d5b95d2-d443-45cd-9361-0c9f7024be42", "value": "T17843A978150558D78113BC01E9831A96CFE4D21326EB1EB9C341A6CA07DE7DBC8B6DEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785763641, "uuid": "f439aa78-1e7c-40cc-a0ea-1fe8894a0afc", "value": "768:iiwg7rQIJmm4LiK2u164t+oVCO7mrdJLZ0BKeIooPic3840Q:dTS13WHrLLh0Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785763641, "uuid": "90de9eb4-550e-4ef3-b24c-cd28988f9b64", "value": 56079, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785763641, "uuid": "2ee713d0-c22e-440e-a797-d45e64e5765d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785763641, "uuid": "e8bc8da8-ac09-499f-aaa2-557bacc3639d", "value": "rck8893214.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eab1fc3-8f03-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1785737925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785737925, "uuid": "3c59db3a-8852-4851-8841-a9bf8eaf480d", "comment": "Malware payload (Formbook)", "value": "16442e1a8967c56f3051f993265a156a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785737925, "uuid": "7dfa4903-84a7-42bb-9ae0-44acdaa5b6c8", "comment": "Malware payload (Formbook)", "value": "817f4fd56392bbd9fb580a9b416e493a2bcba582529354a81af5eb7d12fb2406", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785737925, "uuid": "c7eaf058-e6b4-44d5-8567-bb0f7bde8454", "comment": "Malware payload (Formbook)", "value": "de54a380588f843c3ed10c5b493ecbd86333867e", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785737925, "uuid": "c69413dc-2a2b-4815-9b21-eae36c97ea7f", "comment": "Malware payload (Formbook)", "value": "a37b1ccbaecd76ac9eedd44afedc268bdf0230a9e30b32ad51b87027e5336e48c74c4945df51db771bcd6bc50570181f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785737925, "uuid": "ef66089f-ece6-4c9f-86d4-fda1a9ef1d38", "value": "T133E5D9B667EE650B5F083349784E78988F8ED1141E4337D038EF42E81A5E36476E49EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785737925, "uuid": "9e6454da-c892-41f9-9966-2f3cab27791f", "value": "24576:102cWWSgHDDVBjA0ph8ZIgazv8gIdYdY2m:+UDgHDDVBjA0ph8ZIgazv8gIdYdY2m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785737925, "uuid": "40532bdb-2cbe-48cc-bd0c-b3bfc4e233fa", "value": 3166370, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785737925, "uuid": "66186d6e-6453-4452-8912-8f9a3e4e99aa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785737925, "uuid": "68c8bb2e-e738-4359-9e2c-5a4471c4b343", "value": "Shipping Doc.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b45d7b08-8f3a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785761772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785761772, "uuid": "1b3bb2c1-b4be-4199-9150-b5f16f9b00c5", "comment": "Malware payload (Mirai)", "value": "c676496265faf9da8af520ed78869a0c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785761772, "uuid": "c83211d7-05d0-4f43-b4d0-072369d4f041", "comment": "Malware payload (Mirai)", "value": "822588a3b06a0fb2c7f2984906d995c9c37c74980e4303f23482e45c334aed9b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785761772, "uuid": "12b29550-fd73-403e-9dbf-74e43aa47ee2", "comment": "Malware payload (Mirai)", "value": "2852698c7e9878b7c179a95b2444068185368b52", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785761772, "uuid": "f6040934-fb7f-473d-bd6c-3448eae3536d", "comment": "Malware payload (Mirai)", "value": "c676192ddb721fe2c24bcca2dd6b2fdc4578e2db3adc0fb789ef384f5e034b6eec3f09d574a190d7cbf0108b7e70f1a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785761772, "uuid": "62706d2a-bca0-429c-8b47-55d5eee7bb9f", "value": "T1D643021DD009DA8EC9EE17304C0DB4AB23C93E177CA14E5B4DA266811152FFF5D4A9EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785761772, "uuid": "2e69b937-0f66-4160-ad52-12ba97a7090c", "value": "1536:MwNU7LF+MukKdO+gBzUSnCkuE+qW/8+QLStGSQfE9J:nNU38M6dO+7SnCkuVae/QfET", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785761772, "uuid": "6d86cfc0-8133-48cb-9cb7-72b43b4427fc", "value": 56252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785761772, "uuid": "692b4496-e653-4779-85f1-11310593c2f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785761772, "uuid": "454add66-0773-45f6-96bf-1155c9d09bc8", "value": "miron.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1882321-8f3e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785763512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785763512, "uuid": "2bf76375-e20b-4784-8a61-bcf02902bd37", "comment": "Malware payload", "value": "f0454d382de3a2d3e49010ad78682c6f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785763512, "uuid": "f93c2abe-6136-46b4-a0ff-7f7cd50734a4", "comment": "Malware payload", "value": "827aa0a0191b7820d50c6c6c69d0e57ae95d5902d7b800b295ac52c5a1501bc4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785763512, "uuid": "2113ea11-1c44-4459-b6f9-d986d1713e29", "comment": "Malware payload", "value": "9736709870691b836e33bac94890b79eccec5e55", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785763512, "uuid": "fac359e7-e48b-44e6-9eaf-c42bdce46dad", "comment": "Malware payload", "value": "04471424ee7b136fc0beb28419dfbfb33c8848036eebad045cb24ccac336e3a08a20df5764d60eaf239e8c5ac999d461", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785763512, "uuid": "5c9e7595-dcec-4c54-8f72-0ee9717e2809", "value": "T143A32959BC829B15D4D522BEFE0E518933635BBCE3EE7112DE105B2127CAA1B0F7B502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785763512, "uuid": "219d33ed-499a-48ca-9956-49fe4b6282b5", "value": "3072:emCTUj9mHjSzxECnF0pfpJFWearhpAjDWMPgWF/IyQ:dCww+zxECnGpfjgearhpAjyMzFQyQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785763512, "uuid": "b9b37503-426f-489d-bf67-bedf92ca113b", "value": 99996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785763512, "uuid": "afa08899-a093-40a2-a955-d446f5ba0a29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785763512, "uuid": "2b64adc8-3002-4940-abdb-d4b1e2e53a7a", "value": "lul.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bda2fdd-8f09-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1785740470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785740470, "uuid": "354303c9-37ab-482b-b0c0-2d1491156e13", "comment": "Malware payload (ConnectWise)", "value": "60511ee1058c13f963c30e60d4e1009d", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785740470, "uuid": "d035f3f0-5052-4fc1-a8e0-fb3854476261", "comment": "Malware payload (ConnectWise)", "value": "837c1cb7a091df16151a2747539ffda36f0c6dbe07e3ad4c5777476b596afbde", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785740470, "uuid": "767a6bf1-7c19-46fc-bf3a-272ea1247def", "comment": "Malware payload (ConnectWise)", "value": "e124e2e20cbe9f746cfe26aec839d1030a29ca26", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785740470, "uuid": "a41f1876-4bc3-4d85-af04-d33e92f62e3f", "comment": "Malware payload (ConnectWise)", "value": "21a0fd3bc6c099011adfa67e0997dc3b8078638b91404c1654727aa0664547350d1dffbdcdf80caed5efe60b95808449", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785740470, "uuid": "7a4a138a-70d6-41c1-b548-419d05119378", "value": "T124647D11B9C48432C673383147B4E2B28DBDB8301D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785740470, "uuid": "f362ef78-866d-4dbc-8d08-6144eac3f86f", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785740470, "uuid": "0838e05b-d5f9-449d-a010-c8d2a2fe12cf", "value": "6144:imlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9jK:h1iw7gryNkSV1hy1Z1u2JLu9+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785740470, "uuid": "663b075c-4e5a-4a85-bd3b-f45222c2e87b", "value": 312560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785740470, "uuid": "4159a7be-ede6-436f-9483-2865b5e6345e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785740470, "uuid": "df4cd78c-c9dd-4a77-bf2c-d1c438de28bb", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acd004a4-8f2d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785756176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756176, "uuid": "bfb45678-a9e2-4f52-bd38-736f1f4f625b", "comment": "Malware payload", "value": "d538fd3fa9f3e516a6f7e8ab1c803f63", "object_relation": "md5", "Tag": [ { "name": "dn-pdflite-lat", "colour": "#BE5FA0", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756176, "uuid": "e125eac0-ac6f-4344-acf7-d13bf80a5aef", "comment": "Malware payload", "value": "841901f80e01059e71be39ce03f823b7e72531563af65b56d6432f4ad99c1b33", "object_relation": "sha256", "Tag": [ { "name": "dn-pdflite-lat", "colour": "#BE5FA0", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756176, "uuid": "9b23eaac-6bd4-4195-bfda-0e0b3e75a7a4", "comment": "Malware payload", "value": "14e1ab94196287739d1cba1949ed8921fd5d5e52", "object_relation": "sha1", "Tag": [ { "name": "dn-pdflite-lat", "colour": "#BE5FA0", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756176, "uuid": "14a31258-0e61-4b2f-bee3-c94486f7f4ee", "comment": "Malware payload", "value": "0b9bfec347e71449c191ca84b718b079151d4895172cb0c90b9256de08716463f655ff123331dd3d45b5dc03f1d97aed", "object_relation": "sha3-384", "Tag": [ { "name": "dn-pdflite-lat", "colour": "#BE5FA0", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756176, "uuid": "49208c19-75ed-4618-8b27-f46c3bff6925", "value": "T1A72327F77A4252C6FC7199BB2A7F209D109467022366D1B8F39EAC01DF88F4945743D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756176, "uuid": "b51579c2-661c-48c6-8d48-0284b610c118", "value": "48:5I64nIf3ZRwFNXs4Y6kSUYgPg9rP5u4pwGex3ik3DN:5C6RwF1sF6FgPgJ04p+4k3R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785756176, "uuid": "ce10b01c-07a2-4f01-8426-b954c75bae6c", "value": 47104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785756176, "uuid": "47358518-b4c9-4071-9553-42551c0c07bc", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756176, "uuid": "867fffc0-b9ef-4b6a-a6f3-238ecea1c5b9", "value": "Nota Fiscal Correio-15NPPD.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bcc9951-8ee0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785722968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785722968, "uuid": "e381da24-95fe-4e4d-8d9f-a148f5705399", "comment": "Malware payload", "value": "73d28313ee1738761e81e47ab77e780d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785722968, "uuid": "f05fce12-284d-43a7-8646-95289b3db40e", "comment": "Malware payload", "value": "858dccc67180f5a95a51e0f80e5adb603c0b9dce7d9a8999a964eeb884498e9f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785722968, "uuid": "efcfb0a6-b8f5-46bf-907d-ee1102a9a32d", "comment": "Malware payload", "value": "20e68c410cff500cf758d3d376ad7c412ba43afa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785722968, "uuid": "728a07df-9df1-470f-92f9-17daf90e8290", "comment": "Malware payload", "value": "1cea4660d545415bd96d5ad1e786fb2e6036e5fd3455f5712f08622c98b04c7299fde3978a38468af1daa67da8b1f5e9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785722968, "uuid": "84d0780c-64cc-47ec-8d5c-e4cb14c2d9d0", "value": "T120E4AD03FA20DFADD515613128B38A5567FA15870BE71247C368DE31BBA036C892FBE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785722968, "uuid": "63789ea8-5300-47a9-81e1-73133238f86d", "value": "12288:b/czJzU6gWPOXZPa4v37jPceRqHuek23iOJ6:aeXXZF3VIEC6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785722968, "uuid": "c590cb48-94d0-4676-91b6-2816a2e94a8f", "value": 666115, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785722968, "uuid": "e95f1a57-6084-458e-bdd6-72d9b1a616a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785722968, "uuid": "3c35620b-0f45-4020-88b3-ad53c9bd7ce4", "value": "bot.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c6f7edd-8f38-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785760873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785760873, "uuid": "347c08bf-72d7-4771-8a09-dd5b58807f2f", "comment": "Malware payload (Mirai)", "value": "f25526421273cd6d83f3964b1a99e47c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785760873, "uuid": "34a3ea67-5cce-4a13-9f55-bc5231c1da4d", "comment": "Malware payload (Mirai)", "value": "862b38086dff9382c886440278837233b12cf71fe4b2b5ab5eaa82fd61703bba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785760873, "uuid": "99a9f442-d8c0-4a70-b072-dcd837633246", "comment": "Malware payload (Mirai)", "value": "1741b21e4a44037f5df0b512aacf52f25a611de9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785760873, "uuid": "f841915d-9d57-4041-9dd1-86a2e9f5273e", "comment": "Malware payload (Mirai)", "value": "1fbe9f2ff271cb2d4edf3af2f1ca3794f2558440d8c79d0471843d04017ae6f79fdac044eb74469a931fc15186b72aa8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785760873, "uuid": "771445dd-f971-4c4e-8ac5-4cc310064b44", "value": "T179140785BD826A15C6C316BAFF1F118E37574BE8D3EA7222C9140B3527CB51B0E7AD06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785760873, "uuid": "8b05245c-c2d9-43ff-9801-147a259b45a4", "value": "6144:G+hd4qhryNKQp30yPacDs+jpMwFANZsi8:5D4qhryNKQpEyPacDs+jpryjsi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785760873, "uuid": "42d7c7dc-06b6-4b57-83be-5ea865069295", "value": 202928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785760873, "uuid": "72b93e9a-24e4-49ca-979b-e22ad917b1e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785760873, "uuid": "1c23da2f-316d-4755-a394-5efa719060f5", "value": "tarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "574bf773-8ee0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785722961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785722961, "uuid": "63860759-020d-4b59-942a-dfceb47b4a9c", "comment": "Malware payload", "value": "0ceb5049e9053e91f09b6d5fc15c68fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785722961, "uuid": "d66ea9f9-cd2c-4faa-a47c-fab8a8ef734d", "comment": "Malware payload", "value": "87eadab4c1b3397ac16fdf6807843c0a3da617ff4a2bfe97f015d9e104578859", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785722961, "uuid": "70473760-9d52-421e-a487-306359178e7e", "comment": "Malware payload", "value": "c3cff1b684c332f1ee9d519fb9429f4bc2b94dae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785722961, "uuid": "139495fe-4f8f-40ae-92ac-c2d198847739", "comment": "Malware payload", "value": "62947891c6d7eb9ffa9d6c201b0e637881fb1c9402822a9f477e7cdcd90003dcce757d7902717a1e93d5716a4b5e356b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785722961, "uuid": "541c84c2-17d3-459f-97d9-c04767f172d3", "value": "T1FDC4CE06FA0181B9D4B3A4B2520FD37AC93067349123899BFF5D5D64A63E6C0AF2E357", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785722961, "uuid": "8d950e9e-71e2-4b7c-b9d1-8ec8ef95b7b3", "value": "12288:9AwJBh86mlQPFFBmLv6hgKTD11Z/B6k2OA/s0Lx4oEKDcxvRU8tnQ+8TshKBS/6:2wjh8nlQVmrITL6kx8xeBRU8tQ+8gwBJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785722961, "uuid": "fb8fe495-bac8-49e9-971d-7eb8fb500c49", "value": 575410, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785722961, "uuid": "2990fa4e-4a4c-4b0b-a8ad-a64c2c3f0167", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785722961, "uuid": "ccdea327-12f8-48d3-8819-354913011eee", "value": "bot.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8690020b-8f3e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785763413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785763413, "uuid": "cc2bd733-38ec-45c5-86b7-bd725fee86fe", "comment": "Malware payload (Mirai)", "value": "d46a24acc6112687d17d5e9992b4ca24", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785763413, "uuid": "f4d4ee13-1d26-4ea8-96a4-555d3d6cd6cd", "comment": "Malware payload (Mirai)", "value": "882dff732a9c929d7e0cfd4f244a3ca94489caca9a1f6e6f62d99dae21508730", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785763413, "uuid": "392d11dc-0d33-4fce-beea-a2acd28edce9", "comment": "Malware payload (Mirai)", "value": "6bb9da912b285afc2dd32c4d2dcdfc17c058527c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785763413, "uuid": "b0493657-d452-480e-90cd-c9a98e92a3f4", "comment": "Malware payload (Mirai)", "value": "dba630d5c0134902dd6dffc9f272bda861efc22f524d0f9764f722d3e15fb5b01d79f254f45710a2ce9f0ce34dbfdcfb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785763413, "uuid": "90e47d6a-15e6-427e-8736-2f32171ee6e6", "value": "T120857D4AF6E364BCC097C430835FD753A935F4A911227E7F36849A302E66E705B2DB62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785763413, "uuid": "7f2d13b2-f951-4a05-91eb-8eb2e237bf89", "value": "24576:MK9g07cu9W7Dsi8zmPCOjx0QTjNuuQH6ngGtTdEWANBE8RFgnuuZ:Mqg07n9W7gNfk2QTjNDQagGtTdEDBnQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785763413, "uuid": "752e8406-ec23-4330-9658-701ea1d769c2", "value": 1727016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785763413, "uuid": "e7d387b8-ef2c-47d1-ac61-16d0e8674637", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785763413, "uuid": "1f424d27-394f-4d03-b43a-de15f03d80b5", "value": "eclipse.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d7f637e-8f3c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785762378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785762378, "uuid": "b59a107a-6132-4c56-82ec-1bb220cbed39", "comment": "Malware payload (Mirai)", "value": "08bcb0b59bae24d7fa8641dded5a89dc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785762378, "uuid": "0a065e44-e240-44f5-b9b2-76ac047661ba", "comment": "Malware payload (Mirai)", "value": "8be350f436d37f536cf68e01f5b278d31b0e71b904061af0ee3b84ad977b3260", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785762378, "uuid": "bdc5e919-268d-4627-930b-9a63d75781f1", "comment": "Malware payload (Mirai)", "value": "4c1c7575b41643b79294f466abb39d518540ae10", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785762378, "uuid": "a9b91071-25e6-452e-954e-e858229a1902", "comment": "Malware payload (Mirai)", "value": "3890bbc7e01a4718c6518e9a47d3ff291b610faa8500a4a8ee6f1be600c831850569638302cb1c30de06104bdbcba54e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785762378, "uuid": "90599a81-76bb-4571-b4b9-ec94798bf200", "value": "T198C3F846F8819B11D5C151BAFF0E124E77231B78E2DE73029D286B747B8ADBB0E3A505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785762378, "uuid": "d8c138ab-99a7-452e-9ab1-ef5ec645bfbd", "value": "1536:ybnRlXQl7xm72ByNu3TxIBYXykt6CLLSlivisKiFeI6fru1N07m0m0jOPZttN1a4:Zs72Xj+eXIaFeI6y1N0Ub1aT/uT7P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785762378, "uuid": "0e8b73b5-c4f5-43c8-a3f4-f99f9bba5baf", "value": 126972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785762378, "uuid": "ab7d0f9e-8774-4118-a1cb-7fb35d5f4dd2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785762378, "uuid": "16e57a5c-8048-423e-b453-c0cbfcd24dbb", "value": "miron.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a884e8aa-8f1d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785749296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785749296, "uuid": "5576332a-553f-429a-8837-ea90a144169a", "comment": "Malware payload (Mirai)", "value": "14ed6714d2d6e0a7faf80cc7fc34f8fd", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785749296, "uuid": "a3e41419-29b4-481c-a71c-16fa2bfbadd5", "comment": "Malware payload (Mirai)", "value": "8c27c639ae4e28be9298ae48c76d7fa800bfd0762368a328945cc347a1b30a2a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785749296, "uuid": "5241b997-f4ec-43e6-bc23-84d7c2412914", "comment": "Malware payload (Mirai)", "value": "c1b95ebfaa78be5cf453a34c8fe2471235a5fee2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785749296, "uuid": "8c1f9f09-b428-4d02-afa8-45ce47bf0f46", "comment": "Malware payload (Mirai)", "value": "ba7561368108dd721e646ee5ad2e62e50ff748028b72cb5577c930e40d7f0e30dff3a8d37085a2e6163b9f0e661dd726", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785749296, "uuid": "5cc86eb4-1e12-4813-b014-2da9c7380ded", "value": "T1B601668D731037FA12D28FA9FB599090EA039EF3619869B0F145283C305445C7A7BDAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785749296, "uuid": "614dfe4f-1e5e-4534-8c07-7e8e4e1779e4", "value": "12:+Cm+OuyLCEUavo0MFMDlMFhu633vr3iu3dpdUHo+4k/uz3vr3iu3dpdUH0cJ:lmGWlvcJdHv7i4SHo+qDv7i4SH0cJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785749296, "uuid": "434eff6d-ae6f-45a9-a69a-108d4a2dc396", "value": 834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785749296, "uuid": "c314a425-99b9-4444-89ee-7103111e21d4", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785749296, "uuid": "1a76952f-5fa3-4f50-bf90-15bd44d67db3", "value": "check3.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cbb1914-8f11-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785743881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785743881, "uuid": "9e3f5e82-5aa1-4cba-9c4b-df72b3e6e670", "comment": "Malware payload", "value": "562c6800a2596847f9d106ba0fd260cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785743881, "uuid": "67e7a205-0159-4239-b60e-5ed4d7b73c27", "comment": "Malware payload", "value": "8c3338996ecb06729c825efb145474e38f3cc597508d8fa81390218c62fc392c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785743881, "uuid": "e9e6da77-ed80-4e9c-94ce-5351ef576aa1", "comment": "Malware payload", "value": "6441e0fab3e73528b5a113410f5b15084281054f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785743881, "uuid": "350b6d41-1671-43f0-887a-d4dea0e5177c", "comment": "Malware payload", "value": "d7220c883271fc08fc82f76882bd2c79939ca8a91e05092ba788a78cf6d6f1c43c3e42425c275c42b054f5f854213481", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785743881, "uuid": "47bd984f-5c50-44a5-99b4-becf97d25183", "value": "T15EB70116A2E800E8E57BC278C6679233EBB13C55173496DF05A8E6552F33AE19F3E311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785743881, "uuid": "be54bb47-5ff8-42f9-aef9-86e84c12bc16", "value": "de1ba5a91e0cf722ba05ed41dc9a489b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785743881, "uuid": "73b24fb8-14d5-4bbe-b8f6-b9461d347b0b", "value": "786432:m7om823136tPFTnz0QrF0SZufO7+f6y0phnopi/O7Y:Iom883SNTn1u2Kyy0p1o0m7Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785743881, "uuid": "7e8112de-a871-4d67-809e-c3e69121836b", "value": 48322848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785743881, "uuid": "1469d478-929c-4a61-97e0-79039e786604", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785743881, "uuid": "18e3f658-beef-4079-a78a-2ab3a3caea67", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6de49829-8f63-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785779263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785779263, "uuid": "f15c92ec-ee67-4fc0-a40c-7c8faea80180", "comment": "Malware payload (Mirai)", "value": "cc1ca1ccadc5f2ddb2dbe32561e56618", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785779263, "uuid": "90116546-e407-4319-bcf9-6259a565f185", "comment": "Malware payload (Mirai)", "value": "8e41acea196c26387c2fe628a2bb0b14f4a4861be66068d07ce8e5a0a4204b84", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785779263, "uuid": "6eae8cdd-1ebd-4f9f-a111-8e089068448f", "comment": "Malware payload (Mirai)", "value": "1a035b943c1d80e85289af2baf8c90dea23fadca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785779263, "uuid": "17bb53d0-7956-40f8-a066-32db34dfdf55", "comment": "Malware payload (Mirai)", "value": "1469e1088fcfb55c085e3615c5bae104a428f7e16a5b08a41e5d03e1f304fae758139071f36053afc94df662817c62ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785779263, "uuid": "914008ec-1623-45b6-999f-758ad8647abc", "value": "T17DC3E81E7E258F7DF2ADC33447BB8E32A75923C626E1D585D1ACD6102E6024E141FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785779263, "uuid": "cd285094-0b3e-4aac-8b41-101994efcdda", "value": "1536:pCg6Bqf7cySKryVCkIfFOYYCS2eBDP0yMT/cBvsE2St2Xe617bsuxXD3h+G:x6euVLUUxAsyUBvsE2S2v5xXDYG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785779263, "uuid": "6b202f38-8a08-4177-bedf-54fac564fcf1", "value": 120388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785779263, "uuid": "5cbd4735-3984-4483-b36e-7b6389e3f7f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785779263, "uuid": "8e50dd91-a1a4-47a9-843f-4f2da31ed5e3", "value": "lkxstress.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2af3bf3-8eeb-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1785727946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785727946, "uuid": "6452fab0-c6ad-47d6-9eca-92f311ca2133", "comment": "Malware payload (CoinMiner)", "value": "9a81c38635fe029b2be1bf9285afd031", "object_relation": "md5", "Tag": [ { "name": "424e51f31d68f573a4621aaede8044aa", "colour": "#51F4DD", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785727946, "uuid": "b3f51933-7b81-4494-a007-c5dfa447d49d", "comment": "Malware payload (CoinMiner)", "value": "8eb363f0bffd430059369aa2c40d2bba8492a0fa58c159fdf2cf93f4d8084e75", "object_relation": "sha256", "Tag": [ { "name": "424e51f31d68f573a4621aaede8044aa", "colour": "#51F4DD", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785727946, "uuid": "b9b3861d-fca6-4e07-a374-a20b59c96ae9", "comment": "Malware payload (CoinMiner)", "value": "89142aa9e2d4194ca55aa7ca160162d6954213e7", "object_relation": "sha1", "Tag": [ { "name": "424e51f31d68f573a4621aaede8044aa", "colour": "#51F4DD", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785727946, "uuid": "76c6ee18-cac0-418a-9ece-5dd14a17ab3f", "comment": "Malware payload (CoinMiner)", "value": "c04f4173caa63738629c9dc8519c38a796e7b17868182cb4f29986d20a247e65a2756d3852c1cd83f7a5780ef75064e5", "object_relation": "sha3-384", "Tag": [ { "name": "424e51f31d68f573a4621aaede8044aa", "colour": "#51F4DD", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785727946, "uuid": "e86310eb-02f1-40f2-a8e6-a321ba51c635", "value": "T1413633D279C214B4D022D7F80696646DF4B6F77249703C6B39CC2A99DF9AE18423F392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785727946, "uuid": "9f85dab1-05dd-4910-aef3-210152eade72", "value": "35171f6f6a1bfee47cbc04cb345c411f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785727946, "uuid": "af42da25-c8cd-44e2-a95c-4d6e30f74cf1", "value": "98304:DXJaIWTANn38mgLEkIjk6LwwtgI+mqthG+XyBqCso0LW1QHUt+u1r:DiTIn3UMjrL6n5thGyyBwXLWKer", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785727946, "uuid": "2534b1db-f401-4a6e-aded-3eded17e6050", "value": 5228032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785727946, "uuid": "8cd41f4a-3c37-4387-a28f-16b4a70ad360", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785727946, "uuid": "a5af8e19-2e99-4070-b9df-4639a3722498", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7dbd743-8f96-11f1-bd95-42010a9c0009", "comment": "Malware payload (Phorpiex)", "timestamp": 1785801291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785801291, "uuid": "04abeed0-7dc7-414b-9aa2-bafe8684c1e7", "comment": "Malware payload (Phorpiex)", "value": "8c7edea999955fd5eacd1e544a2bef3c", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785801291, "uuid": "1304300e-ac20-46f9-8943-7403e988b9f0", "comment": "Malware payload (Phorpiex)", "value": "902d28ddfee24818d1ca25d2cf37a950972d876047fdfff29a7feafd60810fdb", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785801291, "uuid": "fe2ad3b3-c064-41ac-937c-1e47ed04b12b", "comment": "Malware payload (Phorpiex)", "value": "35533dcbde49f837eb4818b89182f07b0798db1a", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785801291, "uuid": "de58ea3b-9b56-4482-bceb-68fc0bd4e417", "comment": "Malware payload (Phorpiex)", "value": "160f9ca9d8f3309f87aa1dd188b1a71f4eae10919fe22f581f5578c6c26670d9791c15349f755bc3b62ff2d67ad14b57", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785801291, "uuid": "bef4c8e7-344d-40a4-848b-420db797e260", "value": "T133623B0AA4818035EAE14075827F526649FE6DB623C4F9D7FBE0A8CA4DB4BD1F43116F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785801291, "uuid": "5bcc90e2-2007-4534-aedd-c8719cb564a4", "value": "3537f9c463b968f2d94efe8dfe27133f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785801291, "uuid": "b73cf65c-1f07-4f3e-9a03-1c2be55f6546", "value": "192:AWbesGnjXgjk8LcRI+Q1RDMlYfV/F5oIVUBKUSftzQFBrfgJxTmv8U9cth99ik:AmuScCtfV/ro6toB0av8U9cXX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785801291, "uuid": "18e893c1-ba37-4778-b62d-2b2664a0a112", "value": 15872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785801291, "uuid": "82257757-6e69-43ce-9a23-cddff0f333d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785801291, "uuid": "6061c4b8-6514-488d-b118-35b68ac58045", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f02e01f5-8f2d-11f1-bd95-42010a9c0009", "comment": "Malware payload (MassLogger)", "timestamp": 1785756289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756289, "uuid": "2499c6e8-1404-47f2-9b68-e738c94ea418", "comment": "Malware payload (MassLogger)", "value": "53991b4eba14c2cb2fc582272164722f", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756289, "uuid": "ec085f9f-2814-41b8-98ff-372dc96e9113", "comment": "Malware payload (MassLogger)", "value": "912bbae944ee61ff205edeb301b23238224b0670ab5b6960a95202ab970331d6", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756289, "uuid": "009bca65-8ad0-4c5f-bd13-002af56e1e50", "comment": "Malware payload (MassLogger)", "value": "5a479d97a7528c6cbc9e3da0a9aae3017be51966", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756289, "uuid": "6d3f57a5-ce8b-40b3-b179-29fbb5d5c679", "comment": "Malware payload (MassLogger)", "value": "ffdd7baf183a1487d555ef0934b46b133fc3325bd55bac29a52f6aa22a4b8dd724cd815fba066328d1bab0c779b1ab81", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756289, "uuid": "01484827-25ee-4e5b-8af6-878cc93a0f64", "value": "T1781523DB52FC16A8D06782D23060624DC09416F5CEF21C4365FFD78B63DCEAEA6C9662", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756289, "uuid": "3367df33-fa89-47c9-bf6e-cc366e644ba3", "value": "24576:aDgRHOCwLriQhrDZPI13qyrrT503UuFyC:OgChrDlI13qA10E6x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785756289, "uuid": "869ef41e-0231-4bb6-9642-422b8e899eae", "value": 939149, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785756289, "uuid": "63b47c9a-1dbe-4336-a69d-8325cde9aec0", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756289, "uuid": "c95e0533-6bc4-48fa-b1e3-317b6d243cf1", "value": "Balenciaga_PO_2026-01.pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c1c5a25-8f11-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785744014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785744014, "uuid": "cc38561e-e431-44a0-8ec5-4c0ac5ddc5c8", "comment": "Malware payload (Mirai)", "value": "8e64d13a8a3f115b1a4d7bd5a9964084", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785744014, "uuid": "c8c590a7-57ce-449b-9b1d-ffacec1ed731", "comment": "Malware payload (Mirai)", "value": "919ec6711eccb134db1ec8df1c0804538e5188286203e17b36a5a9b1289038bd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785744014, "uuid": "a1760ae4-2aef-4d42-b80f-89d0c10f7f89", "comment": "Malware payload (Mirai)", "value": "0d57e6fe632386056f4018f9048357dbdb9ac081", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785744014, "uuid": "7a2a3619-6780-41a5-8459-36aaec65029a", "comment": "Malware payload (Mirai)", "value": "f6b47389c8651326cf54b7f05855c1faa5a87ce3de044df411c2f1ab9fab43583eff6e7e20cdab367deebc39ff319270", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785744014, "uuid": "1fce2be9-e3d8-4178-9272-e7ab2552629c", "value": "T13004BEA3B60F2490C82506F44BDF57AD6A6325014D3E96E37D6E763F6A378DE18013E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785744014, "uuid": "78cb1f3c-cb21-4529-b0d0-3b9a19d084f6", "value": "3072:xuGYWKjyeD3Q08LuH5PHBjJmCseitkrVfE3cMKRHMOYugKCwXZcZRq:xVYFjywQkHN/sertE3dCDYSCwXZAq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785744014, "uuid": "315366b4-a92d-4df0-9186-780efbcd8047", "value": 181876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785744014, "uuid": "2a3634cd-85e7-4f43-bbe6-06afec1ccff3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785744014, "uuid": "467cc2ed-c291-4098-a670-64eed20e371a", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c5c1916-8f0f-11f1-bd95-42010a9c0009", "comment": "Malware payload (AMOS)", "timestamp": 1785743021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785743021, "uuid": "8b83503b-b7df-4c16-8ec9-ab4d7d55fe51", "comment": "Malware payload (AMOS)", "value": "8daccf759e4eb4c44553a3509e62b7af", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "Odyssey", "colour": "#EDEF7E", "exportable": true, "hide_tag": false }, { "name": "osx.amos", "colour": "#7AA80E", "exportable": true, "hide_tag": false }, { "name": "Poseidon", "colour": "#D69BAE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785743021, "uuid": "57440ba1-1bbb-4860-9b76-1a0bb6fc2be5", "comment": "Malware payload (AMOS)", "value": "9447e664c43cb02e2947b65e2d04d07b8dd1f5e1dde82dbb1460ebd77f923ee1", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "Odyssey", "colour": "#EDEF7E", "exportable": true, "hide_tag": false }, { "name": "osx.amos", "colour": "#7AA80E", "exportable": true, "hide_tag": false }, { "name": "Poseidon", "colour": "#D69BAE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785743021, "uuid": "c456bd0e-b422-4031-8ced-51e235f89040", "comment": "Malware payload (AMOS)", "value": "2df8d417509d89f7fd868922b2096cfc1d0f3a08", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "Odyssey", "colour": "#EDEF7E", "exportable": true, "hide_tag": false }, { "name": "osx.amos", "colour": "#7AA80E", "exportable": true, "hide_tag": false }, { "name": "Poseidon", "colour": "#D69BAE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785743021, "uuid": "552fa7c9-f33b-4a12-9d3f-aa5ce1540ec6", "comment": "Malware payload (AMOS)", "value": "92129947f1baf6e01ea1765b7d32a1e3b6debad9f0d630a1c0a4e0ec2bdadd8056250e43ae9192e5399751788f70779f", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "Odyssey", "colour": "#EDEF7E", "exportable": true, "hide_tag": false }, { "name": "osx.amos", "colour": "#7AA80E", "exportable": true, "hide_tag": false }, { "name": "Poseidon", "colour": "#D69BAE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785743021, "uuid": "5b42a701-7d34-4c41-9ef5-9bd134660496", "value": "T1E9844C3B21ADAC01E1C6E2BC0F4F85D75E92BC711FB325D8431A666D845CBBA3E15A07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785743021, "uuid": "4ce556ed-ffe5-4b4f-b3d0-c1cdfb79a8f7", "value": "6144:cwAjL58hYmnHYUEwrffgPXAMv7obyvjwW7GvW:cwAOhFnjXgPXAMv7owjw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785743021, "uuid": "3611e1c6-4d66-4d78-aac5-44619b65dab6", "value": 393280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785743021, "uuid": "79e5b7f8-f488-4660-8c36-177ba54cdd42", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785743021, "uuid": "07ae7205-8f64-4797-8964-eb0d158f5d5a", "value": "unix001.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1bb269f-8f2d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785756211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756211, "uuid": "6fff5f7d-994b-4871-9acc-6c609f02c38c", "comment": "Malware payload", "value": "649336969c0d3dbd4cd1a45b38680522", "object_relation": "md5", "Tag": [ { "name": "dn-pdflite-lat", "colour": "#BE5FA0", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756211, "uuid": "7f45ce7f-470e-40d5-887f-63f0c64587f2", "comment": "Malware payload", "value": "94d7208acd5c8319091fcc0fc36a76c369e93a511a0fa15b4201919acc06b759", "object_relation": "sha256", "Tag": [ { "name": "dn-pdflite-lat", "colour": "#BE5FA0", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756211, "uuid": "4bddce13-fc7d-459e-a457-c61482c99e72", "comment": "Malware payload", "value": "45241d472a59a74502421904843b2064d8d5ead6", "object_relation": "sha1", "Tag": [ { "name": "dn-pdflite-lat", "colour": "#BE5FA0", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756211, "uuid": "704b90c4-4a5f-4cef-9616-18382e413937", "comment": "Malware payload", "value": "51edbdef10811c19fc2515ceaabaf672826f48d9fc681adb46e26e4eae3a5e70f462af8f134d304547666cfe5d617eef", "object_relation": "sha3-384", "Tag": [ { "name": "dn-pdflite-lat", "colour": "#BE5FA0", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756211, "uuid": "9ee9a877-1e9b-4b1c-8fdb-11a60360f301", "value": "T1AC2335F77A4652C5FD3289BB2A6F50891090260263A6D5F8F2DFDC00EF8CE5945783E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756211, "uuid": "83f9135b-890f-408e-b5b3-495e9c8cf906", "value": "96:54LErtRwD+sxxiawgs2wmyaSY9ds6k9mR:3XwOPwzds6/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785756211, "uuid": "b07bcc3b-6b93-41b7-8b06-f14b89962f3b", "value": 47104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785756211, "uuid": "776bdb53-029a-4caf-b718-d1377283b18a", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756211, "uuid": "f037edd0-ad48-4748-9131-b10c01617a50", "value": "Nota Fiscal Correio-DK8BS9.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57c91b4e-8edf-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785722532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785722532, "uuid": "07176291-724f-42db-9de3-34735af27dfd", "comment": "Malware payload", "value": "b1e100e1a6cd2af5a91806983d3a8c92", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785722532, "uuid": "98982d95-c270-4d91-9ee1-e343a971844f", "comment": "Malware payload", "value": "9554d42935b9036d49d299e582e1488b3e55fe27f2745ae49955a06a06425584", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785722532, "uuid": "099405c3-78ad-444a-8bc6-e998f9dc9c8f", "comment": "Malware payload", "value": "7779b1b483ab11a4bd1e33ebbae3371c1056532e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785722532, "uuid": "84a99b22-39c5-4161-acc7-c7c84726ad6c", "comment": "Malware payload", "value": "17d765b0aac6823470614047538df170ffd9f09b3b1b26844564cdd2930b9274ea3726cf1da989b0b11065507517f243", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785722532, "uuid": "d58d8494-1a84-47a0-aa51-b6340b04065d", "value": "T1CD236C651A857C24AA98C4371D7E2F0CBDAD43E6320492EE7FCA3CF28C5A69DD10871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785722532, "uuid": "9fbd43dd-2400-44a5-ad52-90ed34aed9c0", "value": "768:eXRWNGxV5k9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:alxJcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785722532, "uuid": "3522989c-9546-4470-9261-e6c635dff4f8", "value": 50047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785722532, "uuid": "cf9cc534-f214-4fe8-ab04-18caa4a96883", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785722532, "uuid": "98ac7607-93b5-4856-bbbe-5f4598c8a494", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cf6a385-8f91-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1785798938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785798938, "uuid": "dcd23abb-c2b0-41b7-8001-b0b31e87d6b6", "comment": "Malware payload (WannaCry)", "value": "81f3775735534865eb0d73d3c32391ec", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785798938, "uuid": "048bcd16-18ed-404b-91c1-e44e4071a0bc", "comment": "Malware payload (WannaCry)", "value": "960a43b385f4370b19590ea7c9250acabb0ecb0df4fb8fb28d970bde643dbbd6", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785798938, "uuid": "9912f20f-f24d-4f53-abe1-c008a5ea9086", "comment": "Malware payload (WannaCry)", "value": "2da4d6155e93eaf9e6d11cfe0532a2bde83625ac", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785798938, "uuid": "4601bd05-ba56-4a5e-9b0f-a757924362bf", "comment": "Malware payload (WannaCry)", "value": "cc9b8c58d62dfabedb7c63744dba14df2c57390157991e5926f515f36adbfcf3dd0089c2d40906bfae7896caaf448cee", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785798938, "uuid": "d9a411bb-9ef1-4c55-bd09-38eff67767cb", "value": "T14D36235A32BC91FCC1172334A4B38E26D6B77C4A22B9970F4B5486670E13795EF68B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785798938, "uuid": "e401b2e9-4aae-46b2-91f7-3debb15b9e39", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785798938, "uuid": "04f6213b-4d64-4938-b17d-046e85c8c350", "value": "24576:jbLg3bLgddQhfd1SirYbcMNgef0QeQjG/D8kIqRYoAd:jn2nAQBSPbcBVQej/1I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785798938, "uuid": "11b77a1f-b275-4b57-b268-0fc341d84a7f", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785798938, "uuid": "97487406-bc5b-4efa-8924-90386f545b59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785798938, "uuid": "bc008463-d5c0-4045-b3ab-7376b17dfca4", "value": "960a43b385f4370b19590ea7c9250acabb0ecb0df4fb8fb28d970bde643dbbd6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8524e97-8f2d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785756168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756168, "uuid": "4e9db304-6ef3-424a-a5b3-eb5bbd408da0", "comment": "Malware payload", "value": "3970e2e6fbcdeec5728543640008154b", "object_relation": "md5", "Tag": [ { "name": "dn-pdflite-lat", "colour": "#BE5FA0", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756168, "uuid": "8e790374-30d7-4bf3-b6ed-5d9b90cee4b2", "comment": "Malware payload", "value": "9619e1a0d22d914e13f2ae707d438b3ec2413b445f19491c1ad90c61285e9207", "object_relation": "sha256", "Tag": [ { "name": "dn-pdflite-lat", "colour": "#BE5FA0", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756168, "uuid": "75dd53e6-a72d-410f-942e-1317007396f0", "comment": "Malware payload", "value": "fb735d13f024b78d680f05d4b907ee696352a40c", "object_relation": "sha1", "Tag": [ { "name": "dn-pdflite-lat", "colour": "#BE5FA0", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756168, "uuid": "d13128d5-786d-43c3-9d41-bd4db4bf7a25", "comment": "Malware payload", "value": "98cbf099fdd113c18637981f627df6073c0d0d143f77243c7eaa196a06efa6a025100f49a30d1e8c35825bb6d43f3447", "object_relation": "sha3-384", "Tag": [ { "name": "dn-pdflite-lat", "colour": "#BE5FA0", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756168, "uuid": "c2ef3943-2068-42cb-bb6e-f261ab17a90d", "value": "T11F23D0FBBA4252C5F9324DBF1A6F604A25D83A471358D279F24EB800AF98A0D84747D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756168, "uuid": "115b74b1-a663-4d04-92da-c2c8a3333c7c", "value": "48:59p4jf3ZRwEXgVablmXkuFWQAQovqcMhTLH/XgDN:5P0RwLqlmRgQnUqcq3XgR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785756168, "uuid": "fdb2e5d0-b01b-4d38-9257-0e208534c52e", "value": 47104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785756168, "uuid": "9c2fa7d8-29d5-44cb-864d-65f59278b2d3", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756168, "uuid": "bb91699b-5895-4fdb-b0d0-d3ab978d13ab", "value": "Nota Fiscal Correio-LY244H.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01a82f74-8f5e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785776934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785776934, "uuid": "5b456592-5adf-4d0c-99ef-27d7cea5d869", "comment": "Malware payload (Mirai)", "value": "e49fdaa2347ce93e1ddf85840308312b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785776934, "uuid": "0f0e2287-67c1-4c79-bd45-961b359c897b", "comment": "Malware payload (Mirai)", "value": "96d4f60af313cc516e83f5c279d38808561c270c9ca796befec486481c2c2b68", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785776934, "uuid": "9f212119-430b-483e-b19a-3c7cab931403", "comment": "Malware payload (Mirai)", "value": "468b02b7a48187c612f72315a26cef6af873c36f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785776934, "uuid": "7a4026d0-0de6-4b26-bd4f-5f5a548f8358", "comment": "Malware payload (Mirai)", "value": "45aa70c3083f2cce76ddab94adbbd99510232a8ffe5bea15016332f954a8e43e587be8cce4011e276f0633a960e605ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785776934, "uuid": "c94ae91e-88c2-43e6-bac0-0ca6fcdaf5b3", "value": "T123D36CC5F783C0F9DC5605B12137BB3B9E32D47B212ADA83E7B81E32A861541D6167AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785776934, "uuid": "61a91a91-e835-4ab0-b207-b915af98d907", "value": "3072:zoJyA1lMsCtS/eiE1WJTJ/Z7pUR/QEOze3IRYm0hIB1XC//K:EJL1ltC8/xEAJt/Z5/YmZC//K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785776934, "uuid": "75b41335-adba-4aca-86de-433957a411df", "value": 130592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785776934, "uuid": "3108ad23-4459-4b5e-b04c-ce915db3614f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785776934, "uuid": "0313fee3-7203-4cbf-b0bf-9ae619af67c0", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3504626c-8f0c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785741801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785741801, "uuid": "b60db273-b6f6-46b3-8c19-f04e3de9a2db", "comment": "Malware payload", "value": "826d8909456dc5460f8532b1da76dbc6", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785741801, "uuid": "f6272120-d51e-416b-a146-da3b9570bd2d", "comment": "Malware payload", "value": "97962dfddab4caf3fda578e8d3bdbe239942c673c361f94ca9486347ade3832e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785741801, "uuid": "f5533421-9d91-4033-95cc-5a31d0add129", "comment": "Malware payload", "value": "c24d766780e80ac3ca43b44dd5b196347f2e0229", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785741801, "uuid": "d677a175-377c-4ecb-b96d-d5094e8e34a8", "comment": "Malware payload", "value": "373afb9cd3d66a29eb272b0d98a3179238dc69682847dbd641ed015d5b599f3a4f09af2a150379b2904ad89b2b265931", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785741801, "uuid": "179cd4a4-36bd-4c99-8e60-6e8089170369", "value": "T1BF235C6516857C24AE98C4361C7E2F0CB9AD43E6324452EE7FCF3CF68C4A6AD910971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785741801, "uuid": "60a93625-ac58-4c42-93d2-94429cae1347", "value": "768:M+q9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:M+/cr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785741801, "uuid": "25dbd4d1-d22e-49bc-8871-28d2a25e8cd2", "value": 50055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785741801, "uuid": "5a8a8a4c-2fe0-4612-9f13-a9152ffc5556", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785741801, "uuid": "11772adb-9ab2-4f0f-be4a-73b6947ece02", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20a2999a-8f3c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785762383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785762383, "uuid": "0baa2339-10cb-4b5b-9d03-30e163a54b3a", "comment": "Malware payload (Mirai)", "value": "40c721912bff4da379de16cee61182f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785762383, "uuid": "6c6f328a-b543-4763-b295-53aa2bd19d07", "comment": "Malware payload (Mirai)", "value": "9811b1db732721a0fb72db67343bb77e3e063087716c7628ed23e08f5466416a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785762383, "uuid": "ff911594-2ad7-4995-a617-69b87f2c8342", "comment": "Malware payload (Mirai)", "value": "cb1c84b475b9c1d4f5ab0f202ed0d914e07aef0c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785762383, "uuid": "79454918-9f38-4bb1-a4c3-3e0e0d19b74d", "comment": "Malware payload (Mirai)", "value": "4d7b1bb90b85d044888f5962042c7ef1b433e69b4ec58f4c42daf2b1c1ce58c2e333fae50f6523efefe3d0d15414f4be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785762383, "uuid": "8ab39537-9c93-403f-813a-1f89f0637433", "value": "T12AD2E0CC3886337FF4105A3716025E99AD98897139674A07A600321E997AC5EFF73ADB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785762383, "uuid": "0388407d-9d84-4c17-9ed2-9b4da8ad8e63", "value": "768:fSELTgtPxP8d6nuqDvrOVGuGqdg0Mpjg7CE9w:6MgtSdIXDvqGqqRpdE9w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785762383, "uuid": "67c8a188-681e-45a6-b7bc-778ddb120ad7", "value": 29164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785762383, "uuid": "e3f970e2-4233-4310-87f1-3ed34684359e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785762383, "uuid": "bcb95eeb-a685-4450-9f94-9517df72877d", "value": "miron.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "334490f6-8f0a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1785740939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785740939, "uuid": "667710a1-c3e3-4cbe-afbc-cf7132dbac22", "comment": "Malware payload (Formbook)", "value": "2b9cdf05942b92ebeead6a8016a81cce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785740939, "uuid": "5e87539b-12fa-4ba1-92d3-02965de3d400", "comment": "Malware payload (Formbook)", "value": "983b8144e80f7053aa08e3c43a07db548dddbb3df4a70be66be9d135cbb5feee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785740939, "uuid": "d98fa88f-f919-40a6-99f8-6a130be4f3c7", "comment": "Malware payload (Formbook)", "value": "632340a9ac0d6eb64ec24433b7a04c3f8a97b6f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785740939, "uuid": "27c0c200-6dd8-4362-9693-63b831182963", "comment": "Malware payload (Formbook)", "value": "40d1aa08a0a8dc3e5635646286e173c0dda925083df2b0c5c9d6e9920c075bea6c26b85c9922e7ce50f69c4fd7731c9d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785740939, "uuid": "47b5cf99-c8ac-485f-a210-1593430f9c6b", "value": "T14E35016926178202E8B56FB40D36F9B0477AACAAE135D61A1FD63CEB76773007C05327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785740939, "uuid": "f4269408-6ac6-466d-9558-5e0f64288f84", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785740939, "uuid": "f9b91bbb-39df-49dd-b343-ae254061c5e1", "value": "24576:midkL0dWzp2ZreNMkKk7nV3oOOaaMwazgOR13ElzgLeZ:midK0dEQrmTqa0ORqlMLe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785740939, "uuid": "3e6e32b4-31c5-49c6-91c9-c5db86afa2c3", "value": 1160192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785740939, "uuid": "9583858c-e843-4d4f-bade-03bdb46c1f1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785740939, "uuid": "d784e863-9a36-459e-ad67-9dce392a31b0", "value": "Our Order 2744PO19.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b78123b-8ed5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785718270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785718270, "uuid": "9c161598-29be-4446-b233-e46739c829e9", "comment": "Malware payload (Mirai)", "value": "4da4afe016b5021d60867ec4051fcf1c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785718270, "uuid": "c482b3fe-cc74-406c-9c43-1d232956067e", "comment": "Malware payload (Mirai)", "value": "98cf52a25bbc4e4287656eb28daaeb01bebfe6c7aa9a0af31f5f811b520cb783", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785718270, "uuid": "a8b79a85-1b46-4741-806c-f28e25b8a88b", "comment": "Malware payload (Mirai)", "value": "041e4cb3f7dd340b2df14fac2bf9f54bddfa6edb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785718270, "uuid": "7df679d2-9da1-42cb-81ab-069b8777adcb", "comment": "Malware payload (Mirai)", "value": "cd9ac75148df35998164f6c0800a42d7a5d7d4046aa710dcbc8bae4e379acb440891e12ff3e55b71ce8287133a952993", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785718270, "uuid": "68e6510f-4129-4a15-a281-f6daa5304be3", "value": "T13F23F19BD52BEA3CC06E80309C8692CCFFFAB6021267179B06EF235C55B9A413519B12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785718270, "uuid": "8504c4a5-4526-4286-bfd2-4912ee780674", "value": "768:VPpbug3hrv2WQOHSf4vBEtTCpM54PoS4vbadGzwlWekofkuUqrDonnCx0YO:++hrv2WQOHI8p2s7GMkekoMbqrknCxO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785718270, "uuid": "5fb21f63-aa60-42dc-b793-b175b7727f56", "value": 49484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785718270, "uuid": "400cc1a6-67a7-4468-b677-5b03fce9a0d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785718270, "uuid": "511aeea2-ece1-4ec2-82d8-b96e4b9b14d0", "value": "nz.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44a43380-8f16-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1785746122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785746122, "uuid": "3235343f-f0c8-41bc-b420-6949fad7ff3a", "comment": "Malware payload (CoinMiner)", "value": "1bc24a776ceaebb5bd0eeda54476c864", "object_relation": "md5", "Tag": [ { "name": "424e51f31d68f573a4621aaede8044aa", "colour": "#51F4DD", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785746122, "uuid": "58ca9559-ff59-415e-a66d-c250cbd96e07", "comment": "Malware payload (CoinMiner)", "value": "99394c069d6474ed22abfc96f3b73cd5f640539f85786cd3f842e4a03dd13494", "object_relation": "sha256", "Tag": [ { "name": "424e51f31d68f573a4621aaede8044aa", "colour": "#51F4DD", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785746122, "uuid": "8cf0fff9-be75-49fd-8de4-df6bf345ff23", "comment": "Malware payload (CoinMiner)", "value": "7385d24571ccda664315ce1a9c07c80d513f504e", "object_relation": "sha1", "Tag": [ { "name": "424e51f31d68f573a4621aaede8044aa", "colour": "#51F4DD", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785746122, "uuid": "a083e7ba-2a8a-482f-b7b5-d0bbec1a3c39", "comment": "Malware payload (CoinMiner)", "value": "3dffa8cc8ebd33f4d051651a0ee88dac401db53954dd9ed0f1970a3fa6ce652f5d4d11f6a1257bf93af5598cb36eb7f8", "object_relation": "sha3-384", "Tag": [ { "name": "424e51f31d68f573a4621aaede8044aa", "colour": "#51F4DD", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785746122, "uuid": "c86480fa-14e3-4205-bb74-773179d60365", "value": "T10D36339A7CC2DA70D8A3C7B84517507DB33FB7A08D35BC1E76C96A444D2AA24507F38A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785746122, "uuid": "77b7e4dc-9490-41d1-9871-f6d2d8875211", "value": "35171f6f6a1bfee47cbc04cb345c411f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785746122, "uuid": "18e0ab76-b94c-4165-8a06-5986a3bf33f8", "value": "98304:CE2mNp/Ks8teppW2X/0V7KkZ3f6nBAsSX/IsQR18UjLvWpC2cesk3V:CEnNp/We7DXcV7JyBoXLa1fjSC2coV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785746122, "uuid": "148229a6-449f-4cf0-bd84-e718726abde2", "value": 5303808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785746122, "uuid": "7c6a3343-31e1-4807-ab70-21f143158ee5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785746122, "uuid": "1d68a019-9ac6-4089-8f7f-fcbf64519fb7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bc3f675-8ed4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785717868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785717868, "uuid": "98d2a777-4f2e-4264-92f8-af162763a5df", "comment": "Malware payload (Mirai)", "value": "f3baee05365e895a7ee708ea1b6b6f92", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785717868, "uuid": "0302f0df-4a5e-45f1-b591-a1d8168494b1", "comment": "Malware payload (Mirai)", "value": "99e62f03ab120c32193fa4170496e4fdcc80b4a952956874d7f3585c8a07dff7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785717868, "uuid": "e66e4841-4ae8-40a3-9d6c-2cbdaf2a4d53", "comment": "Malware payload (Mirai)", "value": "175737b3bba2c847068bae995f085dbe3085419c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785717868, "uuid": "1928bb68-675c-4ddc-9e16-0032096be232", "comment": "Malware payload (Mirai)", "value": "15b5db34119d248ca99109c344495e6046d3e5df8706733fb0ea0c643caa98e519d988eace56bc812af751479631f0cf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785717868, "uuid": "fb6bacea-d86a-4edd-bea3-fe3de444204d", "value": "T16A33F15F670296BDCA1EA0F297404B1D3D020FA6E05BCE68A5656523DFF79F06843E88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785717868, "uuid": "87546a7e-a5f6-4820-ba39-a90552eed2fb", "value": "1536:cGT0Vj6MgC434blTxPzIC1dCGjwoNa5MlmVJue:c80VHb9blFPcMNdcVQe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785717868, "uuid": "48635acc-960d-4266-a13f-532b36ac3313", "value": 50500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785717868, "uuid": "cd6ab02a-c2f7-4e8e-82ff-9287e6ffef61", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785717868, "uuid": "f1995a69-b9a8-4cd6-ac4a-fc6904fcbf82", "value": "nz.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b32ff3ea-8f86-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785794411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785794411, "uuid": "9ebd1177-9cc6-4089-8479-98502beb0666", "comment": "Malware payload", "value": "0ce77b3b4a1046290cb30d60d13fffb0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785794411, "uuid": "e315e66e-7f4c-4cb3-bd84-44179c828717", "comment": "Malware payload", "value": "9aa853664b32a02727ff5ae45c8b027d65d5838e4c2bddc221d674055d84e6c9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785794411, "uuid": "225fc9d8-5cb2-4e8f-aab2-925c5592555f", "comment": "Malware payload", "value": "cab5484d6061dfeb87d919d2254e2a3f6dda2fe8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785794411, "uuid": "40b40eb5-e21e-4705-a61c-93e721d3e291", "comment": "Malware payload", "value": "2013c06fe44ad503612226b768de7f770f209e4239a947421c8b6c3c22f7248084fbacfe3d9f3cefdb09af188e80b82e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785794411, "uuid": "82e3d671-ca71-42e3-860f-d7ca47e19342", "value": "T1BC51E0DA30635432F268A87927A4E6C4A9D70AC3436CFE14F72C68403F75E24BD297A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785794411, "uuid": "65036237-3982-4642-b03d-73ab09689749", "value": "48:HsKRDRM/Sco5whWrDztDz+ULN8swRQRfSjgVAhGiGlLIW/hlrlSl9hl5hlfltl2O:HsKBiqTamDhDCkxwq05GiG2WGtAtgTp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785794411, "uuid": "54856588-b6d7-4d55-a962-b7c59e727548", "value": 2919, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785794411, "uuid": "eaaaa998-9836-42ed-b0ce-7afcb0b82450", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785794411, "uuid": "52a44ae0-a81c-42ad-906b-e822f9d0376b", "value": "sample", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13e3ab32-8ee9-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1785726713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785726713, "uuid": "e8025d21-6c0c-40eb-bbff-a5b952403aaa", "comment": "Malware payload (RemusStealer)", "value": "aaa2d1a6e036ff38f7bc318687aedb4c", "object_relation": "md5", "Tag": [ { "name": "1TEST.file", "colour": "#584C71", "exportable": true, "hide_tag": false }, { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785726713, "uuid": "3658ecfb-97ad-4e6b-9518-ebcc9d5a0156", "comment": "Malware payload (RemusStealer)", "value": "9af478edec362f2ff147458b9581e94dacc7648f5b736975429dc0f2315b9a2d", "object_relation": "sha256", "Tag": [ { "name": "1TEST.file", "colour": "#584C71", "exportable": true, "hide_tag": false }, { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785726713, "uuid": "e9118a7d-eb9e-497e-b5aa-f41b1279fb67", "comment": "Malware payload (RemusStealer)", "value": "3ce6bfda80c7aa24be952c48ae759cfee09dc054", "object_relation": "sha1", "Tag": [ { "name": "1TEST.file", "colour": "#584C71", "exportable": true, "hide_tag": false }, { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785726713, "uuid": "df7be255-a3e2-4e73-8ec9-ce2bb9ff9ec1", "comment": "Malware payload (RemusStealer)", "value": "8707dbc500dc8507f36c1b439faa0963a20f5724420c82e816e7049bbdd8d6665685979bd2d459df1a5f4b197610cdf9", "object_relation": "sha3-384", "Tag": [ { "name": "1TEST.file", "colour": "#584C71", "exportable": true, "hide_tag": false }, { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785726713, "uuid": "2c8c664a-4b9e-4e94-9c29-ff563451dde3", "value": "T1B4B52A203BEE55D9F1377E32CBEBB555D66FB7722A068A4F0605034B0562A02CE93D39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785726713, "uuid": "6705dc52-3dd7-4f3a-b91c-4daa0a2e551b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785726713, "uuid": "f155ced5-e674-4dc5-901b-f5e1d0b06e3f", "value": "49152:0kUv1BL0xjJR/gz/QdRFYy3qW546O2TUY9zc6:YXoxjzpNVfN5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785726713, "uuid": "697e0048-7dc3-41f7-9498-12b2ce2d05c4", "value": 2391040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785726713, "uuid": "a9d33156-1b0f-4d71-b814-4c4941a9877a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785726713, "uuid": "18efd62b-3d73-436f-89ba-4dc5a3d1b7f8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a57000a7-8f2d-11f1-bd95-42010a9c0009", "comment": "Malware payload (LxBaseRAT)", "timestamp": 1785756163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756163, "uuid": "7d51a0b2-bd83-4b2a-8576-039c1da973ca", "comment": "Malware payload (LxBaseRAT)", "value": "313cc79070fec06c7b591e3929c34441", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756163, "uuid": "abdb3840-62e9-4420-8705-de205ce07f2c", "comment": "Malware payload (LxBaseRAT)", "value": "9b2897f4d776eadb07de0555bd279cb305025032f83796539597c5cc6a704900", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756163, "uuid": "8175b39a-110f-49df-a88a-d91d4343a1d1", "comment": "Malware payload (LxBaseRAT)", "value": "2af57daa82e1575eacf448bd8494255121ed3756", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756163, "uuid": "b0299eb2-b1ac-4cb7-850c-01b0e3a72967", "comment": "Malware payload (LxBaseRAT)", "value": "25425cf5388f02812f1ecfe8194375896f99b950909f43283e22aa52e39ecd92c982a4a33450f9ad314b2a36ea2ffc22", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756163, "uuid": "58cfb690-f2c9-430a-9352-efc58a599240", "value": "T170958E8E403E84190B7D7DD8287F266C39DD1E4D0179AA18EA04DEF1B6C50B9D9BE335", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756163, "uuid": "5eddda77-0536-44d3-8ae9-464b6b89f88b", "value": "49152:hDU04LDI+sx45/1oqgjiBdfMo/cT4BTJNBAFa/YuKZRQVhmBEeJ+qo:ubEtQmsBTJEuKoVkBEeTo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785756163, "uuid": "e2a87227-7163-4f74-926f-d50918f95a53", "value": 1922697, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785756163, "uuid": "d0f562ec-654a-42ee-99da-b465e577d9e0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756163, "uuid": "1e644416-35fc-4770-b6dc-00eb20756b75", "value": "Revised_Contract_for_Review.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49680b84-8f07-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1785739688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785739688, "uuid": "fd029d25-79c5-4539-8ec8-4f170b2d460b", "comment": "Malware payload (ConnectWise)", "value": "4f80d7fdd4b7a33ec4d7be0aa65de723", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785739688, "uuid": "4bde07af-1955-4228-aa85-5f174941395f", "comment": "Malware payload (ConnectWise)", "value": "9b74faf0e9410a5ce8525cc77713e4ad44008920b625d233eba93912557f3ec7", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785739688, "uuid": "67bb09da-25ba-409c-a2c4-8356a9822524", "comment": "Malware payload (ConnectWise)", "value": "317ac5cb15c79825b18c020c503e821abc3c384a", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785739688, "uuid": "38ae4e12-2784-497d-9109-b5af0a3826cd", "comment": "Malware payload (ConnectWise)", "value": "51a01739e3733a0fb8bf3a2ab369ac459ce2cbea36ca2340939d7a46e8cb06b293dbe987875fb66c1de8369d68bae870", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785739688, "uuid": "70fec611-1405-440f-9441-a79759ee5541", "value": "T11546F141B3D695B5D0BF0638D87A42A69634BC108712C7FF57A4BD296D32BC08E7237A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785739688, "uuid": "17d1142c-a3fe-4287-8b7c-c462e48e4bc5", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785739688, "uuid": "62887217-379b-4c42-8cd6-9fc2aa751735", "value": "49152:ofRBDtJkGYYpT0+TFiH7efP3nrGLq7FVsLBe+1GVxrKlsuwGenGwfZVkVjOi8if0:cqs6efP3rn/TYGVxz3GBwRVkGuyXOM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785739688, "uuid": "225e5516-de87-431b-8fa6-1f3e7d6ef782", "value": 5652400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785739688, "uuid": "e0e536ee-5190-4501-9c3d-dff4267700c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785739688, "uuid": "54024e59-a265-465f-a608-0928587e3210", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d763a194-8efc-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1785735202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785735202, "uuid": "ae78d8eb-b89b-4ac1-82fa-e74d8170be59", "comment": "Malware payload (RemcosRAT)", "value": "30cd51f75bd1d6773981589002097a16", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785735202, "uuid": "5a175938-d66d-42cd-846f-118219f61894", "comment": "Malware payload (RemcosRAT)", "value": "9bb96b5e7b5bce10fa59ca1e9a040129d6159a5c131c9f3f627faac04698e8f0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785735202, "uuid": "62a2fbb8-608c-4012-88ae-7dac6d74294b", "comment": "Malware payload (RemcosRAT)", "value": "3e5dc389739fdb0bc711fe16f83799968ab35399", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785735202, "uuid": "7ddd2760-290d-4c9e-97b6-880b04db72e9", "comment": "Malware payload (RemcosRAT)", "value": "7f57fce58ee21a50d9e8ae970a089feddb11dbfe496435e84a9eae09896fbb8950d0856e2f19dc2b243d8d7e1e012bb8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785735202, "uuid": "1820ed58-7992-4caa-83da-5b11d5b2a505", "value": "T1BB35ED3DCDE8923FC6B7C52D888B4A07F89A481B231DED4EA4C763DB55260C27C9615E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785735202, "uuid": "3849c1c1-f828-4f0f-9e98-9949da3c046b", "value": "3072:ox2J4vZ1p/09kgrvX5aUi68y7dHRGFn+MfFQzwlIPhKhqDXcxvBkzTWDh1Mj/Ziu:b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785735202, "uuid": "6d10b7bb-6659-47e3-a5a7-46bb0d378b14", "value": 1156090, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785735202, "uuid": "719cbc07-f616-40ec-9334-35ad7a5d6227", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785735202, "uuid": "50a15495-6e7b-4443-9d72-2047cd99e177", "value": "Doc_000009385476563645737354637345373735473.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "580d1373-8ee0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785722962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785722962, "uuid": "797d9f9c-e148-461b-8e10-3197773bd452", "comment": "Malware payload", "value": "87480dca99aab4eee9552f96207d83eb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785722962, "uuid": "20b4ba4e-bc5e-4316-9798-abf968af88ff", "comment": "Malware payload", "value": "9bc92b9cc544a29b7937678496e117902123af821188bad287ef809daaee8a09", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785722962, "uuid": "d9b80257-d09b-4be0-a941-9af3791af31a", "comment": "Malware payload", "value": "4d96895965ccb6e1f5f395d3be8c50415224115f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785722962, "uuid": "c6fbe756-d5bb-49bd-9f25-02ad7ee465f9", "comment": "Malware payload", "value": "3a16e2c952f3eaa296de1cf416d57a0dea2a754208cea26c4f603f4777f9b6ee6e5cd91710b003db98742fe5b71aa470", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785722962, "uuid": "55152dc5-622a-4577-850b-0dc07528d39a", "value": "T140D4AE4177084E63C0E33D70353F1329E79E4D8B42A8A41D192FA71A5272E756B8EBDB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785722962, "uuid": "c611ad7a-8083-454f-8a80-a7599a3ea224", "value": "12288:6QnA3nygyIuG5L1HwV+/N8DJdUgojK/24bIuhhhajMEJ:6QYTwBURx+thLa9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785722962, "uuid": "3768b3da-5ab4-43f4-95ef-9b878441087f", "value": 605814, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785722962, "uuid": "476bb58c-b1ab-4861-aedd-e057102ade00", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785722962, "uuid": "19721982-a2a0-407d-abe0-e0ce140173b9", "value": "bot.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68061410-8f63-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785779253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785779253, "uuid": "17b56932-7300-407d-9f4c-4492134712c8", "comment": "Malware payload (Mirai)", "value": "8010a741a5d1cf0fa272925af3cfc27c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785779253, "uuid": "29c38446-2f0e-4fa2-b9a8-cd6d56ed8cda", "comment": "Malware payload (Mirai)", "value": "9c779bb1034c6b01fc1eb3295bf4eb6bd41a31e1f1b257b639179f54d220fa3f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785779253, "uuid": "171912f9-655c-4052-8596-a5e9db4c0cd7", "comment": "Malware payload (Mirai)", "value": "50ef47751d5ed23241319921cfe46e771390e7a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785779253, "uuid": "019be877-35c0-4004-ac35-eaecaeee4acd", "comment": "Malware payload (Mirai)", "value": "7b7ae1e111dc67796bf2c50d083585086aab4d5649d06117e318e7e8d8ad05be0a4c5fc554c73f4f45aee0fd3d58f642", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785779253, "uuid": "6efa8ce4-675d-433a-b5a6-c00cc2b863e3", "value": "T15B733B81F94B80F1D857487090BBF33FCE31D6954175D66EEF689F36EA63202A60668C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785779253, "uuid": "0cf8a2dc-89a2-491d-a464-62aed40f4611", "value": "1536:uVHQ0rPyMQn+JgVV/SGQ+ZsA/SfFWLIk1Q9j+Lxty4AHy:uVFrPNQn+WVQ3EhVUk29jgxOy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785779253, "uuid": "4fac8d89-c704-4a6d-97a7-da16d0be3ead", "value": 79232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785779253, "uuid": "28d69f35-fe91-42d6-a83f-1902aa7a9d81", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785779253, "uuid": "62747f3d-1c5b-49cd-adfc-4954f7a27674", "value": "lkxstress.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2815912c-8ee1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785723311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785723311, "uuid": "9e604b7e-bec8-4bad-a1cb-3194d945e61d", "comment": "Malware payload", "value": "9bf6bcd5dda32a27f112357f6289cb19", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785723311, "uuid": "2884c4b1-6dec-4b5d-b61a-d39ea7df3a39", "comment": "Malware payload", "value": "9cabe19e0f845ef04507786eb7b6120eea5c04dd08dae799fcaf7b3a90c6d858", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785723311, "uuid": "76e80693-2adc-479c-b01b-76468dd3be35", "comment": "Malware payload", "value": "54720dc95149ba67b589dec224880cb2edc009de", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785723311, "uuid": "02f46f97-f098-4d00-a633-3eead6807d14", "comment": "Malware payload", "value": "fb57d51df085940a268b6936b1fa83bacad06c1d6088cd60e64dc095e4c5085774387f40fb67cf9d676485cd4bdc69c2", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785723311, "uuid": "e47a6e49-e949-48ea-b5dd-657bdd48e7df", "value": "T190C27D966A867C44BDC98A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785723311, "uuid": "a823fb18-7444-4fed-9b4f-538fe734ae9a", "value": "768:z8vCB+25j6es8Rk9FYpMSUpi+20qUpi+20YQX:z8l25JCd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785723311, "uuid": "041af9de-30f6-4f39-bc59-67861fdd40a7", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785723311, "uuid": "afa2f2af-e34d-4c14-9f43-0a118df06ec1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785723311, "uuid": "8d4016ad-be16-4324-9d3e-c897648cd493", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f06fcd57-8f10-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1785743834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785743834, "uuid": "d75ee0a8-a710-4480-9670-89df8401315a", "comment": "Malware payload (ConnectWise)", "value": "f2d291955c241b3967e636c03cf28c7e", "object_relation": "md5", "Tag": [ { "name": "207-174-0-143", "colour": "#FC6F54", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785743834, "uuid": "daa9e416-3793-48c7-86c3-e5dbef0fcee7", "comment": "Malware payload (ConnectWise)", "value": "9d9f3fa5aaf6bc91091873bd7ee04f0cc23e8709e4ad20c61d2779ff1a43c4b4", "object_relation": "sha256", "Tag": [ { "name": "207-174-0-143", "colour": "#FC6F54", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785743834, "uuid": "3f7e1fdd-98c5-45d6-86a5-af1f2a58889c", "comment": "Malware payload (ConnectWise)", "value": "a83a5e93cfb4d1fd65054017abfb7827b48f2e5a", "object_relation": "sha1", "Tag": [ { "name": "207-174-0-143", "colour": "#FC6F54", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785743834, "uuid": "9ac3d82f-2773-4150-8f8c-a2214dcec2b0", "comment": "Malware payload (ConnectWise)", "value": "ebadf2687cc5779d7587e365728dd5ec759b418761327a447bd365b0d51beb39563b874c255acb8a215202f10ff3dacd", "object_relation": "sha3-384", "Tag": [ { "name": "207-174-0-143", "colour": "#FC6F54", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785743834, "uuid": "f0851b8a-747f-4ae6-8e0d-840a5f824114", "value": "T192B733EC6AD67945DF078DB31EF03D1BCA202D5C98D4670CA4BFD4091E242B6CACAD96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785743834, "uuid": "c371a3b5-71cf-4dbc-b572-16c5bdae6d56", "value": "1572864:AT6YrRPyjC66Kp61lEU6sXRg6Y3mCEDgD:kJyuPKpOEAe6jDgD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785743834, "uuid": "0d6e0b1b-5c56-4f70-9f91-ccea3d4031c4", "value": 52434944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785743834, "uuid": "e6ac761a-acdf-4b34-9662-11a02c47fd9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785743834, "uuid": "bfca574f-f853-4ba1-92b1-2e2642d089ac", "value": "zFbJVuiX.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd15e913-8eeb-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785727910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785727910, "uuid": "89d39521-9794-44d9-9d75-35128ae8d982", "comment": "Malware payload", "value": "3d8205a57cf51a79767dfda015ccbe18", "object_relation": "md5", "Tag": [ { "name": "424e51f31d68f573a4621aaede8044aa", "colour": "#51F4DD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785727910, "uuid": "82ccd52f-2a90-4407-9fbf-78515bc095e2", "comment": "Malware payload", "value": "9dd8f8f1de9603e04453600d0427345a01d2ab4229cf29d4527ef0cf95b4c75d", "object_relation": "sha256", "Tag": [ { "name": "424e51f31d68f573a4621aaede8044aa", "colour": "#51F4DD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785727910, "uuid": "74b73145-4521-4e98-ade1-e2c4514dd856", "comment": "Malware payload", "value": "08868d1d10ce21f6e09d0b8ba218bbcc12ae08da", "object_relation": "sha1", "Tag": [ { "name": "424e51f31d68f573a4621aaede8044aa", "colour": "#51F4DD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785727910, "uuid": "e525d46f-617f-4cfd-8084-b21a47e78946", "comment": "Malware payload", "value": "57d6112d1ac9421f9849ff170b0cccae02492d23f7cbd2baedd6e2a1d63e7c5df45dfa15873fa5536dcfe48313bad5e1", "object_relation": "sha3-384", "Tag": [ { "name": "424e51f31d68f573a4621aaede8044aa", "colour": "#51F4DD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785727910, "uuid": "c6853865-5187-4525-9b11-37176dfd2e04", "value": "T1CDD523D77AF12AB1C863C7B58FD2F9BCB12A7B8587918C12B2CD2A006D53584257B731", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785727910, "uuid": "5969a737-0368-4c87-aacf-5c2de27c813d", "value": "f5bec796b7b3c2932293afa8281cdeed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785727910, "uuid": "ae6bbe54-f9a0-477a-b953-2041309cb9dd", "value": "49152:qZ+FQfW/LgwyrgBTJMFxYwLYdwZxVtIVX7Kidq4dActJXFf/VmpbbqXY/YkLfPo:0kgBcBTEMdyrKVX7Kn4dAmXFf/VmB7T4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785727910, "uuid": "de1b86c7-3fce-4165-aaaa-21817f0159a3", "value": 2899456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785727910, "uuid": "2871ca6b-99b4-48a4-b895-e118140e653a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785727910, "uuid": "9258e5d9-ad97-4ba6-bafe-248467f1f7e1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb9775de-8f3a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785761864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785761864, "uuid": "3bd9fb04-b64e-4cd6-bcfa-a7fd913b73f2", "comment": "Malware payload", "value": "d4d67ac42b426e66d21b19369273024e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785761864, "uuid": "ce043cbc-d8d8-4cbb-86b6-cf515c60d607", "comment": "Malware payload", "value": "9e24f73e234fc81514a28546d486597e91abcfa4ab08c473dbe74c766b75846e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785761864, "uuid": "a45dd4fc-d205-4b23-a08b-65cd642183d2", "comment": "Malware payload", "value": "89745cec87f0a8b0030c519f5c3abaebe46d408b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785761864, "uuid": "dcdeb3e2-d9ec-41ef-a8a6-c85dbbce8f25", "comment": "Malware payload", "value": "3be8ad2caa822216146676f2554684dd36237f92719d19f61c17399495424146974cdf8596cab2d87582bbff6d9f0eaf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785761864, "uuid": "e6413688-9e42-402e-803b-ceba88d8cc16", "value": "T191B70116A2E900E8E47BC278C6679233EBB13C55173496DF0668E6552F33AE19F3E311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785761864, "uuid": "f5d6ea04-a90f-40c2-bdca-cb835f699507", "value": "de1ba5a91e0cf722ba05ed41dc9a489b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785761864, "uuid": "77351ee5-cf9d-4435-89aa-1682ffc1bdde", "value": "786432:I77om823136tPFTnz0QrF0SZufO7+f6y0phnopi/8eA:gom883SNTn1u2Kyy0p1o0Ee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785761864, "uuid": "aa63d07e-287f-4e75-8565-ed4523a39cff", "value": 48325920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785761864, "uuid": "2108f7d2-379c-414d-9a44-82e8c9a4ab64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785761864, "uuid": "1a59a545-3d55-40b3-ae19-25bd503b1948", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0b3b042-8f87-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785794917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785794917, "uuid": "857c6951-68e2-423d-9ecb-362947580df4", "comment": "Malware payload (Mirai)", "value": "d0c21cb757508a0e8c1a75620a746c63", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785794917, "uuid": "c66925fd-f025-4b71-96f0-fce7bd709b69", "comment": "Malware payload (Mirai)", "value": "a0449ab884273c0817a6ec9d071d055b6c182be4a720c62902d86b37b9bd4fd7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785794917, "uuid": "154c77a9-9b9b-494e-a67e-3cc7d13c415b", "comment": "Malware payload (Mirai)", "value": "e48b5b0f99d3026dd7e0459441e289f93da0f434", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785794917, "uuid": "131e2c31-2827-4d70-b453-b443a6bd6d9f", "comment": "Malware payload (Mirai)", "value": "79ed26d0e7495695449e8ab2c266960f25d2e2261d80a0b3689c1f0398e5430eb0f4d64524346a8b1c467c9b16a69590", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785794917, "uuid": "85b3da21-23a9-4b30-b14a-b3317dfb8b32", "value": "T180048D32C8746F99D2508570F075AE78AB13A59092476FBFA6B6C2B84403ECDF905BF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785794917, "uuid": "1e6a43e2-d4ae-48d9-9f21-0d2b4fe654a7", "value": "3072:sveDhJZlmjJ3PR7R/y5K5olAH1QSVfKKWoNTkvu4FLX8:sAh7Qty5golAHqBXoGvTxs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785794917, "uuid": "b444d371-d7bb-4745-baee-0b8865022638", "value": 184680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785794917, "uuid": "0e71ebf5-d0e9-4203-97ce-1fa757ae5126", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785794917, "uuid": "1cc2b2e1-adec-4c94-83e0-5c7219c727c3", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a34f4c20-8f85-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785793955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785793955, "uuid": "3ae7dafb-91fe-4d8f-a05f-c0d5d58a0e06", "comment": "Malware payload", "value": "86c324c40d2eb9c69559c4742022255f", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785793955, "uuid": "061469cf-2971-4de5-824f-0a716999a375", "comment": "Malware payload", "value": "a148576de8521852ceb7d46b3cc2ca68bb58e58b9727afe6761f313f7bb649b4", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785793955, "uuid": "251bc16c-5a2d-4fbd-a849-89190017e1d6", "comment": "Malware payload", "value": "08bf0bd96788ac341814b80be9eea37eeba5fa40", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785793955, "uuid": "5719e186-6626-4ee0-b6a0-3c93c116d198", "comment": "Malware payload", "value": "8ae6af0a9b238150270fcb8d8c0235fd270d7210ce6710eb1d91dc8e4a955f3fa975003531599b891beb35b975ac2dbc", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785793955, "uuid": "c485ba3f-7b2c-447f-bc27-6efa9b0298a6", "value": "T1F4D66A17AE9048F5C0A9E731C8BB52557A74B84D8B3133D32E61AE782F313D2AE75B50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785793955, "uuid": "4d854680-6cf7-4472-ba62-53cb585d7f0c", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785793955, "uuid": "cfcccfdc-2f12-499e-854a-2aec5519d31f", "value": "49152:Y+6D20yZT8E2J97Qz/VMCo0pBU3u5Y36Cl8bJ+hYn7nmNkI7MjymEtvi+486Wr88:YQnrqSU3uyq+wId", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785793955, "uuid": "31c5f1da-413f-412b-afa5-953bfa596bf8", "value": 12987232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785793955, "uuid": "8151d018-6107-4499-9f92-20b7dd83ba05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785793955, "uuid": "2bd276b7-4223-4660-ad60-b984cbb0e4fc", "value": "bhatta.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d14e09dd-8efc-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1785735191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785735191, "uuid": "af3ca23b-d362-40ab-b181-4616f50411c7", "comment": "Malware payload (PhantomStealer)", "value": "42d1e1d451e44aa2c89b5a48e9b78aa3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785735191, "uuid": "15915340-11a9-4f1b-a8ad-10b2e92c5a0f", "comment": "Malware payload (PhantomStealer)", "value": "a1a2328ed433e0c7f7ef81919fb3141bf2faadeb4a714a6dfb56bba76cf3b8af", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785735191, "uuid": "55b6cd1b-842a-4d3f-b81d-65bfe1b4e428", "comment": "Malware payload (PhantomStealer)", "value": "cdfdda1b01362efb85a24b4f937fb88bcfb1ed9e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785735191, "uuid": "0876597d-e978-47d3-821a-5006b333d05a", "comment": "Malware payload (PhantomStealer)", "value": "aec6572bddbc57d481016d92255535ad97362d45fac3ea52162e62b65c98dbf5cae6a683bb0682a2d4692203b375c124", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785735191, "uuid": "1c4f3dc2-9620-4199-b718-b04555e6d5e8", "value": "T144658D7ECC28123FC2FBD219C9C64907E9514E6F271CFE4660EAA3A66E16142F5C215F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785735191, "uuid": "89c4a6b9-1e5b-4c53-bcac-ff71e2adb153", "value": "3072:woYzHe9t7UeC6CddQzbj+F0/JvsU0w1ZThOpQMO6J6WO8aNAFf9By95l1tLAt5h1:Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785735191, "uuid": "e1b4d941-01e0-488a-afb7-6ea49a88f37f", "value": 1483958, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785735191, "uuid": "933a6676-a892-4640-8fe0-865e398a8d48", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785735191, "uuid": "dad519f6-e466-49ec-be9c-74e1bc8c879f", "value": "doc_4746573545637383835744654747.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e47e8dc6-8efe-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785736083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785736083, "uuid": "65ee658a-8309-4b4f-993f-c9c1a0fb9b13", "comment": "Malware payload", "value": "0b999b5afef6de20a34d932e40e36bcc", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785736083, "uuid": "db3e7c54-ea0f-4270-a8ab-41d0df7c5b40", "comment": "Malware payload", "value": "a1ec3e5dc2ae13818feef7470c9b0475ce4052d121eaf28629a38cf4abab9812", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785736083, "uuid": "af6f3158-21fb-4e57-8c6f-bc4db20dceb3", "comment": "Malware payload", "value": "37262851a0b6948150bcb8ae6849419ffb856e18", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785736083, "uuid": "a031748c-92c6-45b0-ad55-8411401453e4", "comment": "Malware payload", "value": "395c382785e432a0f866c83fe7ff9c9041af234f4f4f60459fa921b8e684e5a0f5ed6fb616a6b71483ea38a60c24a2d9", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785736083, "uuid": "7b4c87f8-a017-4f10-8070-48607e197a9a", "value": "T105F0591DF88584BEA47FC9DABBE63E8D000FA101594B2E2E93BC6C06F4B9C084081477", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785736083, "uuid": "0b3bfa1f-5d18-4dfc-8a27-130e2a019ae0", "value": "12:Psna0cIMcTiYQkiuy4ghsesFrFBEGghgu+hYuTyisJF8EpASeyiiuyw:J01/XZrTBEGCnuoLpvY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785736083, "uuid": "c269a4bd-19e3-40f1-b913-c5b9bf9e2b1b", "value": 537, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785736083, "uuid": "4828f3e6-8db1-4cd5-ad35-c904950ceb60", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785736083, "uuid": "63ce18a2-a139-4dca-8d7b-088429648219", "value": "l.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a35702b2-8f76-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785787513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785787513, "uuid": "ba7f3774-88bd-450b-947e-2bb070e24439", "comment": "Malware payload", "value": "64909ceb16ececd46a5cb9cbd7db2dcf", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785787513, "uuid": "eb3a6284-1520-453e-b3dd-66552d13d7b6", "comment": "Malware payload", "value": "a279932f4c8f8232308510335457e96a31163a95f6b1b5949fa050096bf081fc", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785787513, "uuid": "78578bd9-3f64-4f27-a2fa-78dc8c4fc5eb", "comment": "Malware payload", "value": "5b86e6f3c11b019d9644a37edccfc0d5b65e0f4f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785787513, "uuid": "e39bb089-d627-4ce4-8d99-07e8c7ab9160", "comment": "Malware payload", "value": "3e320edc9e051792d543e18213d5d0395d881e2d1b4bcd8f786d4ac0c9a936a3908d570332008750651ab53dcde3f5ef", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785787513, "uuid": "241f3f7c-77bf-4dc6-8aa3-2aa66b893979", "value": "T1C4236C6516857C14AA98C4375C7E2F0CBDAD43E6314492EE7FCB3CF28C4AAAD920875D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785787513, "uuid": "6aa04a57-a274-4237-8fff-c58b70909824", "value": "768:RX9NyXsZztC49GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:RXHusZEcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785787513, "uuid": "1920fbad-09fa-4783-9da3-2938f1ac5dda", "value": 50023, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785787513, "uuid": "ce97e6dd-4757-4971-9876-09429999dad6", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785787513, "uuid": "4240ebdc-d927-4b13-a96b-8418704cf382", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb6ed65c-8f2d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785756227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756227, "uuid": "5c1c3bd9-b82e-4ec5-9500-2a4b8519ae7a", "comment": "Malware payload", "value": "0b4c3c582ebf0e7096f65a5c8fde2db6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756227, "uuid": "f6e5ef79-bfb7-424d-abf8-fa432027289b", "comment": "Malware payload", "value": "a2ad85f481f81bd21d6815726244505670d5cc5e9a7259a96e334016a957562c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756227, "uuid": "faf3bec6-1476-4a4a-8993-b18053758577", "comment": "Malware payload", "value": "3cfdaaa67bfeecd617d52ceb95353c29aec903d2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756227, "uuid": "d5877ebc-324e-46c8-a8b9-d32626b31638", "comment": "Malware payload", "value": "f6eb41c1160162654ab1eb6e89b45584589c57f1c54ce1c4c654cfa2fa6f328c9e87711344ae4f79629d241f3f7dc1a4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756227, "uuid": "b4b0411a-12d2-465e-b7c7-1322bfe65481", "value": "T16E65984C93AC8AB4E1211F72EF9B002AB8D5E63C9E157949314D69CE0CD1D94F3A3D6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756227, "uuid": "e86c4a80-3ecb-40fa-8277-4d5a28cd0200", "value": "192:Ussssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssm:vaxZ+LgyWqT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785756227, "uuid": "64cc9adf-d648-4526-8b81-527634258cfc", "value": 1525634, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785756227, "uuid": "e66c13c1-864f-4744-9ac0-9e8f74c2a8bc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756227, "uuid": "cd145308-8c0e-4ee8-ba81-f376c6f38036", "value": "PO-0001334282.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47d8947b-8efd-11f1-bd95-42010a9c0009", "comment": "Malware payload (DonutLoader)", "timestamp": 1785735390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785735390, "uuid": "517b70e5-2517-4d43-8d7d-91ba3a376da5", "comment": "Malware payload (DonutLoader)", "value": "11ffec074fba8e17ea946d85312defbf", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785735390, "uuid": "ea2311ee-28a2-4208-9c38-fd66605e2b4e", "comment": "Malware payload (DonutLoader)", "value": "a2da5567a45a50560adb90e9d5795fa01208d3d06bc12d5f7aa3cca87dedd5a7", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785735390, "uuid": "8138331e-f3d4-45b4-8abb-3b5eca230e81", "comment": "Malware payload (DonutLoader)", "value": "7eb72beec67ea8b956783e0b6fb8836e031a5a9d", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785735390, "uuid": "fe5c9763-3943-427e-b369-80aa408769bd", "comment": "Malware payload (DonutLoader)", "value": "a621270ad78a4ffb052c1fc7c88cd55b226e1b6df27ae6abb67e33066663405e4de38f9601de3185170fa165cdb09bc5", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785735390, "uuid": "24341759-8324-4566-bf1a-3253524cfac5", "value": "T14116F891ABA4487763A0D70C6E76FA229339116300E5DFC6323D8994762FD0F5329EE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785735390, "uuid": "99b64786-7b11-45a3-92cb-791716ac549c", "value": "98304:ou/TZTsj7BnPZHrx7iffsL1gH8t7FcJktXGFNHS1evhXIGHboH6QQk:ou7ZU7BPZLx7iffsLGq7FcoXGbSy4G7C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785735390, "uuid": "71c29252-6ccf-4a0a-a051-5773faf132ee", "value": 4100687, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785735390, "uuid": "155ad565-de00-4a58-8abf-229535d0a33c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785735390, "uuid": "eafb1f7f-97c2-4195-bec6-dd1e53b97e8e", "value": "HSBC_BANK_PAYMENT_SLIP_MT103pdf.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5fecd9f-8f87-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785794926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785794926, "uuid": "8f04d663-5e0b-4c7f-8e56-fb68b221ebe1", "comment": "Malware payload (Mirai)", "value": "18a0b904a05e254b47cfc53fd3d9124d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785794926, "uuid": "ce4c4c47-2444-4a29-8c4c-ba981cbfe555", "comment": "Malware payload (Mirai)", "value": "a436e07cda8a6e551da873e7d2f4e4960f259726f6b78fec9beac0337f2cf0df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785794926, "uuid": "8f1803b8-e321-4da8-b49a-e0f0f393b888", "comment": "Malware payload (Mirai)", "value": "885ba947fafdc2d7bc27fed5b54fda3ad3c7d31a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785794926, "uuid": "caa1d8a6-e225-457f-9097-377e273ef7ac", "comment": "Malware payload (Mirai)", "value": "def0bfdee4c6ddeb7e36eab331e4fe717bc1ab3a2c9718b5783695e0eef8ebfb4ac411f2a7730efbd4822329bad74e08", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785794926, "uuid": "b3ea8c9e-a31a-484c-8ee3-2d3b0b82358e", "value": "T142144B02B5C090FDC8D9C1784EAFA636EA71F49C6234B25B27D4AF262E5DF211F2D644", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785794926, "uuid": "722dacfa-9616-45ad-a2ee-21575184df6b", "value": "3072:XuqOqZLrV9TnRfwDrvIfRheBA4tZeCjLJTh8oCN5qCUf+LbJu4P5A:XqqZLr7puk86CmNMCUA5A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785794926, "uuid": "15ec21a3-59a8-4766-a84d-6055d99fcf11", "value": 208504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785794926, "uuid": "00fb55d9-c09b-4b73-90dd-9dea7cb937b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785794926, "uuid": "c1e9218f-4cc2-4bad-8eef-8acf950e166a", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7d609de-8f7c-11f1-bd95-42010a9c0009", "comment": "Malware payload (NanoCore)", "timestamp": 1785790205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785790205, "uuid": "bff9c33b-0eaf-44d0-bb36-583dba159ea5", "comment": "Malware payload (NanoCore)", "value": "160609deb66c8834b519d11004569076", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785790205, "uuid": "5e65ab2b-6fb8-417d-805b-bc053b22c3b5", "comment": "Malware payload (NanoCore)", "value": "a449b1aa31480572952a07d9dd29ad0a3c53fce17735208b032d70f8b63c4423", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785790205, "uuid": "7c48d2a1-d8b6-4cab-8dd9-e6b9f2dc5816", "comment": "Malware payload (NanoCore)", "value": "9a4d501e0a5e1df65f0001bce2a82f5ba17473b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785790205, "uuid": "44d02e8f-f39e-46d7-9e25-b5e6ab47359d", "comment": "Malware payload (NanoCore)", "value": "65372ced70321a446389829ef6f4094e0d4630b5fbec63c85177ffae8786f156600cdd3efb6ab14d9531b2c09e1ddcbd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785790205, "uuid": "48080dba-5bca-4d00-b587-b2a1cea4c0cc", "value": "T1B014CF167BA9492FE29E867D611202138379C2E398C3F3EF28D464B78B667E506071D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785790205, "uuid": "6db52171-4480-46d1-a99b-1cee850621d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785790205, "uuid": "f4d1e8f8-d9c3-4bfd-b0c8-5e54b51c4bea", "value": "3072:MzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIMVC/Ma/FfqL4m1FYeRBtm23k:MLV6Bta6dtJmakIM5+/BFCh1FjM23k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785790205, "uuid": "31f6d0a7-5a63-4883-84e5-7fef568a5178", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785790205, "uuid": "289ecdd2-d6d8-4072-9009-e3eaa30cf8bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785790205, "uuid": "2f4e5072-ef10-4d93-a583-1431af562907", "value": "160609deb66c8834b519d11004569076.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2989fe42-8f73-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785786020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785786020, "uuid": "b07ded6f-dc06-4eef-a67c-0dcd4b5a2ae3", "comment": "Malware payload", "value": "a3f1934e818f3346093cc38dce83cff6", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785786020, "uuid": "f947f37b-dbce-4762-9213-0e0146588a2f", "comment": "Malware payload", "value": "a54e7837caa075420bbeda443b95cee6d4501384103f6617015b6f0aa6115c0b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785786020, "uuid": "5de6efb9-db58-4c82-a508-eb07653b5995", "comment": "Malware payload", "value": "0ac1759d2567a55f2251a99d63a4c290209336a9", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785786020, "uuid": "b9e18a2f-5361-48ac-87b7-c685db750e1c", "comment": "Malware payload", "value": "0234375a2b140dcb43fe02b05488f032cf9527b804d196c4d9624bfe1bf81b41fd9996c9acc8332bf214faada00111da", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785786020, "uuid": "e9e25e13-6405-4d46-8019-c2cb8883999a", "value": "T1B301ABCB8814691040AA865E26975558F821C3CF1A4A4B79FF6C7E3EEB88C04F07AFC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785786020, "uuid": "b04c99b5-ecdf-4907-9e91-4fd9be176ac0", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkaRC+SX7RFCQatPFWojC0AwCE4gF11CeX:kXCKysE2hi0ziQvZohaRmLjifjBD4W9X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785786020, "uuid": "8182b34a-9c47-4427-a51f-e8acd208f4e4", "value": 840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785786020, "uuid": "912de02d-1de5-4292-81a9-2ddc7b126866", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785786020, "uuid": "4c904025-3b07-4cfc-99a3-b269988335dd", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e62e5fe2-8f5d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785776888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785776888, "uuid": "7e449ef4-95ae-4a55-92ac-585bae02308b", "comment": "Malware payload (Mirai)", "value": "0b1d8bc3dc3f6cec106f3ed925082bfe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785776888, "uuid": "29a088e4-d7ce-4776-b5bc-c89c53d2faaa", "comment": "Malware payload (Mirai)", "value": "a5a9448b346eac7a6a24f2fdb39357e919040cae21a8e16dc417ed69d83bf761", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785776888, "uuid": "4e8865ed-9486-4162-b56e-637237688588", "comment": "Malware payload (Mirai)", "value": "0f7d4c55267ce61712dff19946c813529b32611a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785776888, "uuid": "9cc44ee1-de48-44f7-aa27-c446b753c1ef", "comment": "Malware payload (Mirai)", "value": "25a406db60017b1e5b91cef7cd44e6a1c0de9de3cc548af37c2fa7b6c56df3198e406b816032a202d1955d9958737a04", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785776888, "uuid": "3dbc4a23-5c95-48ca-992d-40c51f6dc197", "value": "T101434B1275791A07D0D165F9117BAB4172831AEF12A4D28FBE720E4BFE213082D66EF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785776888, "uuid": "b4089043-fcd8-4efb-9651-86e6e93f5c11", "value": "1536:X98FGV9QDI/mliFVoRUWMtul8Xps7EKAsTXFCJjWIymQY2AUYci5hh1gnVm:XuxXIMAsrFnqhh1w4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785776888, "uuid": "7f7e0a54-e6fa-490b-9eb2-7090f2f9f2c4", "value": 60408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785776888, "uuid": "826a4e19-721c-4b47-9454-6c736701162c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785776888, "uuid": "25baeb0a-25a4-447b-98ea-6aec4a94cd0c", "value": "boatnet.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7930101-8f2d-11f1-bd95-42010a9c0009", "comment": "Malware payload (LxBaseRAT)", "timestamp": 1785756167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756167, "uuid": "4c531639-12d7-431b-a929-40b914dc48f4", "comment": "Malware payload (LxBaseRAT)", "value": "aaba04d0868da3e44d379dcfa9998a26", "object_relation": "md5", "Tag": [ { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756167, "uuid": "5944562f-fc4a-4e3b-8c29-401a820168b2", "comment": "Malware payload (LxBaseRAT)", "value": "a68239c9afb1eb0b6d59d99100127210ab12037e9c993471a7610b3392612656", "object_relation": "sha256", "Tag": [ { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756167, "uuid": "93a88a6e-7c73-4e6d-9835-6d9693fd12c2", "comment": "Malware payload (LxBaseRAT)", "value": "dbc837d747a972cc1c0de60ed00b2cc40b4e4763", "object_relation": "sha1", "Tag": [ { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756167, "uuid": "3033807b-0502-4e1e-ac6f-2181ba3eb077", "comment": "Malware payload (LxBaseRAT)", "value": "b828233081af01222d73ebd1309039416b876436603ebf5660b6cfdd895e7b1b42897f1c9239d3645b210e046cd2b8bc", "object_relation": "sha3-384", "Tag": [ { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756167, "uuid": "57328d5d-e7d8-4ffb-a588-7dd0b0a8c431", "value": "T17B3533EBD03DCEE4C652AD1A2917C612A888ABE3AF0B513450CCDC4978EB5447F49F79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756167, "uuid": "4297dab1-e956-40b6-bfeb-b6076b7e550e", "value": "24576:rxSpBymaf4POYLo8PnQpjY+s2XMre7mR/:rUBymaAPBL1cjX1Xcew", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785756167, "uuid": "9d4c493a-05ea-4a2b-9255-a08d33d5fbe5", "value": 1082802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785756167, "uuid": "2fd4b9d7-5062-4f8c-83be-35af8bf89b2f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756167, "uuid": "cc025e87-bdad-47f1-a0e9-0ac16b05bada", "value": "RevisedXContractXforXReview.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f289cf6-8f2d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1785756126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756126, "uuid": "578361c8-35f4-4acd-8318-684a2d4f3155", "comment": "Malware payload (Formbook)", "value": "c99a6f0ab9d6577cfb961b911bead78f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756126, "uuid": "95cacc72-98aa-4dec-86ba-6fcdc6a97bdc", "comment": "Malware payload (Formbook)", "value": "a6d4a7d43d4868e871e0caac0ac2cbaa742a1c0a2416ce70c43a5e1c418d4a64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756126, "uuid": "50f24564-5754-4e7f-b0d3-62c09727dbf8", "comment": "Malware payload (Formbook)", "value": "7e2a19a78582bbd5043adbf08a74951bc78b62e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756126, "uuid": "aca2b105-8b4a-4206-bc21-9a72d9271f27", "comment": "Malware payload (Formbook)", "value": "2268d1821ff41e879e6f0e97aab92a4f2eab460730e1659ef0245c547fe8aa650a3e650f5f793108105a4fcfac97588d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756126, "uuid": "5dce22d2-23ff-406a-a983-353859935c6b", "value": "T17AF42315A6A49327C1AD47F553E3127013F13C493222C61D998DB8FFACB2B48A6E47E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756126, "uuid": "2774e063-d136-4f3a-87d7-e610c4764d27", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756126, "uuid": "afacc4f3-ad38-4b88-ab02-db96b7c7d55b", "value": "12288:+GbXRFbxQ4sVlmZfR3hI5TzK0EnXOt2cka6A0aKyRROpDbN:+MRFNh2kfRRqwXOt2cka6ph7pD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785756126, "uuid": "da0d7afa-b41f-4e3b-a8e4-4871b9ad6250", "value": 734720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785756126, "uuid": "77f64985-6df6-4ef7-ad3a-fb673ba493e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756126, "uuid": "fbedcada-7869-43cc-9b7e-c510886df5ae", "value": "DHL_AWB#6078538091.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "153954a4-8f3d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785762793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785762793, "uuid": "7ca5f062-e377-4f9d-84c2-6e1bdda643b2", "comment": "Malware payload", "value": "de6ac97a12722368a7b944682aa01525", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "PixRevolution", "colour": "#D632F0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785762793, "uuid": "4dba53b2-a452-4c16-8140-ecb870de12d2", "comment": "Malware payload", "value": "a812cba48749a1bd14931d235f75f54f52710463eb4cecb1b4ded8d82be93a42", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "PixRevolution", "colour": "#D632F0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785762793, "uuid": "b49f50c9-f33e-4d26-bdb4-80c8c86e0733", "comment": "Malware payload", "value": "ba166c29e606339abe5accc97310eb66a21d8b90", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "PixRevolution", "colour": "#D632F0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785762793, "uuid": "b4b743f2-8774-476d-ba39-eb1f9c84c47e", "comment": "Malware payload", "value": "be9c0e56e988cafa82509ca74a6811f612e7566a883b5057a46619ac1a1028011bf796eb62a7a30ea77aaffbf2ab3875", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "PixRevolution", "colour": "#D632F0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785762793, "uuid": "fb9f9494-1835-4533-840d-927aea5b758e", "value": "T16895AD85BBE99E2ECC7340364F4A5635150AAE27C343C343D968361C78BB6F44E897E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785762793, "uuid": "b6917f0b-49ae-4f8b-b938-d5661c82a187", "value": "49152:fHjfyQEvcI+IMydEaOqVtrr32vDHM0d1PXqjgI7ov6:fDaQPvXyd7trqd16ED6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785762793, "uuid": "546a1781-980d-4b69-956d-344d183ddbba", "value": 1916804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785762793, "uuid": "1fe741f5-d7e8-42c9-b4c0-404ece7454d8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785762793, "uuid": "dc25c753-1c11-4381-9125-f9d50d9f976e", "value": "a812cba48749a1bd14931d235f75f54f52710463eb4cecb1b4ded8d82be93a42.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25a554e9-8f03-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785737910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785737910, "uuid": "26f46a93-163f-4455-a41d-77f8ecc58423", "comment": "Malware payload", "value": "aec6723e05ed1a9e950b8b198704aaa8", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785737910, "uuid": "4a556557-19a3-479e-b295-b08e49557812", "comment": "Malware payload", "value": "a9fc447095138d8f1a020ee65cb1d73da56d06e04855aabdd0f170dfb4b38e3d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785737910, "uuid": "ab5162dd-9a1f-4919-8df9-2fef0fce0b60", "comment": "Malware payload", "value": "9fa3cb13c7d39fd09b56c94d99ed24ffcde01de4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785737910, "uuid": "19768d6f-3406-49f8-b065-933b76a3dc3a", "comment": "Malware payload", "value": "e3af0a989ccae4387312ca41666ec51a20d84ad3d3a18d2cc56888627e5eea49c79e2cbfdafea77e1dc7a4a5273d5e45", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785737910, "uuid": "99f0d69b-cf35-48db-a7c5-016cf3f0d364", "value": "T1AD236C6516857C14AE98C8375C7F2F0CB9AD43E6314492EE7FCA3CF28C4A6AD920871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785737910, "uuid": "34ea6dae-958f-41b2-aded-0c475ddcb1c6", "value": "768:t599NyXsZztC09GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:9HusZ8cr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785737910, "uuid": "b2a2950c-7340-404e-a356-394bfff372a0", "value": 50051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785737910, "uuid": "cab980b7-ff4f-420a-a87f-b57c18f6f50c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785737910, "uuid": "172536ea-3faa-4df2-a32d-6bd8f65da289", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08cbff3f-8f3a-11f1-bd95-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1785761484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785761484, "uuid": "d9746838-5b03-4029-b414-0011a3f10a9e", "comment": "Malware payload (ValleyRAT)", "value": "bf7f77f3348fd14bf997764f5bf79617", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785761484, "uuid": "38228341-f5b1-4336-8311-136f0c3ff99f", "comment": "Malware payload (ValleyRAT)", "value": "abb8a45533292bf79cacd52c3a23f8e1530ec53d459cde3182a60f4e4cb2233f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785761484, "uuid": "9ade45c3-c471-485b-b262-7dd5ddb4e7b5", "comment": "Malware payload (ValleyRAT)", "value": "385eb58fc4ed6c6c76d282bad2fa55addf9237b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785761484, "uuid": "9aacd537-3558-4ecd-8a13-5f909b27a77f", "comment": "Malware payload (ValleyRAT)", "value": "8f331c0f87d80836149c72a497a297110e255cddab31de30a174de58f3bdbaf0c377cbbcecb7804c4c8f332aa56b55f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785761484, "uuid": "af015a5f-5d1a-4f8f-8e47-ac31b32fe11f", "value": "T188D4E01176C1D431EA73147249B9DBB6892EB8310B2459DBB3C807FADB305D0A736B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785761484, "uuid": "490cb890-d71d-43e9-ae2e-4569b386c07a", "value": "2cd79d6acb38a90f0228c6c4889b3036", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785761484, "uuid": "71f2e755-4119-479c-9e8d-cebb56e60d14", "value": "12288:JLBWY+IfognxMEUWBsOB49u+9WbFx5DNMCsQvm9oHP6v:l7nfoS/BBAkdx5DaC7m9oS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785761484, "uuid": "df302cf0-ca6a-4acf-a83c-aa4720124db2", "value": 599040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785761484, "uuid": "ecb4d588-21cd-4847-a9a9-2413db70dfa4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785761484, "uuid": "97275870-25e3-469d-8ae6-4247aab0435f", "value": "unzip[1].exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ebe1537-8f40-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785764286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785764286, "uuid": "dfea4ee0-2a1b-44fd-8282-562b8dd301c4", "comment": "Malware payload", "value": "c0130801fe6ec76abf4a94deec9d1139", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785764286, "uuid": "83f6a393-4dad-460c-a46e-3a9a69d16f08", "comment": "Malware payload", "value": "ac3e94e72860081a46fb643a85dccdc11b601908cd23f245516aa865a3035435", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785764286, "uuid": "74406240-9872-464d-aa82-89cc6110a1d7", "comment": "Malware payload", "value": "f3a880047c69a542371e92c67afbd85107fbc1a8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785764286, "uuid": "9e991ff8-f9db-4003-8860-88124a84de49", "comment": "Malware payload", "value": "802542c7eebb179e913c1ec88ced40cbeb94d70a8b94ba80886607fef54ed6ded0e4dadadc6dcbf589ef31f0f280264e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785764286, "uuid": "d4f3f1f8-9999-4471-9d37-1625a351ff27", "value": "T131E0F165FB0851B823D0877498C8F04339071FF00F801437F18B3922206085D3436975", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785764286, "uuid": "076a2c21-97d4-407b-82c7-c18b1ff3adc2", "value": "12:+9m+OuyLCEUavQhUI3Dvs+4k/uhUI3Dvzd:amGWlvJI3o+q6I3Xd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785764286, "uuid": "beb9b399-7e36-4a2c-8667-766f28a0fffb", "value": 401, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785764286, "uuid": "d71131df-0f94-4982-8b0c-da086af17afe", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785764286, "uuid": "f5e08150-3969-4d43-b320-5d45ea0cc11e", "value": "w3.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5713c86d-8edf-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785722531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785722531, "uuid": "d43635a9-4c34-4965-8b70-9f11ce146a06", "comment": "Malware payload", "value": "cbfd16a655e1fb1ab26d45137339f09b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785722531, "uuid": "6b941379-788c-46f2-bd1b-f54a66c46d85", "comment": "Malware payload", "value": "ac48d17645e060f4ce0b9e22c43e7175ecc0c304fb2a4a3cc8a377a0548f2fed", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785722531, "uuid": "82c8624a-647d-40cf-8d71-3b68fc193c1c", "comment": "Malware payload", "value": "a9e054e0ba6c6ed134d69c144714cb6f6ab448e3", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785722531, "uuid": "e3672241-a8a3-49ca-9ea1-5149b2fcbd59", "comment": "Malware payload", "value": "1776ff8b044a35ceb3f997c4c4bd11c669b9d8c42aa55ec0d626e313ca578a729cade4478e1847ef0e7a3da43fa00520", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785722531, "uuid": "85670a0f-1e1c-4cb7-8bd9-f3f305b2efb5", "value": "T1BD31BCD9B090B132B489E7FCEF1EAF5875033AAD75648E0894F17C64E66D8047C8A5E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785722531, "uuid": "ab6c41c6-39a5-4492-bf07-2f557d6c75fb", "value": "24:rjLhUWKqJMaXMMdSRmBLrZsCD6yqJpYX8vpvpIrlgPocoLH:rPfKqJMANdSRmBLNsCuyqJSXAVH4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785722531, "uuid": "a56226ce-a2ba-4801-93c1-5481feabddae", "value": 1470, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785722531, "uuid": "0f4a758a-d9ee-4395-a8fd-4376a811277b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785722531, "uuid": "59ccd0c2-ac7e-469a-997d-807283f85daf", "value": "loader.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b13703a3-8f43-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785765632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785765632, "uuid": "de9de803-2f81-4496-997e-fc26bb8c0b21", "comment": "Malware payload (Mirai)", "value": "98aa39287f035a9cb8ad24a062a6d88c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785765632, "uuid": "d23bb60f-22c5-4068-bc3a-8e0b5981fd39", "comment": "Malware payload (Mirai)", "value": "af523b32e0c961edf7b21d921ca2842c6376e5e82ebc950ebd47c9bdf3c763e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785765632, "uuid": "4480166f-310e-48fa-b5c3-4242d01ece10", "comment": "Malware payload (Mirai)", "value": "47ffc2d769672942fbf843cd87a5a05e3e0c4237", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785765632, "uuid": "b4cf0c87-a7bb-40b7-a2ce-3785e284b09e", "comment": "Malware payload (Mirai)", "value": "c7115824fc7f9d1ab082288d1adf83e0f6b38bd8b42b31096bec15de6f28056be98353f7ec51f260b4c0dd42ccbc57bf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785765632, "uuid": "4f62f0dc-93c5-4294-9b9b-85d49710b06a", "value": "T116733955BC819617C6C2627BFB0E428D372663ACE3DE32079E145F21378B96B0E7B542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785765632, "uuid": "2daf5161-f12a-47c4-a081-e9454d30922b", "value": "1536:Krym6jopDmnm5w2xOSxC7eAtkBQc/gA//tS3gKBWHFdVrCO2HHmalB4wea6:2pmopDgmbOSnAtkBj/gA//tog9FTrCpS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785765632, "uuid": "27e11a3d-af0b-46ba-a445-9704ef5d079a", "value": 74928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785765632, "uuid": "a198af8b-ef3b-49a1-afd2-1d3d46773db1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785765632, "uuid": "3bff996f-75c6-48b6-80cc-8892d718ccd6", "value": "lul.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc590907-8f0a-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1785741169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785741169, "uuid": "32d68835-5c37-43ed-90de-d316bdb822ef", "comment": "Malware payload (ConnectWise)", "value": "16823f26de6de3e5beda18e2270c699c", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785741169, "uuid": "17ee3882-8a2d-49d8-814f-b34e61b35436", "comment": "Malware payload (ConnectWise)", "value": "b2e392f33490b0e3fb6cb963488771272a284862c66797305b535c98f8a4bfc7", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785741169, "uuid": "d3ecdd34-73b6-4aa7-b247-eae79cbb09c0", "comment": "Malware payload (ConnectWise)", "value": "3610851d2eb7c4d4c0a652ec9e0f7cf305210f53", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785741169, "uuid": "a26bb558-184a-4c17-8d41-08b81dd65573", "comment": "Malware payload (ConnectWise)", "value": "bc6f7ecac10e0afaccdffcd1fb0c10a405c722febdd4246f77a9bec4a3db56a3d74b3348d3f396b88ec5644c5aa9465d", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785741169, "uuid": "25d2e178-739d-42ae-9ea5-5311bb5af0ef", "value": "T161647C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785741169, "uuid": "17754ec5-bccf-4d07-982e-d1028551d3fc", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785741169, "uuid": "1e0d617c-e297-4ded-8844-914b684cf2d0", "value": "6144:CmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9O:B1iw7gryNkSV1hy1Z1u2JLu9O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785741169, "uuid": "2d61b1f9-d66b-463a-9a0e-978d11025eff", "value": 312528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785741169, "uuid": "bec53dec-7249-42eb-996a-234f226d3c4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785741169, "uuid": "73942b56-ef18-4faf-b98b-67ff6085a00c", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b47b13d-8ef8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785733222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785733222, "uuid": "7b098267-85c6-46cd-81c9-0b6129f4523e", "comment": "Malware payload (Mirai)", "value": "dbe03681f401b5903f71d0ef64b89d2d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785733222, "uuid": "c387fa3e-3fb0-41d6-886c-4e2dd289b70f", "comment": "Malware payload (Mirai)", "value": "b3de6338ef03006f2dca23d19704e4dca3b2823afc6a9a3fe5ac3b34bf65164e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785733222, "uuid": "fff048c2-0c06-4fa2-98e8-9c0ccb8d7e93", "comment": "Malware payload (Mirai)", "value": "0277a188dade67c2a58c584609a1c56deec27d3b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785733222, "uuid": "ddada887-1206-4d17-af6d-47916dd3e14e", "comment": "Malware payload (Mirai)", "value": "dd95155b4ae49c815da37bfe20ca1db08a88791842016e2fbf0e08c3071b4ecb3caafd9a85424015d746872f9de54834", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785733222, "uuid": "07dcfa20-7c33-4317-abb8-64a56812a56a", "value": "T1B4018EDD405563061740CE25FC938C79642BA9EA317AE658F296BCF88DCC2092D396FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785733222, "uuid": "59908e06-38ae-4a78-979b-1e5b60f2af9c", "value": "24:3J30C9GfCjsYJNIxVVXK3K0ddfhFzTks23hp3Lt6KspyhMehThj:fN+bXwfvTkxxX6FkhMephj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785733222, "uuid": "33aa3f6a-1666-49f5-8d19-4e2c8f1a2ff3", "value": 828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785733222, "uuid": "edaeba44-5779-4ded-a142-a7f8b6488245", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785733222, "uuid": "844c95da-aa58-4639-a8c3-aa9a464a3b4d", "value": "3.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b99fa27b-8ed4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785717972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785717972, "uuid": "49c156b8-78cf-4aab-b4d8-42f4509ebc2c", "comment": "Malware payload (Mirai)", "value": "114493ebbcf497fb3089023224ae0665", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785717972, "uuid": "4f906d77-e1c0-4273-806a-6fa6111be862", "comment": "Malware payload (Mirai)", "value": "b40a8ddcb9e9da71f24f4459cbc7fd9a9c807d172082c0cc4ea6238b7ea9b003", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785717972, "uuid": "9658377b-b23c-4ff3-9aec-40f1df497091", "comment": "Malware payload (Mirai)", "value": "f05ad5b0c172d38f53a8aaa500ba92feba9c7d80", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785717972, "uuid": "cf012fbe-febd-4850-a0a6-4dca9d7f8e91", "comment": "Malware payload (Mirai)", "value": "23934c34eaf965dddd28a5cf667d7f24ee120336c62154003141fd538457f15bc79e0b6774c90130fd21d1a3f6a7fcff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785717972, "uuid": "6ad3f6b5-85a1-4bf7-ae22-6ea98203c1ca", "value": "T11F93F781BC824A2AC6E013B9A66E728E3361B3F5D2CF3117DD615B12378528F1D67F91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785717972, "uuid": "6512763b-a330-4e0a-b004-14bd7e56fa61", "value": "1536:TMqCAyYDftxiBqVu90Zn/mwLUhLqsKzltFaDfqk98oZIH:TMqCAti8X914uTQmH+IH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785717972, "uuid": "83f74902-0f5b-4edd-bad3-3767bfa0ef56", "value": 91584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785717972, "uuid": "f7f6b119-9ae9-41fc-8fc6-0ae8c78593f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785717972, "uuid": "27af83b3-b74d-4dc3-931c-ba85264fc37f", "value": "nz.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a146077d-8ed4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785717931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785717931, "uuid": "9fc1e267-9ec4-45eb-ae30-6bff147304eb", "comment": "Malware payload (Mirai)", "value": "5927426cf05a4b5fd0410a55b6236936", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785717931, "uuid": "f3676aae-7d22-44ac-85a1-b2c96858b0c1", "comment": "Malware payload (Mirai)", "value": "b46800eb4eb3fbc6decc75bad5ebb5b400e27200c50da23199bd1f6a07537820", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785717931, "uuid": "e7c8865f-3eb8-4d9c-ba7d-447ec08159e3", "comment": "Malware payload (Mirai)", "value": "fc9113f3f04609cd5dbaf391d75585d3b5d9c91e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785717931, "uuid": "50e12446-9ca5-47e4-8d61-9b44f846111a", "comment": "Malware payload (Mirai)", "value": "68ce54563fe175d0b475f4d1ce6065b80273f1e75d6932f45a22c1878518d28306e69965db72ba2c25a241bfc6b45938", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785717931, "uuid": "0a81aa1a-bf98-4463-ad1a-85828a52b9f1", "value": "T1B333F18CBCE1794AE969027243CE0F514A602575719F878E670586CEF6DE32FE80A1F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785717931, "uuid": "b49a6ec5-184c-4777-be01-280a8001b2b2", "value": "768:A82KPy+WUJ1G4GcPXqa7itQ2Rn/arWaY3eRV014fw/J2B9YszEKSmskTAJOTWG:5LK+Neavqdpaqvev014f+JS/Fjzj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785717931, "uuid": "be5721ab-0a76-4a41-9bfc-f32148b800eb", "value": 52836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785717931, "uuid": "16392705-e53b-4d4a-81aa-95069e0d8164", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785717931, "uuid": "6886765f-3c20-46dd-8104-81bb49579ca2", "value": "nz.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a537d05b-8f3c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785762605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785762605, "uuid": "749db3f1-0f8d-4b77-8a9b-9de7cb8257d6", "comment": "Malware payload (Mirai)", "value": "cb85acdf71df75104001049f1911cb05", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785762605, "uuid": "a9c5af8e-eb04-4ca1-a46a-e7fecd789809", "comment": "Malware payload (Mirai)", "value": "b4e161da6102f24ec7a1508ce2a11dcc26cd32c00bedf7a2e865305e77cd8496", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785762605, "uuid": "ae8ce587-d9e5-41de-86fe-d6421b795742", "comment": "Malware payload (Mirai)", "value": "811e0dd6613d0e4928ec23fa05209acbb0f73774", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785762605, "uuid": "44b0bdc4-f81f-409f-b1e9-b74c0e4f42a2", "comment": "Malware payload (Mirai)", "value": "968d3213a3b31292e0f2033b2357b5744f986fa5624396b53ed505c89350baaac8b9faa938b7faa7fbf970f0ad06c37a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785762605, "uuid": "8cc693e2-fb33-4731-a210-2a27894ec513", "value": "T1EC240A17BB511EFBE86FCD3709991769259CF49612E82B376630C52EB60734B09E3CA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785762605, "uuid": "3bfc6863-b20e-41a9-a9a7-4a46a8485f0c", "value": "1536:Wv6cml1T/TUa9lZB/xlCl1AxFa6SbKyMHciTzR8nL8hC4lvh8wbcbwEdPerIFc03:W4l1DTDNb01bNh8UbwEPeOmkuYVnQG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785762605, "uuid": "08749995-dd17-47ef-ad7b-9dcab5986e94", "value": 210368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785762605, "uuid": "044c243c-9247-4704-8d88-07f10efcdea7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785762605, "uuid": "ecc2f78b-5c65-4154-aa1f-c58be6a9cb31", "value": "tmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e05efb62-8f2d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785756262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756262, "uuid": "ef3e1d96-b21f-4922-af4d-d0c607bf6059", "comment": "Malware payload", "value": "71d22cfc7f630feb88a9ba7c2fed00d9", "object_relation": "md5", "Tag": [ { "name": "dn-pdflite-lat", "colour": "#BE5FA0", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756262, "uuid": "154dad61-8598-4661-b7fe-1b45e3fc7133", "comment": "Malware payload", "value": "b60fbc8490dabe517afed9e8c979050bb4bf54726fc4dae3ad3a54f5f01cd807", "object_relation": "sha256", "Tag": [ { "name": "dn-pdflite-lat", "colour": "#BE5FA0", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756262, "uuid": "cf115662-9487-4dac-8c68-7bb0fb5cbde6", "comment": "Malware payload", "value": "1b412060cf561ca9dbed7e5b33b952757060256a", "object_relation": "sha1", "Tag": [ { "name": "dn-pdflite-lat", "colour": "#BE5FA0", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756262, "uuid": "9a29af02-e121-460c-8bb9-a3a25f445c63", "comment": "Malware payload", "value": "bc587d6c6b46d679f26fb67ffc85484de372eeeaeea930db81c2b6feac3e419d16e3d7ac11041d6220f77d68c2297192", "object_relation": "sha3-384", "Tag": [ { "name": "dn-pdflite-lat", "colour": "#BE5FA0", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756262, "uuid": "b26d1c69-1b47-48ca-b9f0-1f162aaca6f3", "value": "T1032368F7BA4656C5FD3149BF6A2F609855846A4213A2D1B8F68FDC00EF88F8E44783D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756262, "uuid": "de7cefb6-94df-4157-8e0e-6b0e405d45d7", "value": "48:5/8yf3ZRwCOtdJrcqUUPy2zDIec7hoCJd0GNz1LNG/8o/DN:5/8wRwCONcqk2zDKhoCHRz1hG/x/R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785756262, "uuid": "046deb14-fb42-42ad-9901-668e84fb4846", "value": 47104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785756262, "uuid": "21bc51f2-3a68-41b4-b7da-5a922340f094", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756262, "uuid": "67a7b864-a2e2-4f64-b0e9-40a4ad922691", "value": "LEITURA TAROT.pdf-HBACOJ.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a8a4399-8f6c-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1785783150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785783150, "uuid": "66fd73b2-e39a-4000-afcd-89738913ec4d", "comment": "Malware payload (RemusStealer)", "value": "58351e26d0d5c6dcd849a126143bff11", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785783150, "uuid": "0082778c-3153-4c82-b2e5-413c21c57e54", "comment": "Malware payload (RemusStealer)", "value": "b6bc2fb4af89149d91c946ac7f7898b2831f2466545d2777b32a6edf0cc34b7f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785783150, "uuid": "5ef8fb10-20ec-43f0-8b1a-57764878ab71", "comment": "Malware payload (RemusStealer)", "value": "68636e1eb64492da1f075a78099fc2453cd037e0", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785783150, "uuid": "ea9111db-5718-4cc7-b11f-eef48fde5f5a", "comment": "Malware payload (RemusStealer)", "value": "b8b4641090e72fda204c9700f29d72b018383646c135cc6995bd60c92884e697b0e853072ba15e56b25cc3a6533a6957", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785783150, "uuid": "0e871cfb-eff7-475d-9dc1-61261ad14532", "value": "T1D0164A176E9448F5C0A9E731C8BB5156BA74B84D8B3133D32E916E782F327C1AE39B50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785783150, "uuid": "64020c13-ecf4-4986-b789-dffd08dcb2d1", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785783150, "uuid": "2dcabdd4-f0b7-45d0-b59f-5d3fafc5d81a", "value": "49152:m9bGkryCMgNVDrCBFJp3QPfJnEY7ftLkI757gYZJN2eoQIWszGtr1LCX2jUDSXd9:mhCUTtLB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785783150, "uuid": "20188c36-f10d-4665-8d06-45f239eb3af8", "value": 4037472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785783150, "uuid": "fd2513f9-28c0-4b9b-96a3-b57eb89f17b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785783150, "uuid": "39842ab4-b804-4d91-aefc-41e580ac0129", "value": "QuickFetch.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d519f2a-8f78-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1785788147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785788147, "uuid": "e92078be-15ef-4d1c-86bf-4c44a2169ff4", "comment": "Malware payload (WannaCry)", "value": "486bb90f6b9e1a9d0e1ae200164e9d6d", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785788147, "uuid": "6da66af3-55fd-45dc-bd9b-f714c397daf4", "comment": "Malware payload (WannaCry)", "value": "b73de5f4e007d0cd7a89065e0069e68cd524acddd073ee9d26b2a120ad9a7e22", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785788147, "uuid": "f1187031-4f57-483e-acec-f9e60e31808e", "comment": "Malware payload (WannaCry)", "value": "0ee18a965627fe12b8447853dc250699671a1042", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785788147, "uuid": "dbdbd426-701b-4d03-aae5-9b23608e4c83", "comment": "Malware payload (WannaCry)", "value": "53a05be98fbce8924cce0447a0b535110a66d30d2fe9d8a5888e62b6379abca7ecb2522dfc62280ec0c60b3bfb15b38b", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785788147, "uuid": "2f34f990-2b57-4cc5-b623-871028752bfc", "value": "T13B36125932AC80FCD11B6275A4B34E26E7B37C96227D870F8B5487660E13790BF78B16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785788147, "uuid": "469f6ab4-9f33-43f6-9b68-e818f038d5ef", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785788147, "uuid": "889fc7ee-bfef-4e16-9cec-0a4672b11abd", "value": "24576:jbLgWbLgddQhfdmMSirYbcMNgef0QeQjG:jnXnAQqMSPbcBVQej", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785788147, "uuid": "1e1bea13-6696-4e70-81bc-43e385a80fdb", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785788147, "uuid": "918734a1-1568-44b6-9c4c-265820ba7982", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785788147, "uuid": "8da9c448-9962-4178-bd3e-840a98f1e1f1", "value": "b73de5f4e007d0cd7a89065e0069e68cd524acddd073ee9d26b2a120ad9a7e22", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e16e1888-8f87-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785794919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785794919, "uuid": "6c2cbc10-9c01-4158-a018-7c11a0882daf", "comment": "Malware payload (Mirai)", "value": "26da6023781adeaafbea6967093204a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785794919, "uuid": "c61fbe33-381f-481f-b86e-95fdeecb6cc0", "comment": "Malware payload (Mirai)", "value": "b7621888cfd420fc73dd74b339ba25c8d826c059b221780407899e66339327f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785794919, "uuid": "46723706-19ce-49fe-892e-77d132a98d54", "comment": "Malware payload (Mirai)", "value": "fc3b00160a6a6185f90fb43944db03dae8252e62", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785794919, "uuid": "2c0dcf36-4a70-4d3a-aaa3-e154376aa003", "comment": "Malware payload (Mirai)", "value": "8c16c377cbe3190cbfe626abfc7342683c098dd5c46f07150f08b6cec98855b228df881b1436b6612591b1bbe685c34c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785794919, "uuid": "a338897d-aee9-45d5-9d92-e10bcbb951e2", "value": "T1A7E34A80F58790F1D817087840ABF73FCF32D1658175CA6EEFA89E36EA67642620935D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785794919, "uuid": "e8ca3d5c-cb2a-4578-9a93-82c51996d454", "value": "1536:hrw3dI6I1MB/chy5GDojWwj2+AanIb7C1IOdAWZrKJNEPI7poWjCfMoleUNheLzu:hMyN+B0hXz6ApnFWgJNEPI0IUNh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785794919, "uuid": "6b8b0412-365e-4593-a7f9-75f2fd55b7a9", "value": 148312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785794919, "uuid": "12c366db-26ae-41f4-8ac9-6344942ae887", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785794919, "uuid": "85cfadbb-83b1-40c1-9293-1c74f6d19339", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f0c67ea-8f05-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1785738892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785738892, "uuid": "a1616c6a-cee4-4116-9b78-2cd06031657e", "comment": "Malware payload (ConnectWise)", "value": "8bd5e72fca970c4f8585bbf6083482df", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785738892, "uuid": "159b2e5d-0f8c-440e-8881-9f17c8d6e935", "comment": "Malware payload (ConnectWise)", "value": "b84630038472ddd00a2088b2de1ded20a5c7c75c323bd2c54231cd73e04a443f", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785738892, "uuid": "4071abd1-eacc-4fff-adfe-6428b645c044", "comment": "Malware payload (ConnectWise)", "value": "953610765859bf0827d5f2351738715490d1299a", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785738892, "uuid": "69b6c656-909c-49b6-b913-43f8597ff721", "comment": "Malware payload (ConnectWise)", "value": "7965e52d25ddd6b349548c3a668e79b256abcd95932f2fb56d198758e26ba48490ccf59538bf368a8dafe5cac6a1d607", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785738892, "uuid": "ce574041-cfed-4ec4-94d0-0e3413ab28e3", "value": "T10F46E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785738892, "uuid": "2b86ef46-f0cd-4b08-a50e-86a1987e546c", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785738892, "uuid": "ac5df8aa-70db-4f31-b5ee-cf5a4b47b7b7", "value": "98304:/zIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:/hfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785738892, "uuid": "52a631d4-ecf3-46a8-bef7-d7b7cf678ec0", "value": 5642984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785738892, "uuid": "d90cbf7a-b478-4148-8b6e-86190cb332f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785738892, "uuid": "2290e29e-dcc1-453f-b88a-bf7ba56dda27", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72ef4708-8f6d-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1785783566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785783566, "uuid": "d9c5730d-0fad-4af6-9858-477b6a6220c7", "comment": "Malware payload (CoinMiner)", "value": "b7235fe5bbef3564c47ed39b9c2df33f", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785783566, "uuid": "2f59bb42-5fbb-4bc9-b57c-39a2c5ecbb1f", "comment": "Malware payload (CoinMiner)", "value": "ba2bdc527333b0d728c712604cda8f0cddec1caebd681f12e4ae4c8d33748072", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785783566, "uuid": "5a242763-3a1f-4987-a67c-f5994a5addb5", "comment": "Malware payload (CoinMiner)", "value": "216bc2cb72c304c1a20ea767a712ea12a40bc7a8", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785783566, "uuid": "f5085378-da0f-4122-a1f6-4dbec1c941e5", "comment": "Malware payload (CoinMiner)", "value": "013de8bda67be14134685cb4abf972014c9f84856fa9b1448dc937d4b1782c05e36d6ac0973b14d1fc31faf41b46f700", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785783566, "uuid": "254daf95-8fc8-405e-90d1-72ff329a78bf", "value": "T1EC322A2B6E450331E3A049B81579468F517C1633A3D3B3EFF733EA994BA52498450EAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785783566, "uuid": "1dce8ec0-73de-4080-ace2-d420938c3445", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785783566, "uuid": "7e19aea0-f634-4288-8454-4747fa319057", "value": "192:R+Io2WJqBlx+eqlaVgPFJxTEZmFhSucS:RBov+wZoVgPFwZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785783566, "uuid": "51e37eed-f1b0-4740-b059-c962d15f7aaa", "value": 11264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785783566, "uuid": "f5aefaa6-58be-4db3-bb61-b6b318b7ab33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785783566, "uuid": "64d5f794-0321-41fa-b7f5-9b02fd3e7413", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c6d0bc8-8f80-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1785791743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785791743, "uuid": "53399c3f-8486-491b-8f0f-1a3c4bae2b00", "comment": "Malware payload (WannaCry)", "value": "b6c54f210cd5cc94a9e99fe406083bc6", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785791743, "uuid": "86df9304-d8b7-4efa-b1c7-cf5b84c912df", "comment": "Malware payload (WannaCry)", "value": "bb47bc91de6fbf45dd8d3348cb6e26fcf1ef2830cd326ec2eaf0e2ff15564ca7", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785791743, "uuid": "036be45d-5c3b-4ef5-8770-004b67efa3c4", "comment": "Malware payload (WannaCry)", "value": "250af1836793ba6da8dde0f2f9332a54ef9109ca", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785791743, "uuid": "8467e511-a33b-46b5-9d21-06cb5cd250ef", "comment": "Malware payload (WannaCry)", "value": "44cfa96f83d240841f60e49573a6b2459275f7ffd9bd6753e4650b80ace4f3dd5c842387d48622c16c69cbd00f7c84fb", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785791743, "uuid": "c73ac693-a47e-4ce1-b680-0a027229164f", "value": "T1E6361259336C81BCC11B523494B34D26E7B3BC5A127D970F8BA48B6A0E13790BB78B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785791743, "uuid": "e2b7b171-df32-4e66-b90a-9ded3cf7d7d7", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785791743, "uuid": "be373dc4-ab6a-4eee-bda5-a507f68ed026", "value": "12288:jbLgmvbLgPlu+QhMbaIMu7L5NVErCA4z2g6rTcbckPU82900Ve7zw+K+D:jbLgWbLgddQhfdmMSirYbcMNgef0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785791743, "uuid": "769f4ca2-53af-40fa-a8c3-4fc30f621417", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785791743, "uuid": "6f786c3a-ab6b-4016-a421-7738c6b86171", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785791743, "uuid": "2f46cdd8-11a6-4203-b5c2-bf4561692e60", "value": "bb47bc91de6fbf45dd8d3348cb6e26fcf1ef2830cd326ec2eaf0e2ff15564ca7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "577e61fd-8f3c-11f1-bd95-42010a9c0009", "comment": "Malware payload (QuasarRAT)", "timestamp": 1785762475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785762475, "uuid": "e1215c4d-dbea-4598-95fa-37ce1997504a", "comment": "Malware payload (QuasarRAT)", "value": "d6ccd3234512a48cd1be709727833c2e", "object_relation": "md5", "Tag": [ { "name": "BlotchyQuasar", "colour": "#41A281", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785762475, "uuid": "b7909072-ba49-4c9c-afa2-152be3d070f3", "comment": "Malware payload (QuasarRAT)", "value": "bb66148445c0402605f3090f0148c5845c9e83c5d73df3558c3967ba2de6b0cc", "object_relation": "sha256", "Tag": [ { "name": "BlotchyQuasar", "colour": "#41A281", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785762475, "uuid": "218c8fe3-92ae-4d7f-ae9b-e293d9dd0096", "comment": "Malware payload (QuasarRAT)", "value": "92179543b4aac52ad4a20e12cffe933977007986", "object_relation": "sha1", "Tag": [ { "name": "BlotchyQuasar", "colour": "#41A281", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785762475, "uuid": "2902fe32-6741-40fa-b362-3188e2c320f5", "comment": "Malware payload (QuasarRAT)", "value": "84a870e62742dcab6ec11e71b2ec131a67eea7d9f4085f8dfab42301d002d98c15876b22bbc64ba7c5ca918c64147794", "object_relation": "sha3-384", "Tag": [ { "name": "BlotchyQuasar", "colour": "#41A281", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785762475, "uuid": "3e714637-b7d8-465d-a0fb-073e362f341c", "value": "T179C6328DE43A95D8DC4335F0BC82188C79495DE59FBD422A442CC46522FB6BD029BBFE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785762475, "uuid": "9f9c9edf-9fc4-4b7e-a2a5-7d414f1c9b1e", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785762475, "uuid": "6efb18ff-b1ca-4893-9fa9-adac2340a108", "value": "24576:cOZTl7DdOhWuiFHoycG9WmkEl+jWm6DbHLsdTa4jliPFFFmGCmYTH/PsyY7dhg1m:4QwrJDk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785762475, "uuid": "dee2c741-bd39-404f-83ea-575f1c1768fd", "value": 11574080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785762475, "uuid": "dca99871-a5f9-46dd-807b-db209ea24e92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785762475, "uuid": "72fbae0a-0258-4494-922b-bcb587bb4dd5", "value": "bb66148445c0402605f3090f0148c5845c9e83c5d73df3558c3967ba2de6b0cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60a0f80d-8f39-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785761202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785761202, "uuid": "95d32643-24b1-4aa3-a01c-dcd37423c195", "comment": "Malware payload", "value": "de28ff0631c9c2f8ebe9eff85abceebb", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785761202, "uuid": "dcc9dc8f-e259-4e10-83ca-b9ebaf6ab149", "comment": "Malware payload", "value": "bc7462c7ddd2602eaa268154aff8a4765bc76e89574a8107ccd2c9fe83820a87", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785761202, "uuid": "e3d350cd-33ac-4250-be62-f5f3fd8abfca", "comment": "Malware payload", "value": "37d7b3d29ca249e586bd3552add95c7785120271", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785761202, "uuid": "46da3da5-d549-4a97-a968-7e4334e3f160", "comment": "Malware payload", "value": "f2a499a9dc4df6fc9f6c8d65de844b92141a7297d8a91f9d755e9c942554a92bf5405218f2c999dce5629ee751eb0b06", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785761202, "uuid": "0d5afb6d-c015-401b-a881-e4cc8fe9c61f", "value": "T13787331F26184B1ACC5FC2BD6DF1060DA0701DA8E923C20B69366CD6D16BBB3EE954F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785761202, "uuid": "d285eaaa-e197-4ecd-a983-41ad6e3c94fe", "value": "2876c35218120d08c062a39fea3a5bb4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785761202, "uuid": "77872f11-32dd-49a2-9315-5f0e3c8119fb", "value": "786432:/vu4LTbYgjwefi/s0R3lNsTkh7uu3h8LVT56BXW7yuKUcDOM2wgUYH:/BDYJea/DRvsTkh7rCLVt6ctcyPUY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785761202, "uuid": "4849c012-73c3-4651-8138-c4a64cb55360", "value": 37057824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785761202, "uuid": "3e437c7c-4953-494f-bf36-ad46ea63ebc8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785761202, "uuid": "5300d49b-351f-402f-89c0-b506fdd1f406", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21645fd0-8f3f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785763673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785763673, "uuid": "837d01ab-3700-47b6-b150-89166d92d287", "comment": "Malware payload", "value": "6e04e1fa392f5cc23feaa25623894e2e", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785763673, "uuid": "7ac32d4c-d943-4785-bdc3-d503fffc420b", "comment": "Malware payload", "value": "bc87e26371e8e61685b57011913b39f360933361b9707c1ef1bf94888dc8f2c9", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785763673, "uuid": "a9911815-01d3-4d0b-bbf9-41edcb9afb9d", "comment": "Malware payload", "value": "526ec3796167f973244b2c8833b5bad68f030422", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785763673, "uuid": "2211d3f0-4ce2-4b38-879c-0b4511f4aa9e", "comment": "Malware payload", "value": "abe13731fbd34c3c4181ee09be572fe620ca4be108e22cec575f47c4efc4beb2770a6e3c680acb25d8673d003000ec40", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785763673, "uuid": "405cac63-8b35-47c5-8f9e-4ef3cf093d00", "value": "T129A17F711BC2D82961CB4848D07ADCE622B39F240975D919F1FCE60E9D66E1C62F82DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785763673, "uuid": "8e337839-1352-40c0-bb89-aca981751aa8", "value": "96:duXaG3e+zK+pc0aSnaPicdfz3vEShwEz3EAeUbn:deaG9zKiacGfDvEQwErEAdbn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785763673, "uuid": "c106d51c-027f-4d81-8136-392ad9314602", "value": 4942, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785763673, "uuid": "06b439d5-19f4-4a13-b4b4-1b0081a5ff69", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785763673, "uuid": "1b738b34-824d-4e01-86b3-ebcd9701ad3e", "value": "Order00390.pdf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7494b0d9-8f55-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785773261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785773261, "uuid": "2ee82dd0-cb76-40e1-910b-911a3b2e8215", "comment": "Malware payload", "value": "de78939a55e8aff36a2999fb56049b6d", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "servpopads-com", "colour": "#E7443E", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "suahoje-com", "colour": "#F702B5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785773261, "uuid": "de36d318-6b7c-499b-9ab0-0b36c9b62469", "comment": "Malware payload", "value": "bd438ba96b05ef5f5dc323a1ce89969000f8aaad32ea3584c00c23f7ee48d42c", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "servpopads-com", "colour": "#E7443E", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "suahoje-com", "colour": "#F702B5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785773261, "uuid": "a46f81e3-a381-47c2-a58e-af1b8829af58", "comment": "Malware payload", "value": "a5e5ffdad731378c491a351d098c30f1caaccb5f", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "servpopads-com", "colour": "#E7443E", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "suahoje-com", "colour": "#F702B5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785773261, "uuid": "b2092719-0664-4d97-846d-f7c5e3bf27a0", "comment": "Malware payload", "value": "3d16c469b162f982d7d9f4838856821475631f037eaca250d914aa13077d7998f47983459c509e7f2e7f28964563ea56", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "servpopads-com", "colour": "#E7443E", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "suahoje-com", "colour": "#F702B5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785773261, "uuid": "e0a5f86c-938a-4e6a-96c2-72d02d9de3e9", "value": "T185953340C03BC7B8DB98E2217A7E3966527F7D3F82198A6299077C35E8953531FC0A6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785773261, "uuid": "1b4905d6-4435-49e2-9a2f-a6dbf688604b", "value": "49152:Yb95fp89c0c72kvycU3rbE79+iaZ96ucATqi9iStYyEmZ:YbX2WpikvE3khEZ96Lg9iRmZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785773261, "uuid": "ccbb87d4-77d0-4b2f-85cd-82220ed5014c", "value": 2000177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785773261, "uuid": "6343843a-b80b-46ae-8d7a-0b2200b8c1dc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785773261, "uuid": "35965eec-1597-4a13-9e40-de10790a6a9c", "value": "1b3ceba6a82929b53c72e137e257f7f8924173d8b0de5852253b7437723f153e.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddba3f07-8f88-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1785795342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785795342, "uuid": "7038b90c-4bff-45a5-9fcc-0ae3fde508bc", "comment": "Malware payload (WannaCry)", "value": "741d9c5a257ec7a77f011afd6f126bdd", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785795342, "uuid": "58e77882-c6e7-459a-a3c6-b7c71cdab8e0", "comment": "Malware payload (WannaCry)", "value": "be4c2b466b21813244238097079ca81abc7af41812eb26d562ded8ff0feaa8e2", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785795342, "uuid": "c4f342f1-e0b4-4118-85a8-44ad5fc0e3d7", "comment": "Malware payload (WannaCry)", "value": "133ff72927085d70d8dea2a9495410b87f3a9008", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785795342, "uuid": "fdc325c4-1a78-4431-9c9f-cbcc94c0a286", "comment": "Malware payload (WannaCry)", "value": "ea56d2276619dbb46880da26f2a6983310953bfb6a7c1ccb2725427ddb1d6fee1146209ef28edd917e31f59b70a1d739", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785795342, "uuid": "e8152f53-e4f8-4403-bf1d-3e9434faedb2", "value": "T123363344A2E866B8E0A20AB904B3CF15A7777C5597BB9A1F0390411F0C73F5AEEE4F15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785795342, "uuid": "fc1f4bf9-ac4f-4f7e-8413-35eabdabe021", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785795342, "uuid": "8ebdf6c5-ea23-41ee-90b2-73109265882e", "value": "98304:DXDqPoBhz1aRxcSUDk36SAEdhvxWa9P5T3R8yAVp2H:DXDqPe1Cxcxk3ZAEUadhR8yc4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785795342, "uuid": "e4486b3e-e5db-4af4-a99a-a3b2e700a819", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785795342, "uuid": "f7c09f7b-f721-4bcc-a233-c1ed544822db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785795342, "uuid": "5d4d6522-1ffa-42c0-84b2-56d2fe736975", "value": "be4c2b466b21813244238097079ca81abc7af41812eb26d562ded8ff0feaa8e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9c70054-8f2d-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1785756278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756278, "uuid": "e7172c65-1729-468d-ac39-7fd0072a1f58", "comment": "Malware payload (PhantomStealer)", "value": "3ebc2c48eb356eff9cf3e6ad50e51906", "object_relation": "md5", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756278, "uuid": "226e9a02-edf7-4a97-8671-8f5389c3170d", "comment": "Malware payload (PhantomStealer)", "value": "c2ed33e3d07e80e5c713c01461a12b8e4dd613b0884b3fc6093bf7d6aaa9f93d", "object_relation": "sha256", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756278, "uuid": "ceac3716-436a-43f1-a1c0-39b6f16fc4c7", "comment": "Malware payload (PhantomStealer)", "value": "b23d10ccb23451f10d6ebed3bca708f04d370b9e", "object_relation": "sha1", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756278, "uuid": "f90b141f-eacd-4446-b29f-7e3058986c77", "comment": "Malware payload (PhantomStealer)", "value": "12d5aaf05835c5f42d913c98aecad4e68579967f74ebd0627d077b8cc29edd275e3c6054607b156de4fe6e8fd394650e", "object_relation": "sha3-384", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756278, "uuid": "c30364be-b6e2-43c4-b3a0-bc949e70fc82", "value": "T1E295336BFA86485259B1C40387DBB7B8FF41CD82E7252AA44E17DD983DD2F99C22C035", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756278, "uuid": "8a3a6fcc-9ec9-4041-91e9-9d98eee37db4", "value": "49152:3/BG/+oqPeORP3e/otkU9y8mXnt5BSWO5C8K2GD/5+9s:pGhzORP3e/otkUk8sQWOW2G75cs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785756278, "uuid": "1b39fb8a-6fe2-403d-8dfb-4bbaff9b511c", "value": 2019565, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785756278, "uuid": "e318d17b-9623-4442-9704-9ac5209f100f", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756278, "uuid": "aeb829f9-b574-47c6-9a52-b1eb8bc58447", "value": "SHIPPING_DOC.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5a494dd-8ed6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785718878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785718878, "uuid": "fb0014a4-fabf-4de4-b35b-eeee36a6512f", "comment": "Malware payload (Mirai)", "value": "b1a1e488733ebde9fccf29a52fb0432a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785718878, "uuid": "491719c6-6625-4e6a-8f5d-eae05da40a48", "comment": "Malware payload (Mirai)", "value": "c3c4f28ac31b86c7b7212831712cbd11bdd58155e57e4e21200754c691992150", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785718878, "uuid": "f484110d-9e2b-45d4-b038-6e7b4ebaabf3", "comment": "Malware payload (Mirai)", "value": "8a833af98a694fe50ef3babe045c239e179853b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785718878, "uuid": "91ccdeb1-0a49-432a-a84a-7640fa4cbf7c", "comment": "Malware payload (Mirai)", "value": "ee204bef41ae6a6211f1856370fead8db5dc115bfac387928eecbce4a2006ce32a85eca6a8f17f5489f193bfecb461b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785718878, "uuid": "a18cdc16-6464-47f9-9114-2c930f2f984f", "value": "T12D230293E7EF6440C42921F9929BB6A48900D27DE54C0976ABC584BB55AFF339310BCF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785718878, "uuid": "fc7bc546-21d0-43fd-b7e4-e000bd18aced", "value": "1536:1SFhK7ZwAfM32X+vM2tPVK5OJwf0oLQqSKNnouy8HyRq:1S4fMW+U2tNcOSzSK1outSq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785718878, "uuid": "fc4686c1-3221-4dde-a4b6-774855b16036", "value": 49808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785718878, "uuid": "715411b3-a4ad-4d14-8352-92b0843716e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785718878, "uuid": "26208b1b-a787-4dbc-a1ba-619024bf3451", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc8cda77-8f65-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1785780361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785780361, "uuid": "419aca6e-ce93-4cdd-8b5b-7d51d6b86d79", "comment": "Malware payload (RemusStealer)", "value": "79f18d51026db9636724450cbe877cca", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785780361, "uuid": "57d4a5f5-9b9f-4c4b-bf25-792402022b74", "comment": "Malware payload (RemusStealer)", "value": "c4e1726827d84a3d77979d1c01baf16518965d9574409e09c1311b89784766cc", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785780361, "uuid": "b3f1b785-28a4-455a-a975-7ddd0b20d847", "comment": "Malware payload (RemusStealer)", "value": "2a9d503cfc3c5c01dfb764af63d15e6d6070c038", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785780361, "uuid": "1ce08274-ffaf-4a3c-86e3-7eaff24127fd", "comment": "Malware payload (RemusStealer)", "value": "7fa5aaf2228b1e633ec6c9f8d73d5d97e09285274a5e83c8d71b8957014dcf4fcd09fb9e05cbbd7b065c0a2c92ffc9af", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785780361, "uuid": "4608323a-6c3b-4658-be40-d10ca3a80b76", "value": "T10ED53389B8C2A990C07AC3F59343B47EB27E7B80CC15CE4F71EC6A51BE5361628B5653", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785780361, "uuid": "ff3b2a1f-910f-4f87-89ae-9cea88524a29", "value": "6a368102586dffa13aabff685459b467", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785780361, "uuid": "2c76d607-c8b1-496a-ae16-b298561ae323", "value": "49152:6A7EfZ6OmuRoWCX0xTFg6Z4CI3xV2xYSWAM4oRX1MYjIAMeb0soic4Bf0pueY3Yd:h7EfhoYxTFgEssOSG4oZPdRblhxYd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785780361, "uuid": "e3415efd-6a33-4f4f-ab8d-10099cc1e50e", "value": 2953624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785780361, "uuid": "8c376951-66e9-4cd5-afca-0baf0f0cbca2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785780361, "uuid": "917b264e-9536-40b1-8939-6fc8a5d1378d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05594183-8f4e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785770068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785770068, "uuid": "8120bb14-32ed-48c3-a5c5-fbec2d9b71c1", "comment": "Malware payload", "value": "5bbf8805cbd4d9526fa57961b158f5fd", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785770068, "uuid": "a1a7d959-ab54-4464-a886-87614bd8d5eb", "comment": "Malware payload", "value": "c4f6a4f5a2b7ef4d8c080c9db932063f6a6569f610e6a1e8cbe251486644b677", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785770068, "uuid": "51d21904-ffdc-49de-9937-427f1a026b00", "comment": "Malware payload", "value": "1666e1aedd8095fc9d30ea923ae676dbcfda231d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785770068, "uuid": "8a50f5a8-b6cd-4bc1-a9be-6adf8655839b", "comment": "Malware payload", "value": "26b73584e03d5b06ca6fd827ead2ceac46cb32a2dcd4c056f3c091fc6c3bd734dc538629013f47e48eec865802d32615", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785770068, "uuid": "34e90bb3-d232-40ae-8efc-230282dd83ef", "value": "T1C60188CAE264A50040D9D82C76975454F431C3CB164A4FB5BF6CA97A9B88E14B026ED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785770068, "uuid": "0283688b-41e2-4306-a3a4-d683b901d2df", "value": "24:kXCKysE2hi0ziQvZohaKKKYkcXvILwK9N+wX:e9Qp+MsKKKn4vILp9N+wX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785770068, "uuid": "b67d0214-7d81-48db-8814-bb5660e91ce6", "value": 844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785770068, "uuid": "e6e9a590-54eb-4ee0-a68f-44cf4a8ccec6", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785770068, "uuid": "c5a8ce78-97a5-4f57-ac0d-bfe3a4ee24c5", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b665792b-8efd-11f1-bd95-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1785735576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785735576, "uuid": "feb3b70b-7435-423a-96ef-ed90ba957682", "comment": "Malware payload (XWorm)", "value": "399a8a3f452d43c6f03cf86bdf3744d2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785735576, "uuid": "c840668b-b858-4693-89e7-b891ada9a6fd", "comment": "Malware payload (XWorm)", "value": "c5aa10a8b215bbf97e41afdc1e5f01bfc08d5d3d698dca70b6b45aab2ca043ed", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785735576, "uuid": "b68357bc-b795-4e92-9fc9-7f512e2e664b", "comment": "Malware payload (XWorm)", "value": "b16c2398dc3cc62d32225cbe0b3343ca6fd00e7c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785735576, "uuid": "19c96e4c-d38e-46bb-b675-72bc803233b5", "comment": "Malware payload (XWorm)", "value": "491f260ff761ff4a83d561332053b86e070183ad553de140349189be527ced54f4f2f9a4be0b04f33a42d023b2cf0c32", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785735576, "uuid": "83fdc873-4a26-46d8-aab1-1c70acb8cfe8", "value": "T18905FEB72BE471104A82B452AC12DB7AF5E745841331E9BBF870D85A2DA4F1845ECEF3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785735576, "uuid": "e419b888-0e34-4397-a0db-5d2501236684", "value": "768:5HFxMC7C7CV9UxU7C7C7ChWl6xW9UV9UFx6xWvCxU27C2xU7CVShMChIWlMC7CVv:8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785735576, "uuid": "5c9abdc4-b575-4a9a-af9e-fb47bab18203", "value": 849459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785735576, "uuid": "ecb1c6fc-ea12-4042-9176-6fa171168d4e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785735576, "uuid": "aef9077d-5cf3-4403-b9b6-01da9b7c582b", "value": "COTIZACION 30.07.2026 GRUPO 011.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30cf09a3-8ed9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785719890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785719890, "uuid": "affccf9d-1245-4cb2-ab0c-cdb8dbb8259c", "comment": "Malware payload (Mirai)", "value": "c03022460eea9c321c91ab4dc7ed4425", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785719890, "uuid": "2313d1a7-c01f-4b92-9a95-8f0076861a18", "comment": "Malware payload (Mirai)", "value": "c7789b031f5c4ce0889b07507bae51be96b442512e31d72a45ebe22464308926", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785719890, "uuid": "5834d3b3-134f-451c-b955-29c595840481", "comment": "Malware payload (Mirai)", "value": "91187f29c7aad937c01a58c6299757e402ee3338", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785719890, "uuid": "9dbaf6ab-ff45-46a5-9e25-d770cd69cd14", "comment": "Malware payload (Mirai)", "value": "57f3c7e7f720cdf4908e2b172c8923dcc5096260b2fcc82ab0fb1fa19347de5064a4fa1b3b41d386ed9cd360be44f79c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785719890, "uuid": "a345b1f4-c503-41b6-b993-959f543c6252", "value": "T114230197E28353F1E2EE197748BF76986ED1C30C60500B958BE07B3D9D80F55B822689", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785719890, "uuid": "d502eb8e-8351-4c6d-9191-183888c3f098", "value": "768:JkZve2hs6Cc3Y+KAgwbhx4eY1xXRnuToDN0Pc3FTmF1j7FFRIayDnbcuyD7UHQRW:+Vs3dLw4eYn8TA+F17nOaOnouy8HyW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785719890, "uuid": "94453763-c28c-4373-8f39-7b6ec65d2b86", "value": 49068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785719890, "uuid": "ae1b7249-aff5-4c7c-8127-f931ab29c4c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785719890, "uuid": "b3505de6-5320-4179-bcac-aec468d59aba", "value": "nz.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "957c7b13-8f47-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785767303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785767303, "uuid": "e1f00efb-6969-41ac-995f-9f6a007140ff", "comment": "Malware payload (Mirai)", "value": "b415c8df94539679813b54ba529b3ae7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785767303, "uuid": "9f415516-80c8-4d92-bfed-75b3005db079", "comment": "Malware payload (Mirai)", "value": "c87be048ce47291e709d120d673b3c37103c551c8dbfc0357563b379f2a81e36", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785767303, "uuid": "85688ee3-7fdc-456e-829f-c89a082cf1fc", "comment": "Malware payload (Mirai)", "value": "4d8980514548f24e422c7357f84ff99b7bf4e5b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785767303, "uuid": "61295006-b05f-40f1-8205-c8b42c40aa4e", "comment": "Malware payload (Mirai)", "value": "041dcdfeb14f4d8515d92c1b47db72a27e754602c05115eed02e186dd91d012945905ca7274d84544e08f268212bf36a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785767303, "uuid": "01349ffb-e3a8-4ab6-bdf0-75e55cc645e0", "value": "T18843F21CB9C55D22C0D18C76F0CA067F236336421FA9EA69FC489BCC271EE3595792B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785767303, "uuid": "dc722455-c5a2-4e25-ab36-c8247520060a", "value": "1536:IM40XLp1LgjSuxiZCTBYG7lm3dEBDkVKZ7ir6J6BAD58:IMTW7uaYsQ3d2ks6BAD58", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785767303, "uuid": "da42aa9b-60f7-4def-952b-93f713d65a8e", "value": 55224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785767303, "uuid": "9f642a4f-9e34-41c0-9de9-506b9790216c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785767303, "uuid": "3dbb0b93-9e02-4948-ba6a-935316b1ce4b", "value": "miron.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "674bdf97-8f63-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785779252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785779252, "uuid": "28e603c2-7b38-4abc-8400-79397f168a1e", "comment": "Malware payload (Mirai)", "value": "100410a631492369e9ebe7b5c6ebba84", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785779252, "uuid": "dacc47e1-936d-42dc-ad13-5bb0a3a27697", "comment": "Malware payload (Mirai)", "value": "c8d58840d3789721d09ff6727bd316ff0f90b6f271baffd80c860785cb110900", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785779252, "uuid": "3e70b60d-0045-4afd-9893-dbd82cbe5ab6", "comment": "Malware payload (Mirai)", "value": "cf458d7eae92805ef09fc7b2df047818f0711b58", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785779252, "uuid": "37e3096a-5fe1-4aee-b2cf-235669d9d901", "comment": "Malware payload (Mirai)", "value": "70e36c6b0f2f24e6231d1c6c1e8d68e5de8513d3d1534072059f87a54b56d66f4df9f5d3214bb1b87b9241ff3b8a3038", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785779252, "uuid": "5a7abd35-4597-49bc-9db9-feb65ebfe6e7", "value": "T157B33A59B9818B22C5C212BAFA1E128E331357B8E3DF73179D242F6477C656B0E7B901", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785779252, "uuid": "2f2b0310-b409-4ca0-b40b-503fd9bc7367", "value": "3072:1YuC8uGbistHQKXaWJ+UfacG8IMywMJV:quC8uGbis7XaWJ+AGJrJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785779252, "uuid": "46aff22c-9037-4a0f-b873-eb411db65da3", "value": 108208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785779252, "uuid": "620a2f32-26f5-4807-a641-e95dcdc598d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785779252, "uuid": "0ae65366-fe4d-4ea3-a223-adaf13feb3b4", "value": "lkxstress.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07606950-8f74-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785786392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785786392, "uuid": "57dd8b2c-5215-49e6-b9f0-e78377729745", "comment": "Malware payload (Mirai)", "value": "5ecebaee3ac6687b61525c2b5f48e08d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785786392, "uuid": "556d508b-eec3-4e23-9179-654dfc1869bf", "comment": "Malware payload (Mirai)", "value": "c917a3ce01191668a2f9208f98824664191dd44742e4788f5e074d78a475a1db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785786392, "uuid": "33d03b69-317b-4c15-a4b7-36fbf3c91f36", "comment": "Malware payload (Mirai)", "value": "f2eab748d491604666029c1a54476aeb03e923fa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785786392, "uuid": "637d0e3d-9d92-4442-a6d8-896f0030a748", "comment": "Malware payload (Mirai)", "value": "fb770c26732aa17cda78a65a5123e62b4b88dc4e1907ccad78ede4a4a51fe279fe8f29020a557a1fa74f5fd1b4b481b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785786392, "uuid": "59a71185-3c95-4685-82a1-bc217c553503", "value": "T1192302972224E3B1DB69D8FF94740D5D3CBAD52A635D1023E7A8F827112440C96AD9A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785786392, "uuid": "d7151b97-7d0c-4970-9c4e-acf8eeb24178", "value": "768:yuTE+/VH0M8wshjM5cEI91YoneVEL4Bg3RiIeNz7eNvCtOCfa8fhOkO8RdKVxfRe:yuTZNKws1lEq1YgeVEsg3RiIoGhCUCff", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785786392, "uuid": "3dca55fd-bfde-405f-8592-4ca08bd4359b", "value": 47460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785786392, "uuid": "6977eebf-7155-4628-96a4-a7c8dcdddf61", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785786392, "uuid": "4490fc69-5612-42a6-ba85-17a9572e2983", "value": "miron.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bca2fbac-8f0a-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1785741170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785741170, "uuid": "68e043a0-8c5e-479d-8c5c-29e5010d1b14", "comment": "Malware payload (ConnectWise)", "value": "1066d3158290ed3341d32eebbd0b3c62", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785741170, "uuid": "e554ee84-b3b1-4ebf-a0ef-7f5e7582ed5b", "comment": "Malware payload (ConnectWise)", "value": "c98df92319f9faeb4b6ad11d2c5c81ba9a49d842bc187ce7a319313aee8a8603", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785741170, "uuid": "237a5ca7-71c3-49c1-8417-a513b9adef82", "comment": "Malware payload (ConnectWise)", "value": "3e2dc22cad235a1f5a210ca563a889e90523d700", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785741170, "uuid": "27593f37-4732-4d50-9b86-bb056b2d577f", "comment": "Malware payload (ConnectWise)", "value": "106dddb2195365586f38d581537076367e5fbd1ed72ebb65b2ba9ee17ac2414e0ce7c9e11a7cbe06739289745b8d2679", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785741170, "uuid": "6b18e1d0-0900-41f4-b4b6-0202945033cd", "value": "T13046E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785741170, "uuid": "b934d75d-4210-4827-9c00-e44c875286d3", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785741170, "uuid": "ab964c8d-6721-44e1-be27-d205535df4d9", "value": "98304:fzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:fhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785741170, "uuid": "ff373523-4d2c-4100-86e9-ce2d0fb1e59d", "value": 5642952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785741170, "uuid": "9e4812cb-0eb5-4da4-8acb-3882654db302", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785741170, "uuid": "2f535227-da85-41af-964a-0758e816303f", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b091054-8ee0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785722967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785722967, "uuid": "f8a3b414-adcd-4366-8f59-cd9e49d47f3b", "comment": "Malware payload", "value": "baa5c780254e69ed390ed4e1b5ce2867", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785722967, "uuid": "82f520bf-55e5-473c-9a1b-252ec6c9384d", "comment": "Malware payload", "value": "ca0c2a644f6c40533811c879c7b0559cb7d01c4399eb2806d3bee0b2f4eaf350", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785722967, "uuid": "f74fdaa3-954f-4b4f-882a-a40d94cc7b98", "comment": "Malware payload", "value": "7a36c0c3268bf6a5ac8890db45ba8c98d9396a55", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785722967, "uuid": "26fd657b-6eed-49f1-82d8-a1b0e2e2d769", "comment": "Malware payload", "value": "41fea53e9c9a46e2fcd98657aae3486dc4a023c2af02be1fe38cb1f7faca87116b49b15d99af3a703f0323811f21231a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785722967, "uuid": "ceafc760-3000-4da7-afbf-72ec5cb9ef31", "value": "T15EB4D029B58C2532E2C7F47FDE4E96B1E027B4FD93A5C0207912824EF2809A55F79F61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785722967, "uuid": "880b7776-52cf-45d3-9c31-c675345a8e4f", "value": "12288:J7rwb9cvslT4sVPwxt75tgoFSd2ndOREh/8+9f:J7OuOTlst7Xg3Ynd4Eikf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785722967, "uuid": "b28409ba-6822-4ad7-b70b-1a0a90a91401", "value": 507052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785722967, "uuid": "1764ae3e-7b4e-4256-8d06-b06baf45e6c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785722967, "uuid": "d985731f-bfef-45d1-8530-46275b81580f", "value": "bot.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4c937be-8eff-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785736513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785736513, "uuid": "167dfa5f-2a4e-43f7-be03-ea476cdcd89e", "comment": "Malware payload (Mirai)", "value": "59342728f6b361c6e3ef3d28edda12f0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785736513, "uuid": "cca62698-53bf-40b9-8cca-c3053b51e02b", "comment": "Malware payload (Mirai)", "value": "ca837b0d63c86622d52c43ac50f4831b091226731bbec18e0eb9895c89f900b3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785736513, "uuid": "fa3cb3b2-07ae-492c-b56f-91f76b176f78", "comment": "Malware payload (Mirai)", "value": "d7e6eff1b5c763ace99b35b893f36a67835f503d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785736513, "uuid": "c596834b-6e30-4f01-8e5b-aac04c301438", "comment": "Malware payload (Mirai)", "value": "01282ef09cb3bd69c176951e306bf3b605512e145d0ffb0a0b1b27f1c2585eb9796596b801640264ed60aec5750e8913", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785736513, "uuid": "6157ca4d-ab16-402c-9e66-296496e6e4ae", "value": "T1C7858D5AF6E364BCC097C430835FD753A935F4A911227E7B26849E302E66E705B2DF22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785736513, "uuid": "c5f8881e-34c2-40e0-9e9d-ec64b01ccc01", "value": "24576:JODOsu1YVO1UuAxzp6Sa6PlTf/jLANojMHa9GzpLLbdr8AUPIT6:JMO31YV6UbnhPlTfbLiojMHawzhbdQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785736513, "uuid": "b375d356-80fc-41e5-91a6-731a651672c9", "value": 1727016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785736513, "uuid": "4e93ad35-0ca1-4a90-b1b9-578631287fc7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785736513, "uuid": "eedd87d7-8cb2-4dd6-ad43-84005cdddd48", "value": "eclipse.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3694f8f3-8ed8-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785719470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785719470, "uuid": "555f499e-4d3b-413c-9445-821db8e4e2a0", "comment": "Malware payload", "value": "e3bf6b7ebded22e3403e71575bc97ec5", "object_relation": "md5", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785719470, "uuid": "087b1f59-e727-4ee6-9366-ac3448f4483c", "comment": "Malware payload", "value": "caac25321fb3b2ec530de8c37fd032b560885dc487f72f72a861ec9c20ae33f9", "object_relation": "sha256", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785719470, "uuid": "b77e7f1f-4f44-4e07-8fd4-77222aa12102", "comment": "Malware payload", "value": "ebaf8d039b4a685e055c1a17862d5d4699f94eef", "object_relation": "sha1", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785719470, "uuid": "faf9e5bd-7e48-4851-8047-06add0aebb05", "comment": "Malware payload", "value": "3133b97ebb2d6cc36db5e26d3dea3d195e86997bfb5096f85a30086b366c3235c77d752c7ec3421f7c816098176fb774", "object_relation": "sha3-384", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785719470, "uuid": "fefb0bfe-7725-43cc-9512-d5f0a999de32", "value": "T15C36C027B384643EC06B1A394827D314993BFA703A139D5B67F49D6C8F35940AE3A787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785719470, "uuid": "d6e372e3-78f8-4c88-b216-f5af92197363", "value": "1a5ad9ae5d9a2a6b6f1f886640a0523a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785719470, "uuid": "bda0c2ad-3529-4aae-b90f-43011a133246", "value": "98304:SmKmn0WMQ9mAHSvQF9QtdqBqJlQ0twTbUijeN0:SZW0IDCSQtdqcJqLbUdN0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785719470, "uuid": "e155f4e6-c42e-4714-b1cf-f3d57622f2d6", "value": 5142033, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785719470, "uuid": "c30e4102-7c2e-4bcd-a2ce-b68e000bfccb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785719470, "uuid": "26c7cb7f-e59e-4b29-af95-0cb3426e4fd8", "value": "Setup - USDT Flasher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5689a770-8ee0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785722960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785722960, "uuid": "b9ea2bb7-2a54-43a0-92d4-4ba5bf386035", "comment": "Malware payload", "value": "f39601867c4fc02bcc1fa4aa7754331e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785722960, "uuid": "b3c5e783-c77c-4def-8e18-35b2136aef13", "comment": "Malware payload", "value": "cb29d2fd5f6bdeffaa330573085ac178cba392e1037fb522a9734d82bf249eed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785722960, "uuid": "cff918f4-5695-418c-906b-0bbae3295643", "comment": "Malware payload", "value": "a6522e629db025487b8a60f8e5262f0b94f9eac6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785722960, "uuid": "2fb5d550-d608-4349-949d-369d6b27b68b", "comment": "Malware payload", "value": "69447ef830e137b41f536d30f19fc55e540d981702a4464e950215c02732ac421201de36aec9a291e042be4f38cbafa5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785722960, "uuid": "f260710c-877a-481b-b2b9-b3e8dde76bb3", "value": "T1ADE4B00ABF481FAFC05ECF70856EC727466C459686F32B24F62C8644BA592CA1F67D4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785722960, "uuid": "d17b83d5-5143-4950-b0b1-b3586397c00b", "value": "12288:h8PVZ7cUk3pw7lhAvzGz/6e8zoR5mYLjvfeI2eLj:4MpK6izOMmYLpLj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785722960, "uuid": "78f1bf80-194d-48f9-a671-825a51ee5830", "value": 669614, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785722960, "uuid": "81cdbf34-7d14-4ec4-b941-62bf3ba1275e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785722960, "uuid": "30378e07-3bd9-4e18-ba00-d22cb380fdba", "value": "bot.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbef2389-8f73-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785786319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785786319, "uuid": "dbfc1d72-791a-451a-8acc-db5a0e21bce3", "comment": "Malware payload", "value": "f5eda5d87275bdb1c4eb39521a592830", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785786319, "uuid": "d4345eb9-af4e-44c1-9e4a-b6ca6b1cf4c4", "comment": "Malware payload", "value": "cb570c03a5fb5a9e2229c5aae19c5590aa1e6f53a9f5336206f32c2913e2011b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785786319, "uuid": "d4097f1f-264a-4984-9aa1-993a2bc7214d", "comment": "Malware payload", "value": "8df9d6536024e5e29950d095eea1180eb2a4ca92", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785786319, "uuid": "5f56446c-6724-499d-a6d3-0c1fbcb6d3a7", "comment": "Malware payload", "value": "48ffaafa3986cb17553eec5976cddcb6c201955fa1e34d484bc5dfb7bd0400943d91d51884b6c448073ec0efda19b80a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785786319, "uuid": "ba175e96-f4d5-4c37-9966-edcc1050c736", "value": "T13BC27C966A867C44BEC94B3E4CBD2B1D6DF5C3D1324942AC3D8A3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785786319, "uuid": "9d00d1ad-fedf-44e4-9414-0762e18f2e98", "value": "768:l8vCB+25j6es8Rb9FYpMSUpi+20qUpi+20YQX:l8l25Jtd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785786319, "uuid": "e72e55b6-139c-4af8-8688-70b1808dc59c", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785786319, "uuid": "54c5bc70-ca43-4abb-8950-e871d6b13840", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785786319, "uuid": "82d42d91-79fe-41ab-982b-59ba471d373b", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10ffcd22-8f35-11f1-bd95-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1785759350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785759350, "uuid": "513cea3b-6e4f-48b0-a87f-acae2505c6ec", "comment": "Malware payload (Prometei)", "value": "cd991f47109356f3cd6c40b3df3bb9f6", "object_relation": "md5", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785759350, "uuid": "6608f075-4da2-4efb-bd78-aafc0aa80aeb", "comment": "Malware payload (Prometei)", "value": "cfecc2a5ff8ae8313773706c7c556a6a94b1b78a8070fa01a8f197b5dffee336", "object_relation": "sha256", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785759350, "uuid": "9741dfae-7d38-478c-8a08-f787d130045d", "comment": "Malware payload (Prometei)", "value": "4d371032dc93d69c3da79ba98b3ff6fedd500afa", "object_relation": "sha1", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785759350, "uuid": "6d611d85-f2d3-4974-938c-c70b7d459bc7", "comment": "Malware payload (Prometei)", "value": "42d948c38248b93cc4b3a1472c9d5d314613ef672fe50aee87e2a3a02b6fc01f85134b122415f091e6410b408a4be95c", "object_relation": "sha3-384", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785759350, "uuid": "a079067d-b86a-4d6c-8822-dd390d6b03ab", "value": "T16C314EDB08611A391287DDDEB762755CB10C96FB2C4BC794DD480EAE868C1CCB2A1BD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785759350, "uuid": "b6daccf6-1bc6-4f79-a109-a2cc83a9ffb4", "value": "24:PZDuVdQtix8hjwK48LsVpyLvF4NGziUeueaq:PAV3K48LsVpI2GziUeueaq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785759350, "uuid": "d9b11c5e-903e-492d-8308-79247a056796", "value": 1584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785759350, "uuid": "47bc69d7-efc1-4daf-b936-de12af87f458", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785759350, "uuid": "de32660f-a189-4164-a6cf-b29c5028a62e", "value": "cfecc2a5ff8ae8313773706c7c556a6a94b1b78a8070fa01a8f197b5dffee336", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cba06005-8efb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Phorpiex)", "timestamp": 1785734752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785734752, "uuid": "0fff98f2-0bc7-47b5-8a22-98125f7adb22", "comment": "Malware payload (Phorpiex)", "value": "84b75eac9226564c9b224839148d0d2a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785734752, "uuid": "181341e4-2f1f-406a-97fc-ae412f9a3e41", "comment": "Malware payload (Phorpiex)", "value": "d00a0806b145423c459a4df53471965dc36f82ec5d5a5d4d108e0a7a1ce09d7b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785734752, "uuid": "4e86d095-8549-423b-976d-542ea0a14ce2", "comment": "Malware payload (Phorpiex)", "value": "b3c7c824c18ac37d2d059f0cb253b60277ac23f7", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785734752, "uuid": "18053e80-23e9-4d76-b97c-9d8a449e07a9", "comment": "Malware payload (Phorpiex)", "value": "f00b17dfae78a2f013f78267397db1b47a33cc7f4a19471ad463c66def37a659e307513ddffa7822d2a6f7ec0829b8c1", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785734752, "uuid": "c4fd4bc6-3cbd-4200-8b5b-d39394d701c0", "value": "T130824B0FB9414326D0E110B0A276567BDA79A8B637C414DBF7E48AED0A6C6D1FC3215F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785734752, "uuid": "d7a01d7d-d8d3-42be-a49f-6de72f13ab49", "value": "edd9caae8565fbe43a73e0ad530f325e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785734752, "uuid": "be02e2b3-1d09-4f0d-a4a8-11734ca09a7e", "value": "384:8d6I8vVaF6OeYUQQlmLu94gXQc4lmxav8U9cJl:8dPvUQQt9a8a0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785734752, "uuid": "993da5b2-b54f-4129-bac1-62f4b631d603", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785734752, "uuid": "3f6f73c7-c003-4994-9c57-60d86aa3c5d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785734752, "uuid": "a97ba791-19a0-4f51-8460-903af5fff657", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47f6b979-8f87-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1785794661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785794661, "uuid": "eef181d4-36dc-4a1c-a973-10e82b139801", "comment": "Malware payload (RemusStealer)", "value": "eecef7c3dc1460be60aea7e6f34326ea", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785794661, "uuid": "ac683db9-f158-432f-b0b6-fcdd5bd7f80f", "comment": "Malware payload (RemusStealer)", "value": "d00bdb02626137fd008456600d4fd89500f1de1c87a3ea3295b4e78740613b76", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785794661, "uuid": "a48400fd-2b57-4ade-a2a3-5b8e687db897", "comment": "Malware payload (RemusStealer)", "value": "e785e6edc3065ca75daa2404115d4a9f1e5eea51", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785794661, "uuid": "ad258c5c-dce0-4045-baa1-7e234aa0b803", "comment": "Malware payload (RemusStealer)", "value": "4b0c1af416742882ab39b3fb4bf9c956c9cc84483b733303804252fc52be95fe33a8e8c2129ec2f3e3dd58a8c75dc32b", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785794661, "uuid": "ac622b33-6e87-425c-b49d-c982c20e3a5a", "value": "T1B6D523C6A6D799D4C03ECBB0664771AFB27E33C548A49DAF34CC39507EE3A112436256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785794661, "uuid": "3ea57ceb-893b-44a0-a7fa-8c52bdeec766", "value": "6a368102586dffa13aabff685459b467", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785794661, "uuid": "1dd4aa82-14ce-4d5a-bcc3-daa08b33b072", "value": "49152:0NRFecAN8UHqg0OpyVhW9p8iwKUr463tPilHk1hrsqMAPjHvDTrgjJLVbVK0rAC:qs8UKPOpyVh68iAjtilHkXAqMYQ1VbD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785794661, "uuid": "468a91fc-5cdb-4b59-a1d5-c73f8cabf593", "value": 2990592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785794661, "uuid": "09a01a99-f573-4517-9b26-d4b137766c9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785794661, "uuid": "5255e57d-2893-4f1d-aea4-61eff5bd012a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2151fc8-8f34-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1785759191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785759191, "uuid": "328de3e7-14e1-40ff-be13-f6a2555998cb", "comment": "Malware payload (Formbook)", "value": "83c2ed0cfdbabaf6e55d3637bb276fe0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785759191, "uuid": "798f3e57-84dc-40c3-a939-f88b8cc6a36a", "comment": "Malware payload (Formbook)", "value": "d0a8c7f680f9573add4c7d681fbfee2bfd8a4c3cf606e98e2b136a63ef85348d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785759191, "uuid": "2980d090-a1b3-43f6-ad06-614de86e3e72", "comment": "Malware payload (Formbook)", "value": "5e29c642364d43b91f8f97b4c97fc5bf64a51c73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785759191, "uuid": "72e5e7b7-27ce-4f21-b2dc-d1e349aff88d", "comment": "Malware payload (Formbook)", "value": "8048c4b23eeae7eb4ca730cec7d1ca1bc2cf187de7a84a6fec69c95deb0b0bd9dea9dfc1301ef5a0bcf7a37d669bc47d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785759191, "uuid": "77680e2a-bde8-4c5d-af9a-f9c9427c6270", "value": "T1C113B3FB6A1EC470ADA00CCB58D77FCB51CC8879453436B39228686AEDF4B1521B75B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785759191, "uuid": "10959671-a139-4de0-8123-fbcc9a6f3bff", "value": "768:TSVz1back6VAZSvVvaSDodQ6uIgHJ2I1v:85Jf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785759191, "uuid": "169dd8a9-5ed4-46cf-900e-cb67186cb395", "value": 45357, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785759191, "uuid": "54739fcb-8556-4929-85fe-76f0520c2059", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785759191, "uuid": "f0c20089-dae3-4bce-8fc0-e0f0947f3a62", "value": "FREP0000003583.pdf 67 KB.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16f73e27-8f08-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1785740033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785740033, "uuid": "d2439a48-cd19-43e7-9448-97171f0f9455", "comment": "Malware payload (ConnectWise)", "value": "296866fe679b096a47babe023a356432", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785740033, "uuid": "58c2e890-83e7-440b-9af9-d0b01ec2e396", "comment": "Malware payload (ConnectWise)", "value": "d0e5fb55a267ce51a048b5bd1f893594b9923107dce833db45596c76cc90d271", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785740033, "uuid": "23ecdc1f-d91e-4325-b73f-12da2c1d5e34", "comment": "Malware payload (ConnectWise)", "value": "a1bdc591f46f947bed7b84b808913f87e39d50a2", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785740033, "uuid": "edc7995f-3bc4-49e7-81f9-1812b6d296af", "comment": "Malware payload (ConnectWise)", "value": "f55ffc7f351354e657df82e4e4ce293301774ebedd352504c8cd62e09ccd44f611127c708c60ed4d30337b15edf34fc2", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785740033, "uuid": "4069dbdb-8f1f-4f93-82ac-04c366f79b23", "value": "T14B836C43B5D18876E9720E3118B1D9B4593F7E110E648EAF7398822E0F351D19E3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785740033, "uuid": "6fae78f1-0dfe-4eb6-a10d-c1593630f0e5", "value": "37d5c89163970dd3cc69230538a1b72b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785740033, "uuid": "31a38c36-0a4f-4b18-9231-951920ddfbbe", "value": "1536:SxoG6KpY6Qi3yj2wyq4HwiMO10HVLCJRpsWr6cdaWPBJYYD7DJI:wenkyfPAwiMq0RqRfbaWZJYYDJI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785740033, "uuid": "f323628d-0ecc-4a39-9d07-406855061a84", "value": 83176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785740033, "uuid": "c85b4c19-a03b-4300-acef-c17454b11e5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785740033, "uuid": "b5a687eb-5dd2-47ae-8a6b-d2714285e39a", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65992b6b-8f43-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785765505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785765505, "uuid": "da9b7c48-57da-4e94-a090-34c2445d2a4b", "comment": "Malware payload (Mirai)", "value": "6e82991cb48a190fb03b65d03c29a5cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785765505, "uuid": "4a985d4e-4e14-4cdb-a360-b2fd28cff38f", "comment": "Malware payload (Mirai)", "value": "d1bce1cbda1440cf35a06d469e808b4814016911e6e0b811f0b9f24298bf111e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785765505, "uuid": "1f8ebd73-5c42-4a88-8f3a-c4e19c5e707e", "comment": "Malware payload (Mirai)", "value": "e5764d7257d3a8d7335390c964e4bd3b842201c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785765505, "uuid": "3b4681e2-734a-45d6-a067-9aea25697170", "comment": "Malware payload (Mirai)", "value": "cc65396feae23890137706a9a948d88adf19f003418fb9717ea33418bfe75c661eb6dac6c89763397af4990c8434da03", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785765505, "uuid": "666972f7-d7e9-4d48-a0e3-61916dbc92a9", "value": "T1003302A5D00CBBD05ECC8CFA89458281ECF564ABF74C15EA5089DF293847EF48266B6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785765505, "uuid": "fc8cb4df-58be-4b16-87ba-7516f4b39205", "value": "1536:MWFQaCPQLXabYbJ+tEDisjvw3k5drIzT9z:MWeaCoLagjvB5drIzZz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785765505, "uuid": "8eb8651d-25c9-44d5-bc98-f25a593743b4", "value": 54616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785765505, "uuid": "5b5011e6-7767-4a3e-b75a-a274299f6946", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785765505, "uuid": "8d6f8e80-de7c-4066-880a-e65118a2b802", "value": "miron.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eda07ba8-8f77-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785788067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785788067, "uuid": "42850383-8f44-4574-8415-35bc832ce3cc", "comment": "Malware payload (Mirai)", "value": "09d0b17798b2d08c81d2988fd02a6893", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785788067, "uuid": "c29e04e5-41ed-4806-946e-8e11f459f7e1", "comment": "Malware payload (Mirai)", "value": "d2c0951a99006538e43c67dd99480c3f837dc1f6544737d77bb958a79535df9c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785788067, "uuid": "89464351-92bf-4169-8132-e7501a5a78c3", "comment": "Malware payload (Mirai)", "value": "3db9d25b985254b5798ffe1cf91ef073adf31de0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785788067, "uuid": "a923352d-4ea3-4f85-b796-111c1ba86f93", "comment": "Malware payload (Mirai)", "value": "3e169b05a609db0afd773c5c72b6dec169eb074ca365bb9b0616f4384472d6de1a62990462832e12de5cbcdc266dd844", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785788067, "uuid": "83665508-96e1-4fad-94d9-07beed01c7d6", "value": "T16F858D5AF6E364BCC097C430835FD753A935F4A911227E7B26849E302E66E705B2DF22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785788067, "uuid": "8a04f5c0-d1c4-42d3-a005-b31d06c814eb", "value": "24576:MC7mcWufxGPdVHf+6YVUyJLl3UiDWSJXSFi9xYv4yCi8uEUyo:Mpc9fxGFVFYmGLl3UyWsXSFi9xYel", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785788067, "uuid": "a142f295-b233-436a-badc-2b202e986224", "value": 1727016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785788067, "uuid": "c3674d40-c1d8-4217-af3f-ab03e7239756", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785788067, "uuid": "2ebafb0d-c7d7-45ca-93ce-8880d919f4ef", "value": "eclipse.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a46b458-8ee0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785722966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785722966, "uuid": "faa2476d-313a-4349-9bb7-621d9c5b57f1", "comment": "Malware payload", "value": "ca460eb36ee2fa23f4ea1ae2178d1a4b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785722966, "uuid": "6cbf8921-26a0-4838-b355-a03257227f3e", "comment": "Malware payload", "value": "d51b92caded0f974b04482d2db03cc38bb3137ef6955436681bfd9874d9701ee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785722966, "uuid": "7c34ec44-d93f-45c7-a5c7-465febccca33", "comment": "Malware payload", "value": "2cfb0fbac21312adad943df382719c8a61639cdc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785722966, "uuid": "e1bccaf9-78f8-4ef4-bb78-75645c4905a9", "comment": "Malware payload", "value": "ba9b89e3d1753a9b3818759448a590545ecdaa379ba35b5c0068c630e611ae8ddb53615f49f7028737c99d9098ea5d10", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785722966, "uuid": "70368595-12d4-49a9-8f51-2559b45197f6", "value": "T16DA47C66FC519A52C4D0267AFA6E8188330353BCC3DE7106EE15CB3576EF89E0E39A51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785722966, "uuid": "94a757d1-e199-495a-8db2-9913522bf1e0", "value": "12288:4N8ULRxQbKJlsxHTLTWhf7UWaPnzfObWXz+:vOQ0SzLTWhAFL+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785722966, "uuid": "8953225e-2049-49c1-9ae9-75c6d6804287", "value": 487997, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785722966, "uuid": "55b52a52-1284-4a2f-86a4-b8136ecfaa48", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785722966, "uuid": "dde570e7-cae3-4869-a503-a0444b24d5e1", "value": "bot.armv6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3ba904f-8f83-11f1-bd95-42010a9c0009", "comment": "Malware payload (NanoCore)", "timestamp": 1785793204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785793204, "uuid": "c57ef825-d18d-46e0-b389-3ccbe136c290", "comment": "Malware payload (NanoCore)", "value": "49a3a8e26557c6cfda62e9c309a9ab67", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785793204, "uuid": "e0474cee-23a5-42d5-a6ae-2bf80d27fdb6", "comment": "Malware payload (NanoCore)", "value": "d5e129f0fdc0806a85b518ee49cee0560e921ee2f80d3d66f3006d3fff949603", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785793204, "uuid": "42d98804-166c-44eb-b9ad-459c9e28bbb5", "comment": "Malware payload (NanoCore)", "value": "98ae00cd8934de8a0f486119c6805ad8e4f62f94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785793204, "uuid": "fd2acb72-08ff-4f4c-b3c0-da751b95db7d", "comment": "Malware payload (NanoCore)", "value": "4b665216e6cec7f644a968780b15672ef3dc17555f905b6a6433d4bf7e83b80bbe4f6132dc09751823d2ef413eae5fae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785793204, "uuid": "f933883b-c30f-4c24-b56a-85aea3f1d030", "value": "T15D14CF6A37A88A3FD2CE8679611202539379C2E799C3F3DE28D455B74B227E10B171D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785793204, "uuid": "6edfd7e2-29f0-41c0-97ec-bc1f83031db6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785793204, "uuid": "47d18d78-6048-4fe3-983c-87b39f1c5454", "value": "6144:MLV6Bta6dtJmakIM5fNLiVdjyTMyIdWuj:MLV6BtpmkWkjyIfMuj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785793204, "uuid": "cfc5bada-8dc1-4c8c-937b-db94a5eb8ce4", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785793204, "uuid": "7bd3ed2c-7c94-4afd-86cf-ed2176b36a83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785793204, "uuid": "82577842-b54b-4ca2-a8ca-69f1fae68b72", "value": "49A3A8E26557C6CFDA62E9C309A9AB67.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0585337e-8eeb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Joker)", "timestamp": 1785727548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785727548, "uuid": "d8fddf2f-b636-4c28-9605-54ab740222be", "comment": "Malware payload (Joker)", "value": "d83b5b9d0200cd0e7b3f5581a1090244", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785727548, "uuid": "777a68c7-1826-46a4-a82b-8fc2cd8a006f", "comment": "Malware payload (Joker)", "value": "d6eb48ecc1a0831a805c5920b2cf9655e60097eb6c7eb822bf87003d71afce95", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785727548, "uuid": "f69ac55e-a044-4992-8f93-73f7d5d47782", "comment": "Malware payload (Joker)", "value": "4e743dfb3043d31f5687dc6f4c3562eb5ed86ea2", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785727548, "uuid": "10f93fe7-518f-420d-8c23-6bfdb4ce29b6", "comment": "Malware payload (Joker)", "value": "8e28f1fe572f2e0e9bf350d3c92e386308dcae201ac32205b4738e41a48c61539aa0f54b9b47db384beb473d31dab4ca", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785727548, "uuid": "5cd7d543-be60-4ddc-8e8a-b5f5819b0a5c", "value": "T11857120AEB0DEE2BCCF7B2784D39126260166C649B83D7D76901B23D7AB3AD44E157D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785727548, "uuid": "fcd4ca44-7c62-4c13-ae12-b4fee8a37426", "value": "786432:e5svKxqqVpVvR5SXRrDOVM+YHn6LSagjIVDbm:e5sSqqVpVyX1OVGHn688G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785727548, "uuid": "9faaff32-8ed6-4ab4-a497-12e75e6ff680", "value": 28816465, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785727548, "uuid": "c2e8f2a2-9542-4af6-8860-315859fce3b0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785727548, "uuid": "deffe6b0-c690-4638-ba7b-a1008463e4a8", "value": "File+Cache+Cleaner_2.1.3.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d2b17e4-8f73-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1785785973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785785973, "uuid": "580b83b8-fd09-4939-96d8-7d558e26d1f0", "comment": "Malware payload (AsyncRAT)", "value": "a404ce3d80ec38216cccdcd9d6419cfe", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785785973, "uuid": "830d9ff2-7cc3-475f-a182-098bcc2d6c43", "comment": "Malware payload (AsyncRAT)", "value": "d87b4127854cdd5d11ab4b57f3589014339e43dd5f47f009e8b0fa00950d4c2d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785785973, "uuid": "b6be0f7c-2ce1-4d98-9a75-19bd61411096", "comment": "Malware payload (AsyncRAT)", "value": "1d4e25e55149bb776936b1668cf403a520111cfb", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785785973, "uuid": "a132f109-1064-41f6-9851-4aad38c13c6d", "comment": "Malware payload (AsyncRAT)", "value": "f8eb8e9019784904463a92ed88189b92d16894ae028b3f2b44487b640c319afae6537932bd86e26e8d721e65341daefa", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785785973, "uuid": "f600e647-bff5-45ac-a85e-9523365cb386", "value": "T187C23B0833E4C572E2FD4AB98C33D6008B75E55B9A13D75B6FC490AD292378D8A14FD4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785785973, "uuid": "a396bc04-2204-44c4-bfae-d5b9f1af3408", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785785973, "uuid": "f04cfee2-6979-44ed-a674-51e61880879a", "value": "384:tePtsFjV3WuHHtZARPn9jnH9qbuUshybQxnCJfJBndnjJHkKlv:tctIdt+LIbIBiBn9F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785785973, "uuid": "3b568759-5875-4014-ac9d-acc358904e97", "value": 27136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785785973, "uuid": "a9f95797-c971-4028-bf25-e8b47c9fb30a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785785973, "uuid": "b8aa27ff-658c-4b19-92ae-e63ce9def301", "value": "VIN88APP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ba2d8da-8ee4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1785724794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785724794, "uuid": "ee7e43bd-8b8f-455b-85d2-ca194ba7f93d", "comment": "Malware payload (Prometei)", "value": "cf78bb7d5ee99c0251b82a9019535d58", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785724794, "uuid": "950427c6-fb3c-458f-a62c-d57e2f557a0f", "comment": "Malware payload (Prometei)", "value": "d95e8aef883002d34e9687c04b9dd1370e9c8c6b08ba2e1a7e1ecb9e07a3576b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785724794, "uuid": "fe683169-9d7a-4157-a9b0-c07a0efc52ca", "comment": "Malware payload (Prometei)", "value": "0632be1827f851ef385eea9da3aaf7d5ead47ff6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785724794, "uuid": "8d191557-a842-4360-95b4-4ea3b3e38855", "comment": "Malware payload (Prometei)", "value": "2793a7b305f29880094dc84bafaa7361aba8636302bf690cc58441286f0c7f4808c96532cbcc9f329cd1238563a4a120", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785724794, "uuid": "d41f9f66-595e-44a2-b6e8-6b64a40e4656", "value": "T1D3765B73905624D8E1ADC974D5151213BEA8384B673863DBBBC076F11BBABE49E78330", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785724794, "uuid": "aca9e0cd-ace8-4949-82d3-dc732b581d82", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQC:cqYUQuVDt0TZEF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785724794, "uuid": "1a8a8049-9c43-4fbf-84ed-3dcffc518113", "value": 7176192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785724794, "uuid": "fdeb88dd-7fa9-4224-8065-84319b231bc0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785724794, "uuid": "57388229-18d1-451a-9651-fff07a91c1ca", "value": "d95e8aef883002d34e9687c04b9dd1370e9c8c6b08ba2e1a7e1ecb9e07a3576b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d46f931-8f5c-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1785776309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785776309, "uuid": "e0665f05-87cf-4767-9571-314c9a461c83", "comment": "Malware payload (RemusStealer)", "value": "7d197e1c8130e31008434cf211b33a33", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785776309, "uuid": "a83fd004-292f-4204-907f-368dd3578455", "comment": "Malware payload (RemusStealer)", "value": "d9b67969142627b6e0b2342e98fe900acd7440e79c5ada813e2500900f9678c1", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785776309, "uuid": "949e4c3b-5a06-496d-a441-371af4cca7d7", "comment": "Malware payload (RemusStealer)", "value": "5bb465427135c7984fa789fad52b68b5fe9c562d", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785776309, "uuid": "914abf60-5ae4-4e2e-b398-4bf74258ede3", "comment": "Malware payload (RemusStealer)", "value": "17bb082fad43e35489a9e937b8abe58cc29d951d1623026ccece9ab8eeb4311a6bccfbcc6c2fb372117d3dd43c7fae10", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785776309, "uuid": "9936bad0-2147-404c-99df-d479c6f6ee96", "value": "T19816E0607BE561D5F437FE56CBEAB695D76FB3722A079A4B1204034B0226902CF83D39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785776309, "uuid": "c3ac3ab8-0e5c-4d50-b1b0-1b8f4a750c5c", "value": "49152:yGDyrb6MkI3cbxsZG4UJG3N5Zg4Tcfc2zqbQwhQ2Ih:yG1IM1JG3N5Zg4TcftzYQ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785776309, "uuid": "4e4495d1-82d6-41f5-b373-bfa5da00ce40", "value": 4072448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785776309, "uuid": "25bcfe89-53dd-45aa-81aa-09c57b70825a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785776309, "uuid": "22d10783-1b41-48ab-a023-8e7320aefd35", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f56e815-8f63-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785779265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785779265, "uuid": "bd2107b8-b6ff-4fbc-9381-7aca762e7951", "comment": "Malware payload (Mirai)", "value": "c46f1670451e297586e2eb5eafcaf26e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785779265, "uuid": "e4cb6b85-67d2-4b00-ae89-635261df57b4", "comment": "Malware payload (Mirai)", "value": "d9e6372114a1a7531477da6728e91b04576724c51edf7760f086d0e1f3d4be0c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785779265, "uuid": "622e257c-ea70-468c-998f-e7d105e79932", "comment": "Malware payload (Mirai)", "value": "d7f118817a8754f33c2ed7bc242661e81c08351a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785779265, "uuid": "a185744c-8d2d-4338-96c5-586a471027b6", "comment": "Malware payload (Mirai)", "value": "92a1f2f4fb56ff2bd4b3a8372edac55bc018782fdbfeed8f0cf37c8c3074996d7a2862aa1211562215bc4c79e68d30a5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785779265, "uuid": "60ef86ca-036d-4a97-98db-04ab0e932bb2", "value": "T1C5635AC5F643D4F5E96705304137EB7BAA32F2B91239EB87E76482327C92642D90678C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785779265, "uuid": "5a5c035a-6da9-4176-b5e2-9e7422c45449", "value": "1536:RaZsGDExpTGAtV+/C8eQBW2OnD+kLQz3WyL35IUfA5PGFjfnPn:zGYxpTGASC4X3+QyyLpIoYPsPn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785779265, "uuid": "1425c170-358c-4c42-a4ca-4f24d72b6280", "value": 71520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785779265, "uuid": "792d16d0-c537-4605-8f9b-318b8d77470d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785779265, "uuid": "8bff6722-dee2-45bf-a922-fe51267ff86d", "value": "lkxstress.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c4c862e-8f0b-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1785741411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785741411, "uuid": "87097523-3eca-459b-a626-413b9be43520", "comment": "Malware payload (ConnectWise)", "value": "88d6492556aab7305575e411e12ebdb7", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785741411, "uuid": "cbb5100a-ee61-4d10-b174-18a58387fcf1", "comment": "Malware payload (ConnectWise)", "value": "da3ad4675e4bb27501158a2e65b936466b225699a1d342567afa5a418810bf9e", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785741411, "uuid": "954c240c-e24f-4727-8cf5-03b45a7aa018", "comment": "Malware payload (ConnectWise)", "value": "ee4cd1e20e99901a409fd58099a52c4f91fb41ba", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785741411, "uuid": "92fd39eb-5e7a-4669-9558-4e1e3972a2ed", "comment": "Malware payload (ConnectWise)", "value": "3d6c538d864e31b4370b482e9bd27a3d564c51ab09a04b86768d65c18ed5c9e4e742088d9a59e923b9f807913817d95b", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785741411, "uuid": "7bde38e9-0894-453c-80d5-f70e0cd2e6bc", "value": "T1A9647C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785741411, "uuid": "a1b16c35-6fc9-481a-a2eb-6dc7fe896c9d", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785741411, "uuid": "1dbcbe6c-47a1-4228-a9c9-371de21f5274", "value": "6144:imlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:h1iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785741411, "uuid": "6b75082b-dc7d-4566-aa2e-fd30db0cc003", "value": 312560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785741411, "uuid": "e692d16b-12e4-43a8-8a70-21f1c6b07da9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785741411, "uuid": "cf1f7a97-511d-4d4c-809b-510c51c29283", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e8b82b7-8f39-11f1-bd95-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1785761306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785761306, "uuid": "c065b413-116a-4850-aac1-7bf721da8857", "comment": "Malware payload (ValleyRAT)", "value": "74eb2b6a1dc9c600de6eb0e63fd243be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785761306, "uuid": "25929631-ac27-42df-8609-20820e9a2205", "comment": "Malware payload (ValleyRAT)", "value": "e18134f304e4b3964ebfae04b8c465fd4f8628ba66f19486d64980e936d6dca3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785761306, "uuid": "472bb3e5-fe8a-4b38-8160-bec860b10b3d", "comment": "Malware payload (ValleyRAT)", "value": "0006801afe3e77b57bd6a61974c6d9aacf3ad273", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785761306, "uuid": "c6d16941-3235-4a88-ad9b-a22c13d1fed8", "comment": "Malware payload (ValleyRAT)", "value": "7b7556d65d3e3c6db20513659d7bf2fb6437bade1cf9e6f95410e77d877031b517d5604ea2da49ec7d6950015b4f37e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785761306, "uuid": "3168df3c-b8d9-4a0b-b993-53e4dd4a8187", "value": "T177B6334037C90C84F86B263DB8C1991B93E2B4610B6686EF57F55D291E337D8EE38B61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785761306, "uuid": "cc77556c-7177-478e-a730-d56d3adc1811", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785761306, "uuid": "d67e5c07-1b7d-4a49-a568-7c329ec38b2c", "value": "196608:lJ4AEwWCUL5IlnHIAoa7LpQBA84LQJM97CddHsGXqrBpXFBHE7zMxMxuj:cFXP56tjx32M0ddHsGXqF7BZxMgj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785761306, "uuid": "5908c7a2-acf7-4a1b-bda7-3d317568a1e2", "value": 11244953, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785761306, "uuid": "5c5a68fd-35b9-497e-afac-ffe2def15b7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785761306, "uuid": "0248b675-fdc4-4123-a4ff-7a4980cf86c9", "value": "EvasionGUI_bundle.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "246b82a7-8f44-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785765825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785765825, "uuid": "d6215ebf-90d9-4be9-86f1-5c08ff4cc06e", "comment": "Malware payload (Mirai)", "value": "7330983255b54e871e3d33f1b8008dc3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785765825, "uuid": "aaacaf18-5751-40e9-9bfa-6fa17ab78512", "comment": "Malware payload (Mirai)", "value": "e434a3abb158788ce59dbbddbdf463c9e33b8f2a7be1fc93374af7870b2cc309", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785765825, "uuid": "db09bfa0-0a47-4c51-ab9c-c346ccbde28a", "comment": "Malware payload (Mirai)", "value": "7f2f8efcb871a7a79e996c0d32d467db57d70f9b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785765825, "uuid": "919439e2-1f3a-4f98-97f1-327647057806", "comment": "Malware payload (Mirai)", "value": "e36bdb75385622e126ea73bbbe2ab8d57305d33064a2b3724f9d66192dc1b7d4a06415fe8fc6756b87fb1c0fded6f5ae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785765825, "uuid": "62babbd5-85cf-401d-9087-9d5e5bf75135", "value": "T18273851AA661CA39C482E2745FEFC290A621B4F46F36210F379527772F35B584F29F12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785765825, "uuid": "3d79949e-590f-4ac6-845c-9cf39ecb9573", "value": "1536:vz0N8ZZwG96ZP/1p0SEKXOXaGW+SV0WfBuXjVO/AchwpdoBjF:vz0qZf9QqqF/VlfBuXjVOYd6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785765825, "uuid": "314ce92d-4609-4d7b-ad7c-26764a5d4420", "value": 75176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785765825, "uuid": "a4430c2a-5d5f-4dc6-9291-8b94f29e4b3c", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785765825, "uuid": "777e4be2-37e6-4a1f-801c-918a453bc20e", "value": "bot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd65997d-8f40-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1785764471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785764471, "uuid": "6a04a5ae-2348-4c0f-a2ce-b7a56bccdc07", "comment": "Malware payload (CoinMiner)", "value": "cb2024d0421d54c618b1d9d16ab27151", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "Kinsing", "colour": "#D800AB", "exportable": true, "hide_tag": false }, { "name": "masscan", "colour": "#55E938", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "shell", "colour": "#705F77", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785764471, "uuid": "59bec267-0c87-4939-b5be-25c05f504215", "comment": "Malware payload (CoinMiner)", "value": "e718fb56f1ab92f116acde54d4837e18d7f98b6534fa17fb5fb3f95ddc07b6bb", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "Kinsing", "colour": "#D800AB", "exportable": true, "hide_tag": false }, { "name": "masscan", "colour": "#55E938", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "shell", "colour": "#705F77", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785764471, "uuid": "94374143-f732-4e27-ac17-b3883bfd0ee0", "comment": "Malware payload (CoinMiner)", "value": "8061deacf9eafd0a8124d376984569661de51813", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "Kinsing", "colour": "#D800AB", "exportable": true, "hide_tag": false }, { "name": "masscan", "colour": "#55E938", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "shell", "colour": "#705F77", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785764471, "uuid": "4343663e-4c5f-4cfd-ad5d-58cc077144ba", "comment": "Malware payload (CoinMiner)", "value": "1de5b2da3d8944ac80aa236774b20491702db667ba9b535aef4ff54fc71ef6c1c751fddae5d76267838468fd731f955d", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "Kinsing", "colour": "#D800AB", "exportable": true, "hide_tag": false }, { "name": "masscan", "colour": "#55E938", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "shell", "colour": "#705F77", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785764471, "uuid": "cdb50c15-56f8-4935-abb3-e287797dd714", "value": "T12381228D9066EC793CA5C86AD8813248644FF18781F33F98B9127E3C2FA4145F7695AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785764471, "uuid": "ceb61702-b8f1-45d5-82f0-e5a2c63fac0b", "value": "96:eSaLaZaZagaLfoi8THN6Zx8YjiRa9aAaTMajka6MfPcyZPsqtstCQrA:eS8OSPefo1hc8MiYMrTPr67qtstCQrA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785764471, "uuid": "c05f24f9-cecf-4bf9-b0d9-a368230b42c9", "value": 4117, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785764471, "uuid": "6d352f95-46f8-4bae-bde9-bd0ab860af4e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785764471, "uuid": "e454f82e-1488-43e4-a5ba-090dbbbe09b4", "value": "e718fb56f1ab92f116acde54d4837e18d7f98b6534fa17fb5fb3f95ddc07b6bb_from_65.49.27.190_pgcopy.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28e39544-8f23-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785751659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785751659, "uuid": "99ad216a-aeac-44e8-8ec5-38fdb56ab3c8", "comment": "Malware payload", "value": "76b7981f13d86374414e4c887b77539d", "object_relation": "md5", "Tag": [ { "name": "aur", "colour": "#196F23", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "reversec2", "colour": "#0030B0", "exportable": true, "hide_tag": false }, { "name": "SupplyChain", "colour": "#CFDFCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785751659, "uuid": "09aecf41-8145-4da9-b30d-f7ffcf9abb9e", "comment": "Malware payload", "value": "e73a35b3e75e94746428d1a207703d6335933deadee7d1d9c9d0328df7b9df77", "object_relation": "sha256", "Tag": [ { "name": "aur", "colour": "#196F23", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "reversec2", "colour": "#0030B0", "exportable": true, "hide_tag": false }, { "name": "SupplyChain", "colour": "#CFDFCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785751659, "uuid": "6fc2e18c-1b9b-4462-8854-bdb5b09cb6ab", "comment": "Malware payload", "value": "069380d8a59b806120d75c554827b9ec9f5e583a", "object_relation": "sha1", "Tag": [ { "name": "aur", "colour": "#196F23", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "reversec2", "colour": "#0030B0", "exportable": true, "hide_tag": false }, { "name": "SupplyChain", "colour": "#CFDFCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785751659, "uuid": "31cf0884-7c86-49d1-a8e4-5d3498dc32e4", "comment": "Malware payload", "value": "881c4295e42b3fe1be2f99a367c304190a4c2c4fb614b204410c939f6c2838af343ef4852aa1ee9ed50ca0252c574f1a", "object_relation": "sha3-384", "Tag": [ { "name": "aur", "colour": "#196F23", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "reversec2", "colour": "#0030B0", "exportable": true, "hide_tag": false }, { "name": "SupplyChain", "colour": "#CFDFCE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785751659, "uuid": "f75ffa3e-c03b-4b8e-a765-2875933e95f7", "value": "T1B2133B07F14185B8D094C3308EF7D52A9270785AEA33A75F3A1E2B247D82B64EB1D6D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785751659, "uuid": "d60dff8b-f287-4f4a-86dc-8d32294265ab", "value": "384:HPtyJuXPLkkfo0sSG3gOLpLYSe0gG5TTtLuOKPl9brOsNMnZYaszriwD0S+LUzVV:HoY60SbpL395aL99uGMZYasXZz+LUuO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785751659, "uuid": "b3e02f2c-06b5-4748-a844-43cd7829474f", "value": 43640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785751659, "uuid": "1f96debc-ec4f-4c55-8891-6832789fec65", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785751659, "uuid": "03bc95bb-4993-449a-8f86-37f1f87aba47", "value": "assembler", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ca14463-8f09-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1785740472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785740472, "uuid": "d8e5b480-62c9-4b4f-b526-dbd679ad169b", "comment": "Malware payload (ConnectWise)", "value": "2ffdfcb223d07f133a520c351f7a828c", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785740472, "uuid": "5801b244-baff-400f-bea3-767c874ffcb3", "comment": "Malware payload (ConnectWise)", "value": "e79152d9bbe8fda56f45103d046cb10ec0aaa92e04557a6863d1a9e162b08f08", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785740472, "uuid": "30df2b3a-e85c-4534-b085-e2980026da70", "comment": "Malware payload (ConnectWise)", "value": "2fe4dda854f018711e67207ce4ce20c8a1ac7244", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785740472, "uuid": "31e86020-872e-440e-b5e5-e1defa00d658", "comment": "Malware payload (ConnectWise)", "value": "9696344f680b0423aa55f4ae03e9d9049b52affcbe7f14fa10bb19e5a7fd64a5473ff9fabc66ea7e0b0a0956d034f02f", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785740472, "uuid": "b350faba-96b2-48b3-a801-28adf9241692", "value": "T1D546E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785740472, "uuid": "a8809de0-819b-4c66-8bbb-ba5c7e584dd6", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785740472, "uuid": "5f7d6d79-de1f-4d34-9504-3e0b31438d3d", "value": "98304:0zIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:0hfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785740472, "uuid": "2ca07954-3759-47ba-be6b-a15033eda555", "value": 5648288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785740472, "uuid": "93b6ed5a-7af8-457b-8d65-e46a41d1454d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785740472, "uuid": "0a8371f1-5df8-411d-916f-17ea65291398", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ae7c5e4-8f63-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785779258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785779258, "uuid": "3736fd6a-9d00-404d-b793-3f0aaaa3c06f", "comment": "Malware payload (Mirai)", "value": "b3d1db91e90e06ee73e607cb103fac6f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785779258, "uuid": "db7fc79f-9d5d-4581-abfa-338b0b95c38d", "comment": "Malware payload (Mirai)", "value": "e79d48cc2ce26ea6d3af7eb9ea11406225287c4901425b9e155e3886abe341d7", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785779258, "uuid": "93a2b485-a1d7-4e21-acb1-f306312d5ede", "comment": "Malware payload (Mirai)", "value": "3caac4fab699a05820d3caca9dbf148a7f4549a9", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785779258, "uuid": "e1daf7d6-c1d8-455a-ba5f-b41899fc085a", "comment": "Malware payload (Mirai)", "value": "81a6ee454945a97cf735f7f4f2a9f58e8e3b7c0a8cb5c523a9b576e979fba0f4120e3d8761d008415ce1ea132f6a51c2", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785779258, "uuid": "f7907ae6-7f4b-428a-bee3-4cab8ab98adc", "value": "T1FE41DDAACC7107364793CA02A2F45708518F44B636A61ABC84A19C7BF7DE3793E34A5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785779258, "uuid": "8bb18792-5d67-4697-becd-c427a18c34b5", "value": "24:swQzNI9y0KRNQ0vteOU01AWXCWvAHhIXhi4s:swfy0QbU01AWXCWvAHSXhi4s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785779258, "uuid": "d853651d-e841-4bfc-94e1-bf37f99d1d76", "value": 2143, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785779258, "uuid": "7c5105f9-69fc-4c58-8ad6-055a9d1b6384", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785779258, "uuid": "2e34ea42-6689-48e4-ac63-944675df9388", "value": "lkxstress.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0f0f6fa-8f03-11f1-bd95-42010a9c0009", "comment": "Malware payload (Phorpiex)", "timestamp": 1785738117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785738117, "uuid": "3f1eb570-bf65-40cc-aa7a-7eb7c379a7ad", "comment": "Malware payload (Phorpiex)", "value": "0c3da3ccdd9f22f48cfc085702e1d06a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785738117, "uuid": "fc767758-42ff-4216-bbe7-78fc598c56a1", "comment": "Malware payload (Phorpiex)", "value": "e940830a9e6aa1ca42e80230d076fbc2a7a2ff5c715cc9fb49a061c532562f6f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785738117, "uuid": "1312cdc2-4dd1-48c7-835b-29178509f4dc", "comment": "Malware payload (Phorpiex)", "value": "7bc757301764d448f113a5f5193819590dbc07f8", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785738117, "uuid": "2bd96c49-a20b-442b-90b9-49518dc63d97", "comment": "Malware payload (Phorpiex)", "value": "2d38348cd0e62f40660edcef4bc2e756309fe1b8e9c3d180c12ad094a6ac318ef4590b6a5cf3b5b226384430bfdaeb96", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785738117, "uuid": "9d3ad3ce-9c2f-4d0e-9dc9-90be7d1be698", "value": "T1A7825B0FB9424326D0D110B09676967BDA79A87633C414DBF7E48AEE0A686D1FC3216F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785738117, "uuid": "8b661347-3599-4b40-adf6-33e8c2244682", "value": "edd9caae8565fbe43a73e0ad530f325e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785738117, "uuid": "37b27a56-0aab-40d6-9678-84ffb0958d86", "value": "384:BW6I8/V6l6uio0HlmLu94gXgcolmxav8U9c7l:BWfT0Ht9a8a0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785738117, "uuid": "33315b9b-6cf3-443a-ad78-61ce2dd4d2b9", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785738117, "uuid": "6f7ebec4-6f08-43ac-990d-001907d82ee0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785738117, "uuid": "2b3665c1-79aa-4c4e-9b78-8827e7659c9a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e33cdcac-8f87-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785794922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785794922, "uuid": "f376c4e9-28bf-4a93-b300-4efee4183c3c", "comment": "Malware payload (Mirai)", "value": "a9e6da5555802d848054b0b2adcc5353", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785794922, "uuid": "2cc57467-a780-4e0c-9481-2d814ee1284f", "comment": "Malware payload (Mirai)", "value": "e9f469c3e8f40ce270d48dbd3dbf38f5033fcd6abb44ca7b03bb09692a771f6e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785794922, "uuid": "3478127b-dd36-48dc-a675-b58b484ecfab", "comment": "Malware payload (Mirai)", "value": "348aa52c7be748893dd5190835bf6576164e8d9f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785794922, "uuid": "25387b33-719e-4dd3-9c7d-487098691a20", "comment": "Malware payload (Mirai)", "value": "21274dbfbb313b36845e73b00da910bceb6f47d71cd74ac4ed4f7dffe850c3d71867fe7ccec2082c8add57e687a63340", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785794922, "uuid": "be9b4587-308b-4fda-9f38-94dabf9f8778", "value": "T1E0143B85F8509B26C6C612B7FB5F428D772A57A8D3EA3203D9241F60378B95F0E3B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785794922, "uuid": "c119e24e-93b4-4969-82da-7f018730b188", "value": "6144:XzMrLyaXMoM8RW/B4xfoSUtNRWvs62eFbP:Xz+JXnhiB41T8l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785794922, "uuid": "06053091-ae37-4651-a1d7-db68fc95b05e", "value": 201504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785794922, "uuid": "0937682f-12b3-4318-a075-92ac470bf49b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785794922, "uuid": "4f61a966-b878-4e43-bd5d-d5211d781fde", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff3a9902-8f5d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785776930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785776930, "uuid": "699999ee-c7c5-4655-a913-d447b17a5559", "comment": "Malware payload (Mirai)", "value": "6a84c959cc46b682296fa57c66e1009b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785776930, "uuid": "f932f3c1-138c-4368-b8d9-b345bf578d10", "comment": "Malware payload (Mirai)", "value": "ea0fcde0f742a92349458d00a63b378a1fcf0b2ef172971699aa10018d356d81", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785776930, "uuid": "c6f4f6ac-0b32-4586-b79f-b379465e3cc7", "comment": "Malware payload (Mirai)", "value": "83629dad9f7577a715c72db4fad4b027a41e91eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785776930, "uuid": "1c58ce6f-497b-460b-8d12-a631aa32c026", "comment": "Malware payload (Mirai)", "value": "71b2030b8a7f362fe318134d5e26840f84942ccf490324e8d9b8d1c7eaf8e5847d85051a97d7f50ce0f69cde9895062f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785776930, "uuid": "f14df8aa-479f-482e-b564-8b0568d2386c", "value": "T16A24E80AAF610FBBDCABCD3702EA1B0128CC555722A93B357674D518F54A64F1AE3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785776930, "uuid": "1ba50b2c-ed62-49e2-8d65-f95f04cf70e0", "value": "6144:L2ZKKkU08ICmEDMCWL4P3NG9k5XFkWsEN1K4UH:6PPMCW5BH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785776930, "uuid": "e9a104ca-0674-42e8-97c3-d73fedf9917f", "value": 224360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785776930, "uuid": "d00edc35-4509-439b-958b-2c9d82548b2b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785776930, "uuid": "45758596-4ff0-4dad-ac6b-37474a96b30e", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a6f2abb-8f11-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785744011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785744011, "uuid": "87816ebf-06d7-433b-a5eb-0ce479cdb234", "comment": "Malware payload (Mirai)", "value": "4e53cec157ff8d9b0bc2cc23fa979f12", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785744011, "uuid": "e4bd7730-a04a-4f59-a418-cf6ddadbb960", "comment": "Malware payload (Mirai)", "value": "eb18799c60c7673c3dffef1c45f35afb8c65439490bf4086e11fba5687ec967d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785744011, "uuid": "3ed12a9e-94a3-4de1-b814-3e2037305ff8", "comment": "Malware payload (Mirai)", "value": "80c7440a276b0d086b957663250d134a2c9b77e8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785744011, "uuid": "b9b4b161-5a1f-4061-9234-781a199c53a7", "comment": "Malware payload (Mirai)", "value": "dd58c089d3faf3ed534324c05b5f4254d43bcdc503b83caa04bd5a613fe6af42d7a4411bc0805bece1126ee62b5018ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785744011, "uuid": "aae59147-0729-40da-b90a-c2f26901194b", "value": "T19D143B46E9815B16D5D016B9FF7E518A33131BBCE2DE3112AE149F30778B87B0E3AA05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785744011, "uuid": "f5386deb-c16f-418d-a058-fc361ccf3092", "value": "6144:rO0ufMbQOvjxxPVGp+X6xiYa0a0qPlbJ:rO2QOvtxP0kXPYa7lPl1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785744011, "uuid": "3a3474f0-42a5-4590-803a-01764212fb8e", "value": 204024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785744011, "uuid": "3b5df81a-8a9c-4038-bd65-8db415dc3c8f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785744011, "uuid": "692f2341-c9e6-4636-a75f-0a04673dd8ab", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc714645-8f5d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785776844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785776844, "uuid": "a42f394b-25eb-4f2d-8ede-450b11002525", "comment": "Malware payload (Mirai)", "value": "180dfe2ea2be1247c6ae2b84ec8cc947", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785776844, "uuid": "5ef28af3-104b-479c-a9bc-586765ced891", "comment": "Malware payload (Mirai)", "value": "eb9673ce30143bba5f3f36a7476fd0506bd6152c711652cb12b0db33455d2cea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785776844, "uuid": "35c9bb11-5995-4eb3-af49-dc84e36d7d3b", "comment": "Malware payload (Mirai)", "value": "be4e42a93446aa159a2d9a1cc655918d486cbb8f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785776844, "uuid": "ed9911ba-f3be-4019-92ad-950196621afc", "comment": "Malware payload (Mirai)", "value": "027796dde0cc25521e4bcc5cf26eb1daed655b4f40acaa54ba02e0302f9d4001d7dbc5ede80f012285e15a243c67789c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785776844, "uuid": "4ecea99d-0e3b-4963-951e-4b8b10632a35", "value": "T177F34A02731C0A47D2532EF03A3F2BE0C7EFD9A225E4F645654F968A9271D361589ECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785776844, "uuid": "7fb406c8-5378-4650-900d-8dbf05534fec", "value": "3072:Ty7BBtHTSh+xNfGaxMOVpVS1oFQ6hh1XcI:TyVzHWoxNfGaxMOLgqvcI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785776844, "uuid": "44e90433-80c1-4434-9fb3-2812f6d0d1fd", "value": 167696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785776844, "uuid": "250d7c99-6075-4410-a3b9-dc29413cf197", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785776844, "uuid": "28c3b388-7765-4ae4-9142-76f3fcab0878", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e35a4682-8eeb-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785727920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785727920, "uuid": "09ae144f-99f2-4715-977f-0b719ddbc0e8", "comment": "Malware payload", "value": "3fb5dc247a10522712c342871c58a143", "object_relation": "md5", "Tag": [ { "name": "424e51f31d68f573a4621aaede8044aa", "colour": "#51F4DD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785727920, "uuid": "b34d185a-30a4-4ad0-b136-5c2406502aef", "comment": "Malware payload", "value": "ebfd170776d67428de1053ae6c92a6dee25614c8ec61f488b6f5228b58bbe003", "object_relation": "sha256", "Tag": [ { "name": "424e51f31d68f573a4621aaede8044aa", "colour": "#51F4DD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785727920, "uuid": "a1e6986f-d031-4c82-a394-750cf2861456", "comment": "Malware payload", "value": "9f18b6a81334aab60c6168bed636897ee279b3b8", "object_relation": "sha1", "Tag": [ { "name": "424e51f31d68f573a4621aaede8044aa", "colour": "#51F4DD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785727920, "uuid": "048b7071-c549-49b3-a37c-77dabe600bb0", "comment": "Malware payload", "value": "d9414177ff2cfeb3e0f589ee21e0e0e8b4c294f5a812b0aee4be38b72bb86074d1b49f8ef2d1c15719a5c3110dd4cd0f", "object_relation": "sha3-384", "Tag": [ { "name": "424e51f31d68f573a4621aaede8044aa", "colour": "#51F4DD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785727920, "uuid": "75186b91-906c-4d93-bf55-8d09e258d293", "value": "T1F6D5228DFCB30E74E873C7E7859764BDB16E77448AA08D1A35892B102D12A397C36376", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785727920, "uuid": "c401616d-8883-4264-8893-f5470f117423", "value": "1799eb3c1092391ae174afa4eee4cba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785727920, "uuid": "b56ac419-72f7-44d0-95d4-f225a5d0a716", "value": "49152:HsDadQo+Oss/hMxu93HPF/jOnLuual/BrbNRNX1mTl7XL/UyOF2DY6xa7LOvU9o5:Zd3iERFLOLuual/XoB7XYyO8Ss5bys4a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785727920, "uuid": "f59bac40-8ee2-413e-9ece-fbb4c6d41369", "value": 2967552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785727920, "uuid": "3ddc9cc5-c4ac-4243-a66e-c5dff9a33088", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785727920, "uuid": "eed39855-e5e3-4bdf-8813-bf28c6d8bb92", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dc4076c-8f38-11f1-bd95-42010a9c0009", "comment": "Malware payload (AMOS)", "timestamp": 1785760821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785760821, "uuid": "4d3d3803-7c6a-4c25-993e-4e209fa68fc7", "comment": "Malware payload (AMOS)", "value": "2682871c759800d029608e7b80e01ceb", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AtomicStealer", "colour": "#FDCECA", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "InstallFix", "colour": "#D6BE81", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785760821, "uuid": "7b89984f-86cd-4660-a5f4-c38dd58014ee", "comment": "Malware payload (AMOS)", "value": "ec0d13eb92a22465723e904b2ace56ddf20489810971f3b437197fdc78d10098", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AtomicStealer", "colour": "#FDCECA", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "InstallFix", "colour": "#D6BE81", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785760821, "uuid": "4405182f-f05e-47ed-b1bf-5b13445504cd", "comment": "Malware payload (AMOS)", "value": "f5e2d7126b110ad4c5267796641ec5ffda11b4b6", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AtomicStealer", "colour": "#FDCECA", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "InstallFix", "colour": "#D6BE81", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785760821, "uuid": "cbddf5a3-6506-45f6-9674-01ad57bda9b1", "comment": "Malware payload (AMOS)", "value": "d7b9f403fd79677c2457f703a480a734e29944b1884ed059e1574212db955ffb3f5e68fac26789c75fe3b40a5dc6fa89", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AtomicStealer", "colour": "#FDCECA", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "InstallFix", "colour": "#D6BE81", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785760821, "uuid": "bc938c79-659b-4b39-92c0-c61ae9486711", "value": "T1CEC49D0EE9FE2A74D1CDD03CDC670BE6A134F8986E2067734710BB10AD9276065DB7A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785760821, "uuid": "7e6dbe2a-1a99-4869-b304-e04793feb240", "value": "6144:7xgQ/0x/E3higdyFA98ijryiSYI/g9QRVCqR0ABpA4iMElpyukpwSd/7bTyiSY10:9gQkfxrijzSYI/nRV10PlIpwSd/7fSY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785760821, "uuid": "98d4369a-d40b-42bf-a08b-4c30c4832541", "value": 568368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785760821, "uuid": "68dce5c3-9a8d-485d-a046-c8edfa471e7f", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785760821, "uuid": "63333e40-6d8d-4758-af97-ac88d8c54cb4", "value": "mdworker_shared", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c4d1eaf-8f06-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1785739371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785739371, "uuid": "278c1689-8b65-476e-893c-60151664f371", "comment": "Malware payload (ConnectWise)", "value": "9f4ba80106e37ac852a5b072d502f222", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785739371, "uuid": "76e91a11-7e4c-4d99-886e-9ceb2f6b8a5d", "comment": "Malware payload (ConnectWise)", "value": "ec1735a92888588dc104f663c23963989970ebc785c77e8684935453c46a8743", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785739371, "uuid": "eeb19d65-5c6a-424a-8985-95257013ca45", "comment": "Malware payload (ConnectWise)", "value": "47ee6f07c6dfbb955f3b6ae6c2665abfca747c07", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785739371, "uuid": "a2dc3b90-4db3-4235-aaad-befc66ad18ee", "comment": "Malware payload (ConnectWise)", "value": "49f9c36df368a248df7bb40d47eb3ac0c576e66630709210b858aef1bf237a339d14b7d09077ab4c6d6d865612559164", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785739371, "uuid": "1b4567f4-e7f6-4730-979b-522126af0dab", "value": "T13D46E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785739371, "uuid": "7534e222-23fd-4891-9b39-8efa5238238c", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785739371, "uuid": "6492ff4e-8c1e-4ecb-a52b-d40c4c39dce3", "value": "98304:XzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:XhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785739371, "uuid": "b76d1bd6-6a39-4abd-9845-3c6d267a6f4a", "value": 5680064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785739371, "uuid": "c20fc5ed-5435-4aa6-a42b-b07c1fffb95d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785739371, "uuid": "20374c28-2c18-40a5-8ee6-f8c1ee58d911", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17ceb331-8f08-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1785740034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785740034, "uuid": "3edf5ede-63a3-4296-8325-187ca09f71c1", "comment": "Malware payload (ConnectWise)", "value": "ce13c2efad3b7bb0e56b287e7dd81991", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785740034, "uuid": "2bc6dcad-4d55-41b5-acad-2cf1f7eb334c", "comment": "Malware payload (ConnectWise)", "value": "eccc5d4b2280b064863957dc1c91ed239f6391d01b94c7f11f63b38959e681a9", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785740034, "uuid": "d5c2ad39-a7a1-45a6-a3bc-3439221bec12", "comment": "Malware payload (ConnectWise)", "value": "e491b46d01ec23cbb34932027bc1285a827ef352", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785740034, "uuid": "9437d315-6399-4dc6-8faf-9a3e658ac011", "comment": "Malware payload (ConnectWise)", "value": "1414b5b29a7a1195c3205fdd953e538b6f581b7f8edb7933f5adc18b4b4fc20692a4c71afa4f65be3a10762752a1c004", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785740034, "uuid": "88535519-6042-4551-8b6f-d80f23ecc21e", "value": "T14046F111B3DA95B9D47F0538D87A42A99A74BD048712C7EF53D4BE2D2D32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785740034, "uuid": "9ffc447f-d42c-47c3-91c5-288954649ef4", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785740034, "uuid": "7729f3cb-48aa-4214-8007-facc706c506f", "value": "49152:0EEL5cx5xTkYJkGYYpT0+TFiH7efP8Q1yJJ4ZD1F5z97oL1YbGQ+okRPGHpRPqMr:9Es6efPNwJ4t1h0cG5FGJRPxow8O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785740034, "uuid": "84c55f71-d70f-4f58-aced-ea73406ee29d", "value": 5640664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785740034, "uuid": "9054901f-bc79-45fc-a49a-c2b5bcf70bba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785740034, "uuid": "e96fdd74-9d97-4b6d-9e98-388385a15067", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd7890c9-8f2d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785756204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756204, "uuid": "281867bf-6df5-45da-8a32-e1d0bd083e88", "comment": "Malware payload", "value": "f31c63da096950dbd26f18bf9ad80aee", "object_relation": "md5", "Tag": [ { "name": "dn-pdflite-lat", "colour": "#BE5FA0", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756204, "uuid": "5218e3bc-5967-4640-ae6f-04e99307ff95", "comment": "Malware payload", "value": "ed4fb97743bdf7599221a0711ff0f290a0f7c8de46f4d3178cf4a9e3d65f7f75", "object_relation": "sha256", "Tag": [ { "name": "dn-pdflite-lat", "colour": "#BE5FA0", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756204, "uuid": "d22969bd-cf9d-4f06-ae2d-6126a2c9de83", "comment": "Malware payload", "value": "9072c48b5ba3c0d5962fb2382b9638822227a95c", "object_relation": "sha1", "Tag": [ { "name": "dn-pdflite-lat", "colour": "#BE5FA0", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756204, "uuid": "d4f65d79-f94b-42b7-9895-b17ce01bbd5e", "comment": "Malware payload", "value": "a8451bca6237ee119376e28a0e7dbbda4214689d2ee3c20890f6c776e7309ee29b049d450c204f5b23190a6f69018850", "object_relation": "sha3-384", "Tag": [ { "name": "dn-pdflite-lat", "colour": "#BE5FA0", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756204, "uuid": "c5031938-b38f-49e0-bd70-2e6f31cfc998", "value": "T1AC23CCFBBE4652C1FC3249BF5A2F609954D4260227A1D4F9F28EDC00EF98E4985343D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756204, "uuid": "3359a98f-10ab-461b-b58f-afb58c8b9e2f", "value": "24:5xa6Df2uZAaLhpwklVwR/N3Fz1jYpQlVyUQ/UfvlFsZspO3GT9V6claKumCK1gqh:5xTf3ZRwxmnUTkWTRt8R0RuRGtg2/DN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785756204, "uuid": "59e495d7-c290-49a2-9299-f5c89f40e250", "value": 47104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785756204, "uuid": "ca274b83-1b20-4142-b431-0965714fd312", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756204, "uuid": "c2bf3fb5-1f2b-4dc2-be2d-6e194bfaf705", "value": "Nota Fiscal Correio-JSRDAM.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "032a9918-8f5e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785776936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785776936, "uuid": "0dcb5a6b-9887-4c01-84ba-aa1a3e3162bc", "comment": "Malware payload (Mirai)", "value": "57e9c25fe584768e6b14f689090b168f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785776936, "uuid": "40de7267-e218-4c82-9adc-bf64d307c5e5", "comment": "Malware payload (Mirai)", "value": "ed83aadfab0209b611ea4f6c512aee4e189036b6d7336355c4eddba16d6b6111", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785776936, "uuid": "1977630a-3d1c-419a-96a6-aa3285683123", "comment": "Malware payload (Mirai)", "value": "09094b051ed4ecf9ac087fe0050373c08ce8632a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785776936, "uuid": "6add5cd5-51cd-4588-8b74-b95bd48404b5", "comment": "Malware payload (Mirai)", "value": "b7d0d9e039b7bc092e02830d42490391e430cfd016eafad75c12df2a143f3043c1cb4e9c77c08f87e5195e87c5ee3a88", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785776936, "uuid": "74c23191-21ed-4ef7-a8ea-de8320e327c7", "value": "T10C24B80E6E228F7DF6B9C73547B78E24975823D627E1D650E1ACD2102E2025E641FFB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785776936, "uuid": "a094c4ab-cd9d-481a-9056-a94230c54177", "value": "3072:bhVcOPJqSUp2vIXMxps8WehuM2A25Eqb9LXUdtV+6hh1/gJI:bhVcOPJqSUp2vIUB8fzbJatjgC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785776936, "uuid": "12b4faa7-f727-4a07-9f6c-e5e47df647e4", "value": 220264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785776936, "uuid": "dfa1f0fe-488e-49cc-874e-202b135e8447", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785776936, "uuid": "90dfe696-715b-45c1-9702-455fcb8b1ef9", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f18271d-8f72-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785785546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785785546, "uuid": "815b7614-8e26-4663-afcc-621bcaeeb0e3", "comment": "Malware payload", "value": "bf65cf5ff9c0d856e8ca6ec13cb34e8d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785785546, "uuid": "414c37f4-befa-4e1c-8efb-35f210ddbfb4", "comment": "Malware payload", "value": "ee12e0dfc1b44470c2a8bde89a6da30cc41753b3b429918009d9e9d728b8d9d7", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785785546, "uuid": "7d7eaf97-11cf-459c-b037-a2d761b52c15", "comment": "Malware payload", "value": "4fa81a66bae2943f5b63508e2d408f2dc9b7874c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785785546, "uuid": "a49b8f20-9373-4494-8f41-a61fcee17641", "comment": "Malware payload", "value": "4a074dc37aacd4cdde09ab4353df0925707c17d23ab32a4c0512fc9ea00c6a6d5f3154cfbaab6f67edf9f931a22de2e3", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785785546, "uuid": "656387fd-1a74-402b-9712-6c3532824a92", "value": "T186C080F6463069739904C54F339C4199714588F94DCBF47D5C174C71544E65C70067A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785785546, "uuid": "471c0482-60a4-423e-998d-ac4ce0a7c84c", "value": "3:6SDtFiLfssG8u7cy+iQQ3ZN1Ltq286iC8u7cyY0GNIa0dog1VZHevDv:5DtmEsw7x+lqZNZY96iCt7xY0axdJvz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785785546, "uuid": "962ceda5-e8d7-42ae-8992-a5f60583917e", "value": 169, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785785546, "uuid": "0c386dd1-bcc1-4ef1-893b-25875757836e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785785546, "uuid": "e48d0d1e-0834-4e3d-af39-beaba51b0d13", "value": "loader.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f432723e-8ee9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785727090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785727090, "uuid": "feed4671-6751-4e7a-bfe6-8e32edf6c621", "comment": "Malware payload (Mirai)", "value": "cd61ef1eb6f48668ca9360adc3820ed6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785727090, "uuid": "d67d91a8-879c-4030-98df-98e5e05ffbd5", "comment": "Malware payload (Mirai)", "value": "eeafcefee69c094284b3d652a0d96f30e37e7fe05da7e10a08bc536a744e8e61", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785727090, "uuid": "000851d2-5c48-419a-bbf6-4d5969c98009", "comment": "Malware payload (Mirai)", "value": "5cbe66ff9a9d01b226a3d756e0218f287b8b0c4e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785727090, "uuid": "ff9fb18a-f85e-46de-b21d-34f0c8dcfb3f", "comment": "Malware payload (Mirai)", "value": "d52bfc512a84981191176091514d2124c9affd93c9a776430cf31b97049d4ce0b9eac44b9baf340dd47b011815679fdd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785727090, "uuid": "0d597dc7-12e1-4d3b-9d45-6a1f3a8e2b88", "value": "T152E3BEA7F7471091C9A302F407CB6BCD6E6322825F5B99E36D2F753B497A0DA4402BD2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785727090, "uuid": "bfaee04d-b0ff-478b-9e64-85dd9a45f1e2", "value": "3072:wrEfRgCsyMXbJohs9gLeLuwO5rgW75qC:8Av0NQLUq75q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785727090, "uuid": "b2c0c4ed-3cf0-469e-be2f-61df17d988be", "value": 148932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785727090, "uuid": "1b0aecbf-bd98-4649-a898-31fcd8f2bbe4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785727090, "uuid": "9efa7f29-1a27-43de-b6f9-33bf1e6e632f", "value": "eeafcefee69c094284b3d652a0d96f30e37e7fe05da7e10a08bc536a744e8e61", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad67c26d-8f49-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785768202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785768202, "uuid": "0b9e1dde-94ca-4a9f-a770-c707500e8272", "comment": "Malware payload (Mirai)", "value": "3166e1bea6baab8970927c0723d6b373", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785768202, "uuid": "d995b072-c5b4-4e7a-a089-cf1b4f3c68d6", "comment": "Malware payload (Mirai)", "value": "eebcd1d6db601b694fd0b1863b414d8a714f65174902b0a09a4a264139708212", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785768202, "uuid": "68c9f11c-e4d9-4564-949a-3a4cb3873a49", "comment": "Malware payload (Mirai)", "value": "445e31f49d0d7f1b1910eff00b920202469bd653", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785768202, "uuid": "de2ca9c8-ed05-4833-a47d-a55a9a77ab6f", "comment": "Malware payload (Mirai)", "value": "28e0d1f5ed7edc02306ea9a77ac846b7b5cc3dee11f8f68642458d1241c39629692c19a553abbb34f1e15158ff04d3f3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785768202, "uuid": "556afd0a-a5fc-4d08-a5f7-30dff4daa4d3", "value": "T1682301F3A13743F6E623767E458B16D960308E712C1BF0B8558D2AD3B28954ADB8D352", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785768202, "uuid": "afa32804-b50b-482a-9cc2-bcdc3b1c7972", "value": "768:+8x3bfhKipDi1jrLjNEd2e6RVd0px+hyY5SCSu8U7deMbw6tQEKinPRl4SBqdRb:+8hsiFi1jLNGL63d0MT5T7d/w6tQjinU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785768202, "uuid": "7bf2bebb-5263-48a7-a4a9-c27d696c5da1", "value": 47664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785768202, "uuid": "1be31844-5a81-437c-bc58-137a72233e22", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785768202, "uuid": "60defa07-88ae-4ee7-8ca2-b6f240705444", "value": "miron.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddff9a5e-8ee0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785723187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785723187, "uuid": "ae035409-dd59-48b1-bf8b-cdc30e88c9b8", "comment": "Malware payload", "value": "6da0654c4e9943abbe500228107b5a5e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785723187, "uuid": "43fff78c-697b-4777-be72-31655a5baa1e", "comment": "Malware payload", "value": "f0acfe5618c3350d21e42a9784c8275e0be4745522a0ba1137ef52d1fd429388", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785723187, "uuid": "e0dade5a-c49f-48d7-a89f-20f1bf4d17f4", "comment": "Malware payload", "value": "344d002a326f1d30af09a6c374b62abf50eb362f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785723187, "uuid": "3d24ef04-1bfd-4639-b8d3-bc887e4e4d65", "comment": "Malware payload", "value": "efd4998fbedc3637fa850d7da4b57eea294bd27e5a6460d69a7c02b809cd0feeea3e1fdf63f92a7829fb1272bbc319f9", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785723187, "uuid": "cf599c3f-b787-4a10-87f1-0bec90309bff", "value": "T12111D0D6105559669A5B8A03F274DF3DA22B7FB47EBE3B0ACF849E13444444031E3DA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785723187, "uuid": "18995789-2ced-4a46-8d2a-530c946e5f08", "value": "24:5XQ9QwtxnQw+pQEJQRQPoQIpQwXx9QwwpQwSxGQw9pQujQvQwEx+DQwiDFFdsxqH:eahTeJGlIe5heJUeVYB/vRms", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785723187, "uuid": "3095d376-d6e4-464c-9e5a-ce8ee0f12218", "value": 981, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785723187, "uuid": "22147c07-8340-483f-b609-65a916d00989", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785723187, "uuid": "e5d8878c-9565-4e8c-a28f-42df491ee10b", "value": "a.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9dd38d2-8f2d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785756251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756251, "uuid": "5fa1f10c-02b3-4fcc-9939-05c4f46c5c8b", "comment": "Malware payload", "value": "f5aa1c25ca98d62829410498b883cb0c", "object_relation": "md5", "Tag": [ { "name": "dn-pdflite-lat", "colour": "#BE5FA0", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756251, "uuid": "ebd0fce7-0d86-4c7a-9570-f877e0828cf9", "comment": "Malware payload", "value": "f1699b3e5dc55a244eda3a27224bc9cc8a6d48ec2e7984885508836bb8dac018", "object_relation": "sha256", "Tag": [ { "name": "dn-pdflite-lat", "colour": "#BE5FA0", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756251, "uuid": "ed915fa0-f437-4332-8cca-575ef9c45d54", "comment": "Malware payload", "value": "5e1df7eba3cde9aff9856f70486bd463c79d1a95", "object_relation": "sha1", "Tag": [ { "name": "dn-pdflite-lat", "colour": "#BE5FA0", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756251, "uuid": "6e666a19-f9fe-4a6c-accc-02c9dedd9165", "comment": "Malware payload", "value": "dd017b2f5bc13389f040e53f6c4eb5db40f2e54a0391a5633c9d308fe649d6faa66a26f7c2bdd09247cdcb8907cf7514", "object_relation": "sha3-384", "Tag": [ { "name": "dn-pdflite-lat", "colour": "#BE5FA0", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756251, "uuid": "6dac31be-392d-4115-b363-fb269d909e8d", "value": "T1B92330ABBE4317D4FE3149BF663F205411D466431395F6B5F54EBC00AF44A0A85283E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756251, "uuid": "f89b9038-f3ea-4db4-9a46-55a706c70cf5", "value": "48:5JX62cf3ZRwhtFXqFje9R0OeMnonzNVUWNJDN:5J+RwhtpqFjpOJnozNJR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785756251, "uuid": "f8252f4e-bb99-4aa4-960d-8b634babae4f", "value": 47104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785756251, "uuid": "39f8f620-6440-4c17-96dc-b9dbf7bf3b76", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756251, "uuid": "bb0b96ac-329d-47dc-9160-d310882c3593", "value": "LEITURA TAROT.pdf-V1PDPQ.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be3bb482-8f34-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1785759211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785759211, "uuid": "dc7c98f1-dfcc-4b1e-806e-7ece559cf411", "comment": "Malware payload (AgentTesla)", "value": "0ae87c430da0ab4d3d9736d8ce73589a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785759211, "uuid": "0455738d-46b5-430f-9858-a7159207d38e", "comment": "Malware payload (AgentTesla)", "value": "f184acaa8821f13f2eee56c390b83d2b6948f10ce768cd23ac6e56e3fa708e61", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785759211, "uuid": "8a2b70b5-fc8c-4e8c-88e0-06745f9506be", "comment": "Malware payload (AgentTesla)", "value": "e1c5a0ee07efaed78dbaa15697c2f655496a035e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785759211, "uuid": "406d536c-6b59-4265-aac2-b00f395bbb9b", "comment": "Malware payload (AgentTesla)", "value": "6e1889c3fd1e64b32c46cc713a0f6303c4acef6c84a5be570876be743f6778d0a3e60e362c012119b14e186cda7876de", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785759211, "uuid": "2477c4d9-4a70-4601-87ed-1632608bcc8f", "value": "T132051FB26389A5C1DABB63C3ED8AB7299590450BCAC2B71F3FAC87C314458DD1690CF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785759211, "uuid": "c80e8762-de8e-463d-b876-5fdc83f705b6", "value": "384:frqHJGuWHKf6j2/oD3xGnlpTFOzfaH4Pg2g1b3i9:KGuWHm4E2slCLaH4o2g1b3i9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785759211, "uuid": "d146fca6-6a70-48ac-bfa3-69de71257017", "value": 853306, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785759211, "uuid": "e7d37d5b-0748-47c4-90de-7a1b74e12354", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785759211, "uuid": "861e0d51-92dd-4417-9f44-6fc68f7d775e", "value": "comprobante de pago.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddba1018-8f87-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785794912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785794912, "uuid": "a917b36d-f0ca-4707-94d8-8ee646bcc99d", "comment": "Malware payload (Mirai)", "value": "17706efbba21ff7c59bff670448b8163", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785794912, "uuid": "45e0b623-8cca-490f-acfc-c29bd2544b64", "comment": "Malware payload (Mirai)", "value": "f2579b42273a13bd2bba92afc3b5b934cb4a27b2f93baebdf716916daef714c4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785794912, "uuid": "1c266007-0b27-4d90-a824-9d235b8e0318", "comment": "Malware payload (Mirai)", "value": "a5afacc7fb7a28997e53c6e7216b5fabbdcc76d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785794912, "uuid": "2989e171-fead-449c-b4cb-7e7895f2d841", "comment": "Malware payload (Mirai)", "value": "f7cad229a78aaa2baa350c2181bf1f7bec9b295fb47e9110680f24499c77c063b5d2c409a795751d3f664af7358fa991", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785794912, "uuid": "25a948d3-1569-4d7e-b124-cac72c460eee", "value": "T1E744B71E6E128F7EF2A8C73447F78A31976923D613E1D585D2ACC6105E2029E641FFAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785794912, "uuid": "0f742017-2309-4773-952a-702d69672291", "value": "3072:fIpL5fJJ/qknZ7Xe8yjD5hpXIsQUHifisbpJb7MBWeyq0zvWSDC:QpL5fJJ/qkn9ehXiaA97IvyqSvtDC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785794912, "uuid": "2f2d968b-4b99-483a-872d-752375dd7fe9", "value": 263172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785794912, "uuid": "bbca542c-652f-4d64-a11e-f7596159594b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785794912, "uuid": "68e91f88-da36-4f91-b791-c785639544b4", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ea1db3e-8edb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785720933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785720933, "uuid": "66077f3d-a123-4c71-98f6-0b1103a508b5", "comment": "Malware payload (Mirai)", "value": "e6b4ac3e034edef770dca6f3d5e7b338", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785720933, "uuid": "61230b01-25f5-4a4e-ba53-f9e650866e93", "comment": "Malware payload (Mirai)", "value": "f32e6d2dcbab31760194ac911b76dbb89561a32bb53d76a1b5c2b16c5f5f3548", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785720933, "uuid": "145a0b92-8c69-4a07-8620-51919f988cc1", "comment": "Malware payload (Mirai)", "value": "c23aa9096629e7c50f54116108a1fc241233a978", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785720933, "uuid": "8299d153-7bb5-4866-9131-64673af7767c", "comment": "Malware payload (Mirai)", "value": "a135a8097fab1271628a07d1011dce5bbdc561a2d019bb31cd8addda5fdc0566125baa80df9d0ce7239c547cc4a621ae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785720933, "uuid": "555d786d-8c37-4fe7-be13-0d74d5428b1a", "value": "T1B3C34B0273180F4BC4A31AB11E3E37E587FBE5E021E4BB89251E8B564675EB76449FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785720933, "uuid": "26b20b9a-cefc-4900-b4b6-a7bbb29eb67b", "value": "1536:qdanlx5A0NMvRnbZAVAmivlJNOY9y/+Fx+1mGlXyykjPHr4:qd0li6AVnjFcmDBHr4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785720933, "uuid": "b8381222-d8a5-4677-884e-8a0348d566bd", "value": 120396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785720933, "uuid": "857d4873-902d-4887-8faa-e834f07715e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785720933, "uuid": "fb6a5f45-c7b4-489f-9371-6166efc99ef7", "value": "nz.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58425e50-8f38-11f1-bd95-42010a9c0009", "comment": "Malware payload (njrat)", "timestamp": 1785760758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785760758, "uuid": "5fd76791-c962-436a-8c2e-6f36d6e75b2a", "comment": "Malware payload (njrat)", "value": "faf24936b7e05072e24445e3f0194716", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785760758, "uuid": "690f12a0-77fa-4d53-b83c-e8d14aaaaa36", "comment": "Malware payload (njrat)", "value": "f3414f6a3bd78e26a859f4301c98ef9094bc43508968331ba1265b711cdbe030", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785760758, "uuid": "fddb3e5f-53c7-4b36-9676-45f5343abc68", "comment": "Malware payload (njrat)", "value": "6ff940ed7095ac5ba2074537032020d00aed67b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785760758, "uuid": "42a8c376-3740-4083-b5d1-f61d20a1d766", "comment": "Malware payload (njrat)", "value": "ee293bfab0d8208da0e1ef3f0d865dc4fc1e0d4ba111f35cdf73e60e263a0d31801a7eec118c0aa8f4ffac0cd8fd2f33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785760758, "uuid": "c3077f56-bd7c-4391-8608-c5dd8102855e", "value": "T1ADF4BD04A65A74D8D06645F388D1371DAA2AFE0132D05ECA2EDF72756E317E0EDEBE10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785760758, "uuid": "682085b5-b9bc-4e16-a380-22b311f71bfb", "value": "905d6e2fd95bb9d68bb959ec7e8cfb12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785760758, "uuid": "8e5c2ec5-4f9c-4d2d-82b8-ca6aa869d891", "value": "12288:cVrl29Gr49nD/W+48CKulnmcXMyAMj9jnpD9Dzm0blXEqCPXnQ1tEBFbdv2uQ:t9GU9nW9n44AMJmAXEhnQABFR2uQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785760758, "uuid": "00057811-9f35-44ad-a8c1-2fc78d78be4d", "value": 783088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785760758, "uuid": "4b86a5ac-4265-4db7-a548-93fb6bd09142", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785760758, "uuid": "d4e42fa9-b851-4c2c-b67b-13224760fa95", "value": "f3414f6a3bd78e26a859f4301c98ef9094bc43508968331ba1265b711cdbe030.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edd5e76b-8f2d-11f1-bd95-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1785756285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756285, "uuid": "bff83fea-0f6f-4cbc-89f2-993469189629", "comment": "Malware payload (XWorm)", "value": "7d69d550687badf3260a593f0881f86e", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756285, "uuid": "2366a54c-1ce6-4de3-b447-13fd430f06ba", "comment": "Malware payload (XWorm)", "value": "f54480ef123a6b769b0b2d09794aaea00c6b72416c5990fc33a70e3703c505e4", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756285, "uuid": "9370633e-520e-44aa-a36d-2f39c030439a", "comment": "Malware payload (XWorm)", "value": "14d3cd1fa01501f6e84af6c3e3ae49abb8238442", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785756285, "uuid": "5870e972-a569-4e57-8000-a0f3454be39d", "comment": "Malware payload (XWorm)", "value": "264370030443d809fadb747d72c412a8b9696561c7bb9fcb8931f95b1116ea74e5f3dcca191844569437dfc3ae6f542e", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756285, "uuid": "7fb04b54-3768-4317-9ac1-206b9fcc83d6", "value": "T1D422BFA5B97DE71750B408848BEC1A9FC7E24F02FEFA43A2E649D7226429D1351C9EC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756285, "uuid": "0bf5dce9-bca0-42ed-8608-5673f6689a12", "value": "192:ihKoKiHoQhp1i5kdB23WEMV4TYgIlh+ELe/KOYtGcw:hofBhC5qBy8aYR+Ei/KOYtpw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785756285, "uuid": "cd3f15ef-469c-48f2-aebf-937c5a73ad5f", "value": 10181, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785756285, "uuid": "463f7a19-8019-48e9-9084-70a9233bb3c1", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785756285, "uuid": "e1813a69-4baf-4026-8f08-fa5717c513ab", "value": "073126-Purchase_OrderXs.lzh.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5988b948-8ee0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785722965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785722965, "uuid": "4c7198fe-f780-4dc8-99c2-ef6694d404a3", "comment": "Malware payload", "value": "4999d5b25ce7f13028f35b1997f8078d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785722965, "uuid": "eaf67108-1614-48ad-b5bf-f8ef1fcb24e5", "comment": "Malware payload", "value": "f705b64b8a8dcf8de34dd9c6f1ebcbb5aee140dd973ec70bf998d172ea7d6893", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785722965, "uuid": "8c2ae580-84b2-4c80-8827-581b54d68f1a", "comment": "Malware payload", "value": "3938a62b0b1b07f7571607ee748d642cf8df6d8a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785722965, "uuid": "88ae67e8-b0e4-4131-9997-038810c87e64", "comment": "Malware payload", "value": "2c619ccc5d822ea644e01ee6b5a4365c5f8eb3319b994bf311673f7220e7e53ccbe3341fb7bb17673e4b39f17a4ec179", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785722965, "uuid": "40844e30-8273-4f94-a368-d030a4e0d417", "value": "T10AA48C6ABD419A52C4C426BAF96D918C730313BCC3DA710AEE05CB3576EF48E4D3AB45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785722965, "uuid": "242d1c55-8da9-486b-8253-976a57f4cb90", "value": "12288:c4ZS+vgMq1opmuADzQAZtMko+HfL2GUer33DL:V8+Wu60QW+HfLcer33f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785722965, "uuid": "13677af3-7677-4ed2-aa75-fa7c3002b345", "value": 481677, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785722965, "uuid": "e6aab779-c359-407c-93e8-25ace5f2c954", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785722965, "uuid": "3892f551-3cf8-474b-94b8-5954eb4e7e4d", "value": "bot.armv7-a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe312448-8f6f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785784659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785784659, "uuid": "b9a4f261-6437-42f8-af29-d3f216d97541", "comment": "Malware payload", "value": "6dcf67f57ecf99d4bca0ef79b1ddd212", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785784659, "uuid": "8c08dc38-3aea-433b-a67a-15ce6d957326", "comment": "Malware payload", "value": "f70cbd866b3f1482610603ed98948f76215012abd559f9e857c321305ff46f66", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785784659, "uuid": "cea0f553-40e2-4316-a884-84cfb57b2c07", "comment": "Malware payload", "value": "5f4e2c7b1e91d0f63c1250a5eedb2b5df2918862", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785784659, "uuid": "3697af19-8d90-4994-8b7b-c8086b50e3f5", "comment": "Malware payload", "value": "18cb2108a8c0486b0068a6b9287e2ad42c5245a002956d233101d4623f563ec205c8f9eb9e91514c7474acbb235e01da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785784659, "uuid": "74c75468-1811-4265-ba93-caa6581f0073", "value": "T163734999B8829617C6C1127BFB0E428C372667E8E3EE3203DE155F21378B95B0E7B551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785784659, "uuid": "5f688af8-532c-4705-aa57-b3ed489855db", "value": "1536:yNGQCm5a0saRScVLszEzYFyUeIA0RqfaO1Xgfj1ryAd02RLqJUFgpIMUov:ygBm5a9abVLFzYFyUxA0RqfaCQdyAC2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785784659, "uuid": "717aa9a7-d5ea-4430-8f2d-cb2671f7ea1b", "value": 79024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785784659, "uuid": "fe71868b-d019-4dcc-90f9-28f9f595bd37", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785784659, "uuid": "6fcdadd4-3a08-4b36-92be-d64b0229b38e", "value": "lul.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8727ca7-8f47-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785767362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785767362, "uuid": "a92dcf1c-1bf6-43bd-86ce-5242026d1dd4", "comment": "Malware payload (Mirai)", "value": "ae7034ac1fa34b578154280b77e92a8b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785767362, "uuid": "16ecafc0-b513-4b54-a680-4499312e2df9", "comment": "Malware payload (Mirai)", "value": "f7cbdaa79f80c8d8b11f32f260f340694dc328c40f9a6c587147cabdd823f74c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785767362, "uuid": "5067b25e-7242-41f4-98b7-7282fd8d2dfe", "comment": "Malware payload (Mirai)", "value": "f61b7c3e1772471eea48be1d1332365ba78c50ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785767362, "uuid": "8466e9fb-b32a-4e3e-8ca3-679dd6b176b9", "comment": "Malware payload (Mirai)", "value": "81a492e568dcf936bcee9e80394c22495e787a72b7cd4f21e54dcdcf55afdf1e1d388e1253c0ae5eb87e9b7784b38ba3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785767362, "uuid": "59b72033-8293-4221-8ac1-a7fd7b11507c", "value": "T113E3C6169F960EBBCCAFDD3302A90B0539CC955722A43B753674D538F54E90B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785767362, "uuid": "7ce2d3dc-1761-43c2-8375-72e8665f6aef", "value": "3072:DySsjLwUbL7jN/FslsYqGsQ6S4mWRYa9uy35T/gEfkaiJTpqf1B6uvQXToTN+c6T:DyRLpfmu6eJb+J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785767362, "uuid": "8eb021ca-2f4f-431b-b063-210a6a936991", "value": 152684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785767362, "uuid": "9aa9886a-931d-4c4f-8112-cf2a96768d82", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785767362, "uuid": "37a53e89-aea5-48ae-bf7d-24600a004574", "value": "miron.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58c59f05-8ee0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785722963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785722963, "uuid": "9aa40cc3-f701-43ef-a887-10fd4f1601b0", "comment": "Malware payload", "value": "aa8f58846f86c07b99c44eb7eb61d54b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785722963, "uuid": "eb0189e5-5b7f-4535-8416-ea1bf81b9ed4", "comment": "Malware payload", "value": "f87136be73f25c4716fcfbd96499b78ad81093f01484d6edc894a8ca26146bf1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785722963, "uuid": "ebfeffb2-2fc6-4969-920b-409ae390d017", "comment": "Malware payload", "value": "e2d70c9fa672681ea0deaf7fa1280b18fd79faaa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785722963, "uuid": "c9724287-cd17-4145-90b2-cc5e7a83320a", "comment": "Malware payload", "value": "5ebbf6f32c06c51a86415981979910835e3b30785f3353a1044bc84fe493fe10f5b1e37ab909b0b8e9046e6f05c9bf28", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785722963, "uuid": "9e432ba6-f6bc-4875-9f26-37b912016eaa", "value": "T1A4B47C6ABC419A52C4C4367AFA6E9198330313BCC3DE710AED15CB3576EF49E0D3AA51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785722963, "uuid": "8d643ac5-ac08-4631-8271-bc8d0378d216", "value": "12288:aYMoxgnE+JHSdsRhaEb25V3luXEHAaRZAPtde2j:RqHSOhMFlPl4tdeo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785722963, "uuid": "2fca6d70-bf80-460c-b09d-189ca51e44b4", "value": 494544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785722963, "uuid": "79a70e35-a5a3-4942-8a5c-0346fb44e34e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785722963, "uuid": "6db354f5-a2d0-40c5-a850-2f9282b9c0a9", "value": "bot.armv5te", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ba87d9a-8f63-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785779259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785779259, "uuid": "b2dc6cb2-abb9-43e0-8d6b-efd0983726b6", "comment": "Malware payload (Mirai)", "value": "693c6a9c71210078f02ed098e5d7a59a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785779259, "uuid": "2aa70edf-0b0f-4148-ad8f-b6e32354fcd9", "comment": "Malware payload (Mirai)", "value": "f8906e9b13e4e77a7571a384fdd24fb22c5d024d973933029a238adbfc9d74ec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785779259, "uuid": "21cf80d7-5c6a-40df-840f-31d30ae44ac8", "comment": "Malware payload (Mirai)", "value": "433a5ac5eeabe575fb4346294edf8f985e602ea1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785779259, "uuid": "1893e8d2-3743-4996-8a52-3ec6f1558674", "comment": "Malware payload (Mirai)", "value": "954536fed4ef78822691e0ddcc3d972131a75cb71e6b5ccb15f28f2c3fff2b24ae431845fb04d3099195ec4dede29fa0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785779259, "uuid": "450b9fed-0276-4daf-a5e8-d5946c61a6d2", "value": "T1F2C33959F9819B11D5C622BBFA1E028E331357ACE3EF72129D205F2537CA96B0E77901", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785779259, "uuid": "4d0371fb-bbc1-468e-97da-647fd715803f", "value": "3072:L0ehRjDIcjhTrHVyGAFNafb3QE9KCZEPBIEMHfjp:L0MRjDIcjRL2Nafb3QE0C4BHM/j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785779259, "uuid": "55d676b8-30a6-45fe-aca4-70559fde1912", "value": 124752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785779259, "uuid": "e4c7f621-6f30-402b-a63d-08615873d068", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785779259, "uuid": "eef76b4f-99e8-4132-9c6c-d731d9f07dd8", "value": "lkxstress.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d53d873e-8f57-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1785774282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785774282, "uuid": "472c1293-794a-4759-aad9-74d938f15e58", "comment": "Malware payload (RemusStealer)", "value": "1e316b9ce1142c72cfabb53fef597990", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785774282, "uuid": "e4e74f67-5a1c-47e4-88c8-6567242ef89d", "comment": "Malware payload (RemusStealer)", "value": "f8cdef17d24fff6b62927d599b08164309a94304da6a045eb39727685be4643c", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785774282, "uuid": "c6cad2ac-7575-40ae-bfb9-71f4be96357e", "comment": "Malware payload (RemusStealer)", "value": "e17fb89decd81e1ce84ec7cf1c099b852254f809", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785774282, "uuid": "9b0613db-291b-45a6-bfbe-f0797cfd6e59", "comment": "Malware payload (RemusStealer)", "value": "af84cd3960c878a15b6ced62a3c8d06df9e76b89fb57afbeb777e7c94a597ccb0981c8fd099b2a75d61b95a80dd721ac", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785774282, "uuid": "83011a4d-0edc-425c-820f-1e954e54de4a", "value": "T12CE501467F81C650D055CB70CA26E7FD3329FE58DE558A8730DABE0BBDBA5C21D2A180", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785774282, "uuid": "525db0dc-483f-4ee0-a194-544a2a6f415b", "value": "6a368102586dffa13aabff685459b467", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785774282, "uuid": "50a170e3-ff25-4c4d-9260-8f1e49c01ab1", "value": "49152:vmkkw+5xh/11QkOr6yTKI3bPnfo0or8+wqm+7licaFBM16Hcm9DUZ7iT5kbs4B:vVjk11POGcPnjorvZ3daXMUzWGBY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785774282, "uuid": "7e4e2e6e-1900-4324-8bde-2c2a26200691", "value": 3133632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785774282, "uuid": "2252ad13-ae35-4db1-b8d4-6dd8ffa847f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785774282, "uuid": "3d1a4bc3-40a0-485f-893c-893fa2028dec", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81bf65b7-8f0c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785741930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785741930, "uuid": "f9a2bec8-5a0f-4c6b-b03a-f0d51c7da90f", "comment": "Malware payload", "value": "5f07588e58a97a1f22f5bf0144f5e644", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785741930, "uuid": "a4fcedff-6c89-4221-865e-9479f26b3fdf", "comment": "Malware payload", "value": "f9a7b51cd7ebfbee5f7c7b4b5c472b174b1a3ebcc0dcc80d39b9dcc0e33729ab", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785741930, "uuid": "634df046-6428-4d66-b238-58489a4e1e28", "comment": "Malware payload", "value": "30cd220585e4763acacca2e47bbae3ff1ea262d0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785741930, "uuid": "3205e544-3162-4f1a-8d2c-62788d1d03d2", "comment": "Malware payload", "value": "ef80c40b21e4931faee663bacd43b7df7b426ccc59f915b7df4966354b94cf0df22c0835b13dea38c5579a152f5a7c3a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785741930, "uuid": "75948ab9-d44a-4f17-9a23-76f10be7ed74", "value": "T1E9C27C956A867C44BEC98A3E4CBD2B1D6DF5C3D1324942AC3D8A3C71DC11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785741930, "uuid": "9aad2809-ae28-494e-9277-a594d9b299ee", "value": "768:J8vCB+25j6es8RH9FYpMSUpi+20qUpi+20YQX:J8l25Jhd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785741930, "uuid": "57a3226d-d748-47d3-9961-e2102588ad2e", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785741930, "uuid": "260e9dc3-492f-429b-9cf7-f760da4379d0", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785741930, "uuid": "67a7c050-9988-4456-91a4-a50e7c201a19", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34970b29-8f05-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1785738794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785738794, "uuid": "172d3ba5-2af0-40ee-96ce-7ca443e57e2a", "comment": "Malware payload (ConnectWise)", "value": "04f3599d93df666242cfdceab5837512", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785738794, "uuid": "a3f4430b-0197-4f42-8aa8-cb3e295068f6", "comment": "Malware payload (ConnectWise)", "value": "fb7ad785490aa3c04b34d53cb4c7720584016fc35fd25c9f7ef3edc735d930d3", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785738794, "uuid": "6cb6fac3-c96e-4f25-8dde-74889b2f1486", "comment": "Malware payload (ConnectWise)", "value": "a99df53b8cfe499d2d030ba9946476dbddd5100a", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785738794, "uuid": "0a2a8fce-913e-4a6e-89b7-3b988cc655a3", "comment": "Malware payload (ConnectWise)", "value": "da1428af58b77d7c2b5f5d7d7faa811c294abd57f97526ecdcd2581ba2e020cbab43814bd340fb63a32687bba29f94b6", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785738794, "uuid": "cf16e6ac-a20e-4669-a81f-93dba2d6544f", "value": "T1E546F112B3D995B5C47F0638D87A42A99A74BD048712D7EF5394BE2D3D32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785738794, "uuid": "efe5e3aa-c6d7-4f5a-8a4d-bab8aae888ec", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785738794, "uuid": "324a8228-6c46-48c3-8ffb-e37fb553c3b9", "value": "49152:CEEL5cx5xTkYJkGYYpT0+TFiH7efP8Q1yJJ4ZD1F5z97oL1YbGQ+okRPGHpRPqMO:/Es6efPNwJ4t1h0cG5FGJRPxow8Op", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785738794, "uuid": "ee77d600-6adc-48b0-9c73-93611ef8cdba", "value": 5668432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785738794, "uuid": "7dff9eee-22e6-4a75-95a4-a056076072c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785738794, "uuid": "4d27fa9c-c0a4-4867-80b7-66967169ed2b", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e74351bf-8eeb-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785727927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785727927, "uuid": "98ae102f-b298-45e5-a8a0-be74138fbd39", "comment": "Malware payload", "value": "6fc570b518436ff8daf43a4a429c3470", "object_relation": "md5", "Tag": [ { "name": "424e51f31d68f573a4621aaede8044aa", "colour": "#51F4DD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785727927, "uuid": "4a1cd0e9-8a72-4d6c-b611-df4e983e97d4", "comment": "Malware payload", "value": "fc029c04afaa0cff7e8baab3a7c7688d00d6d1b9157390071ea3399f1c53b2a6", "object_relation": "sha256", "Tag": [ { "name": "424e51f31d68f573a4621aaede8044aa", "colour": "#51F4DD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785727927, "uuid": "3ab2ef3c-cd75-4a08-9139-89bb7eea317d", "comment": "Malware payload", "value": "fd249494617a367b641da71a704b117629d4dcf8", "object_relation": "sha1", "Tag": [ { "name": "424e51f31d68f573a4621aaede8044aa", "colour": "#51F4DD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785727927, "uuid": "647187dd-6426-4169-a3d2-76b481af2692", "comment": "Malware payload", "value": "868c8300b191987c03ee27d005c1c5acfce9e0c78f89bd98d1017bc1f63a247ca05cba3dc6d905cc8e334f8332e24498", "object_relation": "sha3-384", "Tag": [ { "name": "424e51f31d68f573a4621aaede8044aa", "colour": "#51F4DD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785727927, "uuid": "ce498ce7-e2e3-41f3-8687-a3de0ea5b0bc", "value": "T13DD5229939FA1EB0C43AD7F68F92E06EB05A7B9183709E9772CD68109E6315C1C353B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785727927, "uuid": "305702cc-6a1a-4b2a-8739-97d2be568aee", "value": "44140cbbe125df54636c585913f74c75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785727927, "uuid": "b06c969d-b14b-4592-9e48-8cb72fe6a9c6", "value": "49152:EigDgFAnnlN3hyHuVis1tm729RItA4QwQgAtUHHLV37EqHpnoSuMRuZlceAJyOS2:WDnlphWuVPtm74RItbVQSxAqHpnbuGB2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785727927, "uuid": "c257c65f-505d-442e-bd75-d4781cb32fe1", "value": 2942976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785727927, "uuid": "5964a85d-a3a2-4257-9e12-4aa193fca9b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785727927, "uuid": "ff2a5fb2-9598-4895-94c8-065aa3de1e0e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eddf0f5-8f05-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1785738892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785738892, "uuid": "3c751614-1e90-4b78-958c-ffdabb3bea44", "comment": "Malware payload (ConnectWise)", "value": "6060527a473e24f42609c81d07dad6ef", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785738892, "uuid": "a32adf34-ee49-484d-b6e5-abee0cdd6815", "comment": "Malware payload (ConnectWise)", "value": "fe6ebf2a07ff4f970e06333d60ebaaf3e4968d9d1a5c56a2fc7bf37abba17c20", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785738892, "uuid": "9552fc47-8799-4216-a8c8-958260a4e537", "comment": "Malware payload (ConnectWise)", "value": "667f336c5cfa26431699daed0129589937c52b9f", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785738892, "uuid": "d3258c89-3ffd-453a-a16c-8e5e998313ec", "comment": "Malware payload (ConnectWise)", "value": "bab9ec432d59847eecfa751d5e6cb0e8dba84b9e601a9eda0fa0b13b52eee9c796d4140fbae12301bb8102ca5c61cb12", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785738892, "uuid": "05e3ee51-e9e5-444c-80a5-0a2966a5330c", "value": "T17B646C11B9C48432C673383147B4E2B28DBDB8301D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785738892, "uuid": "ef7edcaf-7cfb-4024-acda-57cf89486312", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785738892, "uuid": "920582f9-d3f9-46de-8dbe-90be8c0e9a52", "value": "6144:KmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:51iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785738892, "uuid": "41bc9cdc-143a-4626-97d2-33a1f7e4a841", "value": 312552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785738892, "uuid": "a7b9cd34-d034-4767-b15a-04e2f2af5e0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785738892, "uuid": "60f262b8-1a77-4238-9758-30696266ea66", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a88f3dd-8eef-11f1-bd95-42010a9c0009", "comment": "Malware payload (Joker)", "timestamp": 1785729489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785729489, "uuid": "2bc036dc-4582-499f-94e8-0536958e94a9", "comment": "Malware payload (Joker)", "value": "11b56316b8c79adec9701856c22f1497", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785729489, "uuid": "fa24cbc5-b825-459d-8a9b-8b2bf12a5468", "comment": "Malware payload (Joker)", "value": "fecb8fedf9ff14958a45077626ace3d82347ac5207c7c123aa4e19c355e28ebc", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785729489, "uuid": "5b774677-d5d7-4af7-b699-eb8f74d72439", "comment": "Malware payload (Joker)", "value": "e5b49bd3e6e945c744878d574caf0e928febb057", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785729489, "uuid": "f8ab947e-1733-48fe-b8dc-e23c0118713d", "comment": "Malware payload (Joker)", "value": "79389e9f1dd973cb63cbdf126ddadc23b7a4ede2d41cc7dd8cbacf1bf3693fa7049874d937eedb5a12495e813d724c7d", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785729489, "uuid": "c400c016-d2a9-45f4-b9a9-337020c077a6", "value": "T141271242EF5D202FD9E662792D3402232D671221B7C2F7EBAA10513D695B2E3CF55BE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785729489, "uuid": "9da82e10-f5b0-409b-8119-b0bd5f9a14fd", "value": "393216:vJAsYEgLsWtEbn6uRN4KuII7wPEKKha5mhK1FgRqygsILHT2:v5YEgYWCbn60qIhWhNhoFgWNHT2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785729489, "uuid": "094e944d-2619-4987-b2e4-db3f887ca9b0", "value": 21659764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785729489, "uuid": "177b9158-430c-4226-aa8b-6460dc5e8068", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785729489, "uuid": "5404b302-1888-46b3-9c35-a2b804c65adc", "value": "File+Cleaner+Pro_1.0.8.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }