{ "Event": { "published": true, "date": "2026-04-12", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-04-12", "timestamp": 1776038582, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "ed01c07c-436b-4961-9995-84266f5e0440", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "931aa89a-366f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775998826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998826, "uuid": "73c7c2d9-a286-4997-ba13-4f234ed23ce2", "comment": "Malware payload (Mirai)", "value": "526c57764f3479beca31f93466c29cbd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998826, "uuid": "5c1d5643-b6ab-45d4-985d-6ad19a72de1d", "comment": "Malware payload (Mirai)", "value": "012904ad4a930748947553f9aec5d73de1035ac93b9dc8cb38df7946190c1022", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998826, "uuid": "d054a4cd-fcba-461d-830e-a4166e04d7f1", "comment": "Malware payload (Mirai)", "value": "6d98ae63800b446006fdabd6bc94151c6d5e3e52", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998826, "uuid": "00b601e5-202a-4981-bbef-f61cbb9d4b0f", "comment": "Malware payload (Mirai)", "value": "e3b02745c5010eeb915472e5d5cf374aceec2de13b446773af55b352092d9bfed49cb6d2465dcb844b159ab5d6f43dd2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998826, "uuid": "48fb161f-6cb3-4793-844b-9a0c7f42201d", "value": "T159544C87F900CE7AFC0BA37749574905B530FB7608520A76B216BD9B9A3A1C61533F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998826, "uuid": "bf0e5d70-686a-40ad-9ab9-5e42f6ef3dce", "value": "6144:5loyN2ax14gJHZxbc2azSdOXwAyiIhEzr2zbbcs+Luw3Fv:XtjJa/gRbk3Fv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775998826, "uuid": "7b2eff10-db29-49bf-9ada-8dcd9ccc8aa3", "value": 280208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775998826, "uuid": "c6f635b6-f78f-467d-90be-1c8d01120b6c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998826, "uuid": "2a128753-d342-4259-ba4b-485cefbc794b", "value": "redis-scand", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcefba66-3655-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1775987783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775987783, "uuid": "e204500c-6c73-46b2-8774-0e81ee50e2c8", "comment": "Malware payload (CoinMiner)", "value": "462f8edfe45ec7199c5e440720ad9f09", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775987783, "uuid": "7c80a9ba-6181-4c9b-aa16-5da2f02b7a38", "comment": "Malware payload (CoinMiner)", "value": "025d683b3ebcfc6ffd60c825d2ea6b94f337e9af9c2ba0d6cbc59277246bbe05", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775987783, "uuid": "3ed80de4-dbfe-4aaa-bf61-4e9019a0c366", "comment": "Malware payload (CoinMiner)", "value": "86e9eaf373b250f552f985a466fcf23ce473ec4e", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775987783, "uuid": "2cf250c7-1cb6-4bf0-915c-05db3922ed83", "comment": "Malware payload (CoinMiner)", "value": "0229cd2a47687573cf04a514b1e0ac7bb8a249326d81753444cbca53f5c2acae1eb4aea726a30112a5d8f557f73ca962", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775987783, "uuid": "bd728ffa-d379-4da8-a6d4-c78b18f5de19", "value": "T1F213E9E5FCA9D93031355638BACDD401FB670A37055A3104719EAC187F3C799E1AAE2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775987783, "uuid": "d4ce045e-6cca-4176-a962-1c915f8825a7", "value": "384:waRKQ0VXvoQ2itS7s3RWA0m+EwvE4qN0MH8ns1irDy07Srgb6zakqpxYAVAD:waMQoio334qf8ns10DCx9Ky", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775987783, "uuid": "0eca2f99-5ee4-487a-94dc-31355ad52d31", "value": 45306, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775987783, "uuid": "2c4faddb-e36c-41df-af6e-2c539267f478", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775987783, "uuid": "a9d4eda2-ea72-4def-8e79-9e41eecff8fb", "value": "ghost.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25bfc3b3-368f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776012386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776012386, "uuid": "1d553278-04cd-44fd-b92f-278ae4287ef1", "comment": "Malware payload (Mirai)", "value": "f4190e1e67836e8aae3cd21278ea5545", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776012386, "uuid": "afb76773-d698-42a6-a728-5f3377f58174", "comment": "Malware payload (Mirai)", "value": "0315833ce924f6d7cd071916a4f53d7dccc5f5926c046c4a08b2540848d94d6c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776012386, "uuid": "1889d61b-c84c-4126-9df9-c75ee4e42ed3", "comment": "Malware payload (Mirai)", "value": "ffb0afdd36cfb7f8527354f35c4ef52553eb48c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776012386, "uuid": "34456c7c-d0ac-4b0f-a156-9b8bf7e982dd", "comment": "Malware payload (Mirai)", "value": "1731afa24b3f80570399a293a3a48d07d9030d7f9a44d9cba1d9a1c7f08c8ae0a8c3f22c7b770605455882158158cbbd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776012386, "uuid": "b0ff05f3-a8eb-4616-8226-b48761991c93", "value": "T1C0C3E809EF610EFBE86FCD3746E90B4125CC551722A83F7A3574D828F64A64B4AE3970", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776012386, "uuid": "b64cd86f-2ac3-496b-b904-ec2b30f82eeb", "value": "1536:Po1cGwHDero50U7+UuQUbbbiZE80zbmTd31MkJt9o+04tCZnJ/WXApoST6yLbifZ:Po1cGwHWo/uQUmvo+ntCfRzbA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776012386, "uuid": "c2eff8e5-d946-49b9-a1d2-d27bb1648011", "value": 118636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776012386, "uuid": "d7805066-1ac0-4899-add9-77d120276e30", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776012386, "uuid": "1d2e1879-c815-42f9-a3ad-77d2f2cffe8e", "value": "titanjr.mipsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06f11a57-368b-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1776010617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776010617, "uuid": "7d17130c-8361-4525-8dc9-944038724f52", "comment": "Malware payload (QuasarRAT)", "value": "04353bcb1346fc94dcda474aa33a8636", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776010617, "uuid": "d53652a9-d1a6-4db9-b7c1-4fa761bad4c3", "comment": "Malware payload (QuasarRAT)", "value": "047e637b1a13399fcd898b76dffa736e9644b041f35bf390c1c6cf302e6381eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776010617, "uuid": "774de43e-ff8f-4a3b-b9b4-f75331c2b96b", "comment": "Malware payload (QuasarRAT)", "value": "86a6b51f367a8d6db3e3a3363088f1a533018196", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776010617, "uuid": "72ad40ad-fb79-4565-98d8-378d8af92c8c", "comment": "Malware payload (QuasarRAT)", "value": "1a32a69fa182cabefdf00bf0e8ab8691ee5f3f7305aed1b33f5266845522439836d9296d3a187e48969ff2fec8e22b6f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776010617, "uuid": "682cf844-a179-45ca-9b53-5d92a75ee593", "value": "T128E56C1577F86E23E16EE2B2D2B1041267F0F81EB3A3EB2B224257786C53B505C517A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776010617, "uuid": "fef8bbf4-373e-49c1-af19-d4a93db8216c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776010617, "uuid": "1958b4cf-5fa4-4af8-8801-f2b8cc1e10de", "value": "49152:7yhJJHPNCC7J98vBgJh99oG4znXy+xUuxGATHHB72eh2NT:7yhrHPh7J98vGJh99tyx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776010617, "uuid": "ca8d8d53-7ff3-403f-823e-d6c6d7dfa76b", "value": 3299328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776010617, "uuid": "e5720fb5-2364-4700-9e76-ee62f5655f21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776010617, "uuid": "358b7149-98cd-4f4a-8cd7-ccf56bcc5685", "value": "messenger_update.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bc16f5a-368f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776012396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776012396, "uuid": "ba31ac58-beb9-4b85-b655-a32de1321b42", "comment": "Malware payload (Mirai)", "value": "d9a0062c05aece575c8f3cb0d2548e82", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776012396, "uuid": "152bdb1a-62cb-4c5a-b11b-047adbba25b0", "comment": "Malware payload (Mirai)", "value": "04aae7f7a58081b162d8c57e91bdfd2fb83068101623b8f65a092374dd2d5158", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776012396, "uuid": "b41356ce-0d58-4747-81bc-ea7f42a35fc7", "comment": "Malware payload (Mirai)", "value": "a5393dcfdc4bfd6b011e8cfb78a998098ce8bb62", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776012396, "uuid": "0ba33029-98d6-4a43-b6fb-1543cf9f9312", "comment": "Malware payload (Mirai)", "value": "467f8c588a77af5539e5b91473778c38ce78bcfba779751a52da9f4a37bb3555d80392a0483359d75df2adcc9dc78cda", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776012396, "uuid": "ac85c241-c250-4ad1-be5e-04d7e12445a9", "value": "T1C883AD23C83A1D68D8444AF0B4A18F759723E115C1976EF7995AC63AD083EDCF98A3F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776012396, "uuid": "c2aeb367-d4cf-454d-834b-578ecd2c5172", "value": "1536:ZCmLxY87JpRcGX/FpcKv87nOUvWNCGQd04DyT1:ZrLxdRRPFpDvMvWNyG/1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776012396, "uuid": "eda8cd0c-3d83-4e8c-b4ed-c7185cb7f194", "value": 83808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776012396, "uuid": "2e6daca1-8ddc-4f24-a1e5-c91bed83471b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776012396, "uuid": "9b35e879-fa3c-47a9-b994-bd482ac6fbc9", "value": "titanjr.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbbf4af4-36c5-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1776035938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776035938, "uuid": "764f52de-2428-4688-9f1f-74f1d6b3f0e6", "comment": "Malware payload (Smoke Loader)", "value": "cccd03f2ec24e57f6d1bf59989241ff8", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB3.file", "colour": "#87A90D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776035938, "uuid": "5480606f-d250-4adb-8bfc-76643e437951", "comment": "Malware payload (Smoke Loader)", "value": "06a8b84fdfddca6a3d73c00c4e964239bb77c87ca811111d7d65373019e12471", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB3.file", "colour": "#87A90D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776035938, "uuid": "1a57c2a8-5a1e-44d2-986e-ee7eaa6ccd3a", "comment": "Malware payload (Smoke Loader)", "value": "b7c4350497b7f92fd0533b0566e59455531b0978", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB3.file", "colour": "#87A90D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776035938, "uuid": "e20e57dc-cb19-4526-85ab-9cad880204fd", "comment": "Malware payload (Smoke Loader)", "value": "3277e83a07d840937b3920900133955a67a5f2e873dd3b3f1698e1dba7a04877442eadef714bfa897422ca7132b6c4ae", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB3.file", "colour": "#87A90D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776035938, "uuid": "ba8103b6-3291-4216-8d39-c7d694bfe341", "value": "T1F4854A1ABCD404FAD09A93328DB76692BB74BC490B3223C72E50B6782FBA7D45D75704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776035938, "uuid": "0d6b5309-08ea-47af-a424-0ba59a3ab1d1", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776035938, "uuid": "f79e688e-04e1-452f-968b-20d2446db76e", "value": "24576:w2HGLFexT7a0184pH6Rc3FpzYVV3o5s41urtPvOZ:w2HIQxT7ac8nRc3FpEf3c1uYZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776035938, "uuid": "3d1bfbd4-306b-48f7-a4fa-cc7850ae713d", "value": 1704664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776035938, "uuid": "8f336d72-22ee-4a2b-b742-2cba69c0644f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776035938, "uuid": "681cf171-2b6b-4d36-a9ea-9edc83d36374", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "722bea2f-367a-11f1-a769-42010a9c0008", "comment": "Malware payload (Chaos)", "timestamp": 1776003495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776003495, "uuid": "064702ae-5e7e-4e4c-8d85-eeff4051c1bc", "comment": "Malware payload (Chaos)", "value": "4ab2019eb57240e39a2a2b622be2e63c", "object_relation": "md5", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776003495, "uuid": "69bea8aa-c300-4979-9396-8e1212ba6437", "comment": "Malware payload (Chaos)", "value": "06f6df0f5e37620beb9e3e24a8d0f7742e7d5db7d0f8c1bd4fc10a869443e4e4", "object_relation": "sha256", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776003495, "uuid": "6269d7cc-027c-4273-9d73-248e6a428349", "comment": "Malware payload (Chaos)", "value": "76b2afd07893f8002bcc5e9f2fb9fbf0f7a1569a", "object_relation": "sha1", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776003495, "uuid": "efb29ea4-7e31-451c-bbe2-d31faa6a3e59", "comment": "Malware payload (Chaos)", "value": "1a6c0f01fbf7eb80b4d679af07ebcc9a1ed439f00f5e358d7d1d22f8afe3ab9c7b0000d0b31c9581e75dd29df73cf943", "object_relation": "sha3-384", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776003495, "uuid": "9dade5af-eb21-4abe-8fd1-1f5f466cee45", "value": "T145B2E7487BF68A39F6FF9E7868B162415375B913DD1ED7490C8E014E0C33B8C8D91666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776003495, "uuid": "ada3a23c-988b-4fa1-b7a1-0180e536e8a7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776003495, "uuid": "0667a003-b619-4b38-b947-4b80da77b14a", "value": "384:QFYenjLLAAtKNE3c9Dp1OABmMFJOVp91AoJLOnxDGJ:rAtiEM9fOcc9ioJexDK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776003495, "uuid": "631c07a4-008f-42ea-84a4-b1a9ad3a6a39", "value": 25088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776003495, "uuid": "9182aabc-f09a-49a4-966e-f434d6ead7d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776003495, "uuid": "76a668b7-e7ef-4807-8ee6-3122521b565c", "value": "indf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "212537d2-36a3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776020968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020968, "uuid": "e9ce82fd-3f89-416d-b370-e9f3b011ed3e", "comment": "Malware payload (Mirai)", "value": "f479765fa58c8b9b7dc9f11f11ba0cf7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020968, "uuid": "ccdac8d5-c2b6-4455-a656-d13bd2768f70", "comment": "Malware payload (Mirai)", "value": "0706eaf03f6e7abbad6bc082f63b3fae58d26fe545dda231b478a804da0bc21b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020968, "uuid": "ba1d86d2-e21d-4c01-8956-08bd8c6e34cd", "comment": "Malware payload (Mirai)", "value": "593ee4c4161bc776e5bbf5a7689a16b57ed8acd0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020968, "uuid": "f7dde95a-a5bb-4c72-8bc8-5b1436753dc8", "comment": "Malware payload (Mirai)", "value": "9baf43ba5f1c8b9d6733f77d0610db07a53782652595064de8dafb714a96c07644fa52fe42f1495049b31d60860f18ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776020968, "uuid": "7b533324-73c9-40c0-a356-162f35fc353c", "value": "T198154A46FB1D4523C9531DF02A3F43D9F3207A4340F5962A374EAB572621E3AAAC7399", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776020968, "uuid": "94ed44ea-234f-40d1-9755-e1c6a602f64d", "value": "24576:VnZlvxrqSd/2sQ/aXtWWwNgzHQddMUMdz:VnZlvxrqSd/dQ/aXvygHpUMR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776020968, "uuid": "7607a5f2-c448-437c-a772-ab0d17418a53", "value": 923956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776020968, "uuid": "c8d21a55-d050-4481-97ba-a55fb70ca0c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776020968, "uuid": "e0a89f28-c80f-464c-b994-dfb4909fdf26", "value": "bot_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2efe70f1-368f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776012402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776012402, "uuid": "5392ece4-40b6-427f-a8d2-52d16613f162", "comment": "Malware payload (Mirai)", "value": "527b066c88508e47e366975a58823595", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776012402, "uuid": "9935db64-8e28-48e0-841b-5b47ca423da1", "comment": "Malware payload (Mirai)", "value": "09fa74046a27b0aa4bf4e6e2cae0588098ed64830f054da3272a7d73c16af429", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776012402, "uuid": "b00ce515-7768-4e7b-b589-b7399c8129b4", "comment": "Malware payload (Mirai)", "value": "cf3a6e959c4342aafb7048ffeb390c1205eb39a1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776012402, "uuid": "28f6a3d4-944a-4b0f-b977-286482338cff", "comment": "Malware payload (Mirai)", "value": "29ebd3ce3b2eed0e7938504889bf0cab864bd64bed40732a307dd7c9ee2c72f64b66c77a4e7208e9da52a58177605831", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776012402, "uuid": "999b4bda-61df-4643-8312-e9cd8e558374", "value": "T1B4934A13B9C480FCC449C07057AFA537D923B17E1239B29B67D4FA167E8DE112E6EA84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776012402, "uuid": "1d7efbc3-7212-465b-91dd-7ba751c1210e", "value": "1536:saxd8RlojwN/6eTX2IyEZTb6AJzi1e1ybsRUtI5uClmb8Lvwg:3sDojwNjTXByMf6Ak1e1ybsRf5uQmOog", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776012402, "uuid": "fbc96dca-3aaf-49a2-bd10-7dea3f60125e", "value": 88928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776012402, "uuid": "52f6e204-d35d-40a9-b142-69c4666bf26c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776012402, "uuid": "cd97dcbc-6069-4498-bddc-b170366f303f", "value": "titanjr.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6e5cf09-3688-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776009677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776009677, "uuid": "4917ef7b-1794-4840-94a9-65e24913d81e", "comment": "Malware payload", "value": "c5a0bf77c0aa322b48f4f36a030a31bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776009677, "uuid": "9d4cb301-7c3a-4026-ac32-8ded7f51f832", "comment": "Malware payload", "value": "0a60ccf29f89019b1eebbbb8ad9bf0302dba399a26a62449078dda919bbd247b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776009677, "uuid": "4858005b-80bb-48ab-a32e-3e5d02d4db43", "comment": "Malware payload", "value": "56e384b878105849ff4a51a2a8cbc12f4cbc1952", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776009677, "uuid": "182657a1-0bfd-41b3-8469-0c9b67197bc2", "comment": "Malware payload", "value": "1e0f0acaa92b44b510855af656f61a72f7f21b8fd53e25a99b5913c29e3e7b666c0c9a852e913a9cc6b68e2932ca469a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776009677, "uuid": "b100dbaf-7137-4fec-80e9-484e65cd23f9", "value": "T1F56423D467FB61A1EAB422784A35F530A027B78A320FCEA605D0AEE11DDD07C3566F47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776009677, "uuid": "cdc96b57-9adb-4a78-ab9f-b893abe1937c", "value": "9b760feffec4fca9c313889f9a05ee36", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776009677, "uuid": "60d9642c-4e99-4c1d-9af9-75efd5da4914", "value": "6144:NMZ552NpIxMIVZpzB5Es4bOkEOixOwwhS2vyJKHvN9ezyJXxB8YS/6Jz:NaMexMUpF4hixOwwh9yEVLJXi6x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776009677, "uuid": "cade280b-8323-435a-9b71-d7856f9d4528", "value": 311808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776009677, "uuid": "da6569de-2cb3-4d70-b472-063da42d5190", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776009677, "uuid": "93efa2c7-1372-4774-bd85-f8cced171b55", "value": "0a60ccf29f89019b1eebbbb8ad9bf0302dba399a26a62449078dda919bbd247b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1b6f3de-3680-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776006286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776006286, "uuid": "033954b2-82c0-42c3-a211-3f003f2832e5", "comment": "Malware payload", "value": "2d06465087a7826b7b5b9e4774345a85", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776006286, "uuid": "b6dd5177-a829-405d-9410-40db4b1379e3", "comment": "Malware payload", "value": "0ab7e57a2c44eac46da853a2bc29149d4a0474528a211d3ab57b72f5b2ac68dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776006286, "uuid": "b5e4d046-a368-4534-90ab-7499544aef0b", "comment": "Malware payload", "value": "3a397d81a3a1381b91dc6fbe7c32071c40efe1fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776006286, "uuid": "85511e77-4cfd-4277-b218-e83bdd3d23dd", "comment": "Malware payload", "value": "d1ba18e0b30507db5c2d80cfb1c05a8cb155fd05d8d3f6a1c24ceeab261662c2b251a7f9510965a4bdccd61ecd9433ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776006286, "uuid": "ec26125e-1ce8-4704-a1b2-8704080ec03d", "value": "T149D57D17FC9119E6C0AE9232896655967BB1BC451F3223C72E60B7B82F737E0AD39704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776006286, "uuid": "f64f8b25-60ff-4836-bb6d-015bc3c90f0d", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776006286, "uuid": "47d9c7fe-d934-40ec-bab6-5f146d5e819f", "value": "24576:wj01HqbP1ZJ0VnOLLesiPmrvGv34s6moUzkaPuU358PrImoF9lWSRI50ES7bcpEp:wjIKz1XYnWLRiPjvByUS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776006286, "uuid": "c9994d0c-fe80-4068-95a0-cfda516d3c14", "value": 2993152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776006286, "uuid": "e4897e76-f6be-4bb4-bf3a-bacafe46f432", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776006286, "uuid": "4b419b8e-a5a1-4483-9cc4-fad0ae7a5b7e", "value": "runfut.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "247382cc-367f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776005512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776005512, "uuid": "67a19b57-2789-4cb2-90c3-639499779811", "comment": "Malware payload", "value": "22ddd04f33dc2c264fc77d17f85c9c5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776005512, "uuid": "bd0cd06c-fb29-4367-8325-9c801cdec8be", "comment": "Malware payload", "value": "0ba0a0cc5e297571e4f21eb4c130f133defbb5743c2810047698ec080935114f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776005512, "uuid": "bfd7d64b-8ac4-432a-94ac-13f1593f1be6", "comment": "Malware payload", "value": "cdc3a43909968a6ae5f4a811a53fcf670d72982a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776005512, "uuid": "62881ee5-221a-45ff-8743-64456908f3bf", "comment": "Malware payload", "value": "fe33206698b4af063b3d28a8fce7c7a7917e386773f65833555c74eb6936621c8bc8afb956ce42b7f94ba7f33bad0dd6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776005512, "uuid": "19c8d945-09e9-4d69-99c3-9869cf8cfb45", "value": "T10364B704CA12443AF1D743FAC7FA0ABD7CF86B51238410C3E3D55CD6D95AAE176368AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776005512, "uuid": "6882886a-a83a-4561-a488-285dafef9eca", "value": "6144:3VEWtrSlk/eV9VepYW6nyGvDqx/+FQRVc:3urlk/ePWcDqeN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776005512, "uuid": "94b7cb44-74a1-4c34-a635-2351ce696cc4", "value": 326144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776005512, "uuid": "5111a66d-e447-43ad-95f9-33b1cf016c14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776005512, "uuid": "d3a1cde0-e1de-4f55-9623-f7cbf06ef149", "value": "22ddd04f33dc2c264fc77d17f85c9c5a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "173ba18e-36a3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776020952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020952, "uuid": "82dc18da-1c54-4284-976c-53a19ecec218", "comment": "Malware payload (Mirai)", "value": "e6c4bc692e7a5bfb2c39f062ebd286d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020952, "uuid": "caf506d2-6b0f-4be9-84c1-18741ab68a36", "comment": "Malware payload (Mirai)", "value": "0baaba865e4b0dd71476f2014ad966cfe380cd8bd89ae7f41689775c55389fa5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020952, "uuid": "edf759c7-6286-403d-80e4-97e2d1649183", "comment": "Malware payload (Mirai)", "value": "fb98595c140a1a2696a7a3622bcc64a19634753b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020952, "uuid": "8d886b9e-4485-4955-a9c0-c818b7b804c6", "comment": "Malware payload (Mirai)", "value": "6dd81b6477330deb0ae0e9d2ebe3a0383afdfd689f4b9de1836fc8156912f781a35b9b44f1a060e3eb2fd4e46125d5a4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776020952, "uuid": "510150cf-dab0-4bdb-ac0e-09a766c47c59", "value": "T1E4A4D159F24B2F42C8D7D9352446C1458B56E96733F383497F8368BA383D2B68F28789", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776020952, "uuid": "6dd0de7e-099b-4f98-8479-0c8f5324774c", "value": "6144:tRX4DUccXxf1mjIohMcucn4q/sdwv0Vteuny4MDVQkeQHd9r8pbwRXv:L/XgIohn4qRv0eBxVQkeQ/8pbwRX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776020952, "uuid": "23f96730-6807-4fe0-a8fd-519b55ec9b2d", "value": 465600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776020952, "uuid": "de336ad5-dee3-4a72-844e-dbde7be9da2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776020952, "uuid": "6e025eee-11f8-4b57-8cb4-e5171a32a2d0", "value": "bot_armv7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18c5c73d-36c9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776037275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037275, "uuid": "7a011aff-631d-4370-a3c5-0269054b8c0b", "comment": "Malware payload (Mirai)", "value": "49feceeb1e5333ad90bcbff67126d19f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037275, "uuid": "b5a3d36a-2c29-4209-9475-053422717490", "comment": "Malware payload (Mirai)", "value": "0c4878ad823439ec0ed99e456fadcf54cfbd39f68cb5f9172a016e54911f94df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037275, "uuid": "a3d6362b-5455-4004-927a-3e220cc79d04", "comment": "Malware payload (Mirai)", "value": "85168a6b1d16f9c74ccaf1818a4f038ba692df24", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037275, "uuid": "938992ab-9e7d-4a52-ae57-84a6f1c33acb", "comment": "Malware payload (Mirai)", "value": "c59f76997ff4c814db07eb558e73f64ff9a85c3eadc9abc3583434ae518296123ae3e436ff2c429f7cc0c76c66dcd6f5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776037275, "uuid": "ab0ac653-15b2-4442-adfa-4e2fc892822a", "value": "T1BE934AC4FE8BC1F2D41B843050A6FA3FDA31D9E95161C65DEF5A9F36DA33581A202389", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776037275, "uuid": "fd8dd8fe-2475-4693-b429-328c61359399", "value": "1536:rPo3NKMUnAY90NrrInRUZc/2e1JWXSpXWFr5I4LQNu7XLROV:03RUAO0dInSW/2RCpXWF1IYvRk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776037275, "uuid": "dbc88c68-484d-4179-b52e-93f98fcfce9c", "value": 91412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776037275, "uuid": "270e196c-3d2d-4766-94d2-14c2965d26eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776037275, "uuid": "580fe77c-10b9-440f-9760-2d9a95dfb6d8", "value": "Hammz.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2ffd6cb-36c8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776037185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037185, "uuid": "d4ffd8b7-7982-41bb-9533-8135fbae3dc0", "comment": "Malware payload (Mirai)", "value": "31e3097ac4dca3cc383491ba9baed302", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037185, "uuid": "68633b5a-cc23-4bec-ae52-9f64c649184b", "comment": "Malware payload (Mirai)", "value": "0ca885e27697e5df7a40f7cc2dc6163d88d377db953b2680039dc573656251f0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037185, "uuid": "eb1a1b25-d5e3-4a43-9783-fd10ffe391e5", "comment": "Malware payload (Mirai)", "value": "753449271108e0d4c5ebc010892caa094718b429", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037185, "uuid": "cd9594e7-ade1-4658-ad29-2027bf18513a", "comment": "Malware payload (Mirai)", "value": "f267bfb31483f7ffb6d06f93db847e279eba641ba130d8e0a9e3c9c468ae374f429161dc317ad152a67198d2842e06c8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776037185, "uuid": "576faafb-b77f-4022-a79c-8e9d59b8877e", "value": "T1DF03F115FE8E6E4FCAA7ADF48B63C8C697B27EC163534FE3D6A91B090025261501CEC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776037185, "uuid": "76aab723-eb19-4f3d-b8f3-30eb45425fe3", "value": "768:lXwCW9bsSzMzopf+PZD6FC2L43X1GOTV0Rf1dLFM4uVcqgw091:l5MC8tt43Xw6VSh+4u+qgw091", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776037185, "uuid": "35458d6f-ae06-4acd-8633-e61e0fa6663f", "value": 40572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776037185, "uuid": "a93fcfca-578b-4182-9ae3-2952827bb199", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776037185, "uuid": "c1224527-086b-403e-adcc-6d22e5775a0b", "value": "Hammz.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a819694e-36ab-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776024631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776024631, "uuid": "df54c0c9-bf57-4155-b87d-6d3c38c08990", "comment": "Malware payload", "value": "7b21bf5ac61d6e8463dd709511a7e888", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sb[sd]", "colour": "#989195", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776024631, "uuid": "d93929fd-92c1-485c-9999-d90f7c49c427", "comment": "Malware payload", "value": "0d9e6c88ea00a3eb737ac99c7da52b413d2d7cfdd890f3075d17dfe0b327d0e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sb[sd]", "colour": "#989195", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776024631, "uuid": "aa71e0b9-b038-4b99-93cb-25cb912cbee9", "comment": "Malware payload", "value": "7819a466bd2b240d98e897f8377dfa3f2313e990", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sb[sd]", "colour": "#989195", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776024631, "uuid": "f9ee4fa1-837b-4054-95d9-c0a5629fa2ff", "comment": "Malware payload", "value": "ee10e6c357256f12755dbbc3c0718dd58aa197cb20dbe5765da85927c6749d80190200a97b5976ff71c1790b8c15e871", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sb[sd]", "colour": "#989195", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776024631, "uuid": "74892144-2d10-48ee-873e-4716e68bf268", "value": "T157549D45F3A948F9E9B6C27ECCA20912E6727C114374DBDB07A066565F337D0AC3AB12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776024631, "uuid": "f63aed30-98f1-4317-bad6-2688b35bb248", "value": "668bc7640f4bff4dbced3f03b53a7419", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776024631, "uuid": "5f3cf298-793c-43a0-8127-874a44276191", "value": "6144:4h/wkhJUmnf0eDzuk+OUjq+j36pXRT9n0du:4h4iJ38eD0LRgXn0du", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776024631, "uuid": "85d6d4d9-96a8-463b-b426-ce9f82fc3ba8", "value": 301056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776024631, "uuid": "0e39995b-1424-486e-a99d-e4ca08131226", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776024631, "uuid": "f8f7f70a-ac6b-4c04-a228-48a5d8dd9e6b", "value": "VolumeController.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7133214d-3690-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776012942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776012942, "uuid": "1bad0a39-e52f-4b06-bac0-6f511c450375", "comment": "Malware payload", "value": "82f6881316a9f7faea2b8611278f10c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776012942, "uuid": "04ba533e-5081-47c9-a1ff-464a0c370635", "comment": "Malware payload", "value": "0e9c8e5ce94641e0b07607647a55c162adb18048f9c1e1e3dbe859cd08b2a797", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776012942, "uuid": "d7f10598-0a3c-4d68-95ec-ca6a92545e70", "comment": "Malware payload", "value": "2acb01f5a82fe6736e048bb71d11f94a477362de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776012942, "uuid": "27a884ac-4085-4862-b336-b3b324cf3b14", "comment": "Malware payload", "value": "c2a11d51b650677b7e39ca28be50c023fff777482f445d6c98bd438aaaf13e0c402c6d425a54a0a381928b052941d2ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776012942, "uuid": "666997d9-d148-4921-a300-ecf2eb44d4dc", "value": "T188D47D5676E443D9D23EAAF9C827470BC2B0F00147F1EE2A15E745891F8797A722F34A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776012942, "uuid": "75ffa2f8-f145-4d29-a6c1-53e6e2ecd0b7", "value": "e316e08fcdf7bc1838bc40772f99c8dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776012942, "uuid": "4e2aad87-3cd7-4acb-a824-7124c06a15ba", "value": "12288:3SZT+YO4G3fXlsFqlYW+RRHoR0J2D8/OeLZUXZL:3Sc7e8ShzHof8/t0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776012942, "uuid": "e8a0f7ac-5854-47a5-bdd4-4abcb62f7703", "value": 634368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776012942, "uuid": "fbf7fd4b-50b0-4d6b-9976-e990fa30069d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776012942, "uuid": "3c75bb37-981b-4885-ba39-54f2fedf68a1", "value": "0e9c8e5ce94641e0b07607647a55c162adb18048f9c1e1e3dbe859cd08b2a797.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8918d96-366d-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1775998030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998030, "uuid": "920e03de-0352-42f2-a062-c931d3acc951", "comment": "Malware payload (Gafgyt)", "value": "541b5922132c373aeff9f9eb485c88b0", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998030, "uuid": "4561cf61-99a4-4daf-812d-2c934d0c87ca", "comment": "Malware payload (Gafgyt)", "value": "0f8286217385fad3eb7f004cc7d76b1b588720e64f526a4c81d747dd4f9ca396", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998030, "uuid": "3b112078-8f8f-4baf-a5ce-d1e1c1381675", "comment": "Malware payload (Gafgyt)", "value": "d605a20c4f036c38b0730ae7a05c2f95032d0c55", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998030, "uuid": "6e430807-0dfa-4d10-a4e0-5a5f28355254", "comment": "Malware payload (Gafgyt)", "value": "c3fc23674c624ac551899ffb8df9a822ac35bdb64ee46be2c2f14816b1961c6f502568a9e779b996226077ecbaa67702", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998030, "uuid": "adff6387-d808-4d23-a098-e4432d7616d5", "value": "T190348DB3DD21AE96C22395F0B1F1CF380F52BD2989431E99A576DAF54183EC9B1053B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998030, "uuid": "224e9e9b-467d-4e2d-b35b-1eac9ca27ab1", "value": "3072:fTsr8t2g1fG5+XAOgJDmedfzINBhY26Q44JzOG3paQQ1hqgD2uWqkK8Zct5yy0rN:7f/gldfzINE2544JzOG3pgfa7JKNY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775998030, "uuid": "e2cf4595-42d0-445b-8654-1f8356b0f01f", "value": 233680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775998030, "uuid": "55b6eebc-67b4-4417-b5d9-1a80919ed177", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998030, "uuid": "3772ed71-85ff-41e8-95b3-b19a361143cc", "value": "redis-sbomd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5b2a389-36af-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776026479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776026479, "uuid": "9b8bb4d5-3572-4e3a-9e2a-5e357a5f9317", "comment": "Malware payload (Mirai)", "value": "44c547a80ad5dbf986a0facf240fb359", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776026479, "uuid": "5603d3e8-309e-47a6-a971-5796638e7356", "comment": "Malware payload (Mirai)", "value": "0fdc80f795f77d395072d7fa5b6cda4753d552ab4d0a366317ac2be060a09417", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776026479, "uuid": "37e938d3-7115-4115-a94b-b9ec0f55e264", "comment": "Malware payload (Mirai)", "value": "8d537396a2db0139c36113cbc250e5a6fb329dac", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776026479, "uuid": "80be7e04-b1b0-44d2-98ea-eb7f1dcce7a2", "comment": "Malware payload (Mirai)", "value": "59804011494394fd1cda82f649861e058a1833c7fd17a0ec6ad32731b75c4cdc764e6896e5e541e8f864ba08a335d978", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776026479, "uuid": "009d4fc9-53da-490c-a65d-6e934c43f28b", "value": "T190B56C43E683C4F1DA560AF0125BFB7B8D3699164121C963DB98F929BD72312E70A33D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776026479, "uuid": "3f28d68f-34a6-4acf-93d0-caa44bc19934", "value": "24576:x5+HY96zsFHiAXXI6hnM/v3mZmAQDuV1MLiChJie40Z9X1yngq0i/Tcc8JUQ7eSR:cEFcvimAQv540U94f7UcsSMXp1kVgO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776026479, "uuid": "de9349df-c5da-4a02-b9ab-8e26780cdedc", "value": 2411672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776026479, "uuid": "4b7ae24e-6b24-4692-9564-8a54bb517ab8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776026479, "uuid": "0f26ebae-8998-47ab-86fd-a03d3a09f085", "value": "ciubuc_i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28ab12e5-368f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776012391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776012391, "uuid": "dfe533c4-429c-4791-bcdf-3625fd528764", "comment": "Malware payload (Mirai)", "value": "17b0f133466124fd63c6ae9f5a7a8a22", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776012391, "uuid": "29cc9a51-dab0-4181-b947-a8dbbc8b0fe2", "comment": "Malware payload (Mirai)", "value": "103411e6d66653aa088a4f64769c9adee9a9405ac018737acc3aa79139089b13", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776012391, "uuid": "7acb91c5-0dd8-45d5-81cd-d3d90f9f041a", "comment": "Malware payload (Mirai)", "value": "cf40b85815d849e6198ac80a9982ced9cf8eaf8d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776012391, "uuid": "ebc03a6c-cdc5-46c3-9f94-7dbbde5aac33", "comment": "Malware payload (Mirai)", "value": "ca6db7eda3a0eacd87c22f39cf5730c2461c74f53bb12bd45bf0ba96d3d8bcf246147213270b98d87e57a4438e25995d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776012391, "uuid": "adc06cf8-aedf-4c53-ab31-40c894387759", "value": "T14D935D52B70C0A43E1574DF02A3F17E1C3AB66E120F8FA897A0EDA4596B2D325547ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776012391, "uuid": "c101c229-2f5f-4dae-b07f-e3089bc0ffff", "value": "1536:rhhqGE7L5Xu89Xkl7QYcks/pc8owNEerOaKOnu1//45eMv091Wrz58KUoO4Fp:fVevNrrOjOn5eMCWrRXp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776012391, "uuid": "64e37786-fdc8-428d-8aba-3716e43d890b", "value": 92044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776012391, "uuid": "09bf9ceb-9be8-4408-8b64-310e5525d500", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776012391, "uuid": "53c35d4a-678b-4a0e-b838-de6e9976f839", "value": "titanjr.ppc440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e943244f-3665-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775994675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775994675, "uuid": "b1eac894-9979-468b-ac87-b48d61216d5b", "comment": "Malware payload (Mirai)", "value": "25d3b7cb507311dc747654f8660c5f79", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775994675, "uuid": "b9d04989-8b36-4a36-a622-78bddbffce3e", "comment": "Malware payload (Mirai)", "value": "1104f9fe83821e3e549c3cdd10df27018a65c70a308085bcc41f6dc02795752f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775994675, "uuid": "4f619a4a-376e-47ee-afad-45e98153ddf4", "comment": "Malware payload (Mirai)", "value": "9d07d447d80effa1013c74b1f4946aa8b7b4fa8e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775994675, "uuid": "174d59f8-bb08-4844-8e41-447e6d7fdbb3", "comment": "Malware payload (Mirai)", "value": "83273cacbbf3b6f51b9b76fe3080eb0dacd83514777d1ee17996e46521cb3d1a5f0e4c84160bfc88e6a6d2eac190a7a4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775994675, "uuid": "00dcfb0b-cbce-4f3d-9846-3af3074cbb95", "value": "T177B55B41FC51AA56C6E066BAFB7E828C33272BB9C3EE30174D044B74779A95A0E3F541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775994675, "uuid": "89e5d315-401a-4f29-aed3-ae7b44363c5f", "value": "24576:NdRGJSoDsTY37dvOu59xFuFECu2IBpDkwrJO9RSqOSPFuRoT2A8Gqo+pWvPlevL:NdE3cuLx1HpV6OwFZr+pWvPle", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775994675, "uuid": "d96d5a3b-e93c-47aa-913c-fe1e4718260a", "value": 2487484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775994675, "uuid": "a6e62d6f-29f2-4d54-94cd-70db102f7ea7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775994675, "uuid": "c37b1882-8a5d-4fa7-9e39-8cf94c42f694", "value": "ciubuc_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9da7db16-3695-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776015164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776015164, "uuid": "82352009-ee73-4dfd-a605-21b9b9fc3129", "comment": "Malware payload", "value": "022f77e0696fb572a5cb4677f637871f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776015164, "uuid": "48302bec-a217-4c79-b079-55432cd60c70", "comment": "Malware payload", "value": "11b94f552d6655a2b013f8efb5375fe7e4a0556e94f2c5ba6c0982656bb69709", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776015164, "uuid": "8a648924-6e62-4683-b3ff-6100cd627a0c", "comment": "Malware payload", "value": "9f8c7fed1e8d9d81a7ded10645796869cac3c2d2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776015164, "uuid": "98e35369-8bc1-405f-9d41-4d51e6b783c3", "comment": "Malware payload", "value": "1ce91349cb7a06c9f226f6dac8593be8c3c7f43a6409be50986adbd1cca335fec244225977d82e7acc8c56db9bd67842", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776015164, "uuid": "a7cfe387-4b59-4ed5-b9d7-db6e9cfc5eb2", "value": "T183621B16936CC66BCA9D1A74B4A0431303F5E3057D03DF9BDE8874D67D273663101BAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776015164, "uuid": "a26b5590-bdb9-4db6-a481-029f19c5673a", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776015164, "uuid": "f0e053b1-0843-44fb-b11a-e9c5f39189a6", "value": "384:mp+rQE0PhFbMFxho69sNb+EPKPRi8nD1GaABsZ:F0PhFIeoslP1CwaABsZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776015164, "uuid": "9dd45311-a96c-44e6-8374-ff575499d691", "value": 15360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776015164, "uuid": "41cbda0d-dfd5-42a7-9200-ed71532d508f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776015164, "uuid": "5e5b47c6-3708-45fb-ae97-34ec50a50f23", "value": "Loader.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecc5bd28-365f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775992104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775992104, "uuid": "4e59c721-e4d9-4e69-ac3f-fd44cfb6dfc7", "comment": "Malware payload (Mirai)", "value": "35c4f4047df3e58deb0203e34f4690c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775992104, "uuid": "5cd604ab-ee06-49ef-a5a1-e532830aa739", "comment": "Malware payload (Mirai)", "value": "120464e5b3d87a25ca0bbbb11f44017a8cbb907e00f739be3b56eed7eed9fe00", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775992104, "uuid": "85d5366c-928b-442c-b771-1f09ff49e74b", "comment": "Malware payload (Mirai)", "value": "8d169fb2a37b5995a6dc7b7c95ae3fd4c2a85f2b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775992104, "uuid": "0b73282e-cca6-4154-b3f0-4905313864a9", "comment": "Malware payload (Mirai)", "value": "5668a11471f41869c97eb562b2efb9b8b1234ebbbc0741ddc6c374f0255cbc158d5186c64b55be451b0aef92e0dd5153", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775992104, "uuid": "0701b559-f812-4a5a-936a-7c16f3a18fdc", "value": "T11C939D12CDB46DA8F07A6D7010B9DABB4717F509990B6DFB3D4282211007AD8F5AABB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775992104, "uuid": "760c8213-3212-40b1-b40b-a027eab76e5d", "value": "1536:2Nq4dLLCEQ+DLeydo/jmhynSPeQOIk/cPFudX+hO7yr0mCnkiesZnCb+R:2NqiL0+DLesoKKSPfOIKHOr0miW+nC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775992104, "uuid": "d2112b72-facc-4207-8eb5-0baba74c3141", "value": 95624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775992104, "uuid": "b17d803b-2bda-4f19-ac31-682dd3f342c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775992104, "uuid": "b5083b5e-49cd-422e-a43c-ee4557067cfd", "value": "splsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "091b1c5e-36c9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776037249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037249, "uuid": "76df900a-b262-4e50-836d-1a14541ad06e", "comment": "Malware payload (Mirai)", "value": "3cf8f8085a360315d16abf40dbcc3eac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037249, "uuid": "49b370e0-9bb1-42a1-b298-04e80636f89b", "comment": "Malware payload (Mirai)", "value": "13e30bc82a69c24011da4937cdff3da7bedecb3c8d28cad788deeb844d9aa137", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037249, "uuid": "4f37786b-3d1b-40e0-ae3b-8942d2b03bae", "comment": "Malware payload (Mirai)", "value": "95746ecf6edbf745752d86fb45c594ed8f1f059f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037249, "uuid": "05a92d9c-49d4-4cdf-bc66-174075ba5cbd", "comment": "Malware payload (Mirai)", "value": "4ca1962057a9a0c3f5501e8958bfd9cdc1567639392deb15614ddc3b544f2e07557682d95717e446749dcc635cbb6d6d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776037249, "uuid": "40ccd244-b186-4654-b2ea-c358a5914c5d", "value": "T129C3C85E7E318F7CFB99823447F3AE25975923D627E1C685D1ACD6001E7028E281FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776037249, "uuid": "101449b5-1d0f-45d6-b12c-8ef1326e74d8", "value": "1536:hIsox/9sXMZHxGz8mqqCNRf4KS7703FbwIJWY/B/PsytkgSteuBZ0HxKNs3:LO/AUgAa43pwIJv/Psy2gS4RKNs3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776037249, "uuid": "b73cf5fc-5f4f-4ae2-9595-61f8c16c524e", "value": 122096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776037249, "uuid": "e0e0b044-4984-4bab-ae56-8eb967cd5862", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776037249, "uuid": "9fbe86c4-208b-4585-9c41-1b43d00fac0c", "value": "Hammz.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bae4b1b-365c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775990680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775990680, "uuid": "052ab32a-5ac0-4494-bbdc-c7697c15d78f", "comment": "Malware payload (Mirai)", "value": "cb74d8dba13b5b2897718aff28282d7c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775990680, "uuid": "2d0cb840-3e81-4f5f-9935-dd8233afedad", "comment": "Malware payload (Mirai)", "value": "162a98232dcb65340dfaf60fe3e4e83c08d7a548d961b57208937748ea1d2613", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775990680, "uuid": "9f015a81-9007-4ca2-ba2b-2fce4544ba42", "comment": "Malware payload (Mirai)", "value": "ce03f97a5f2f620491a1ff860aafe9a0ebf0d14c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775990680, "uuid": "853d96e5-0cdf-4880-84ac-30ea2de7c658", "comment": "Malware payload (Mirai)", "value": "cbddb37923caf5c4f065cf72f7b8366c80692e6e1e590fbbc92bf21197e779e350db066e0e298a829b2e14f869915315", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775990680, "uuid": "23f9ee77-21e4-4e8e-9dad-27d43c8851d0", "value": "T1D9533B87B801AE3DFC1BE6F940620A19BA217E3519730B57AB67FCC39D311E69D06E41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775990680, "uuid": "9e95d44a-b57a-43b4-8491-a70d137e46e4", "value": "768:MeT+6JhUvtNaEVGAXPgj2x9+iGCvYN1ul8yXLyCIlqXxXv2XWFtW:MInQvtNFGAXIjeWvNUl8yXx2qBvy0W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775990680, "uuid": "798582dd-1bee-46ec-b137-1c2508eaa7e0", "value": 63320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775990680, "uuid": "c47aafa8-5032-4d03-a8a7-9910286ffa0f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775990680, "uuid": "43cd96b7-88fa-4b44-b439-73cd2466d511", "value": "jew.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26ad3653-367f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776005516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776005516, "uuid": "18dd1708-784a-41aa-8a20-928322736463", "comment": "Malware payload", "value": "d239b89281bb63ec22e67c9be5cb18a9", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776005516, "uuid": "42ab29c9-89e3-4a6f-9509-f362a5559a21", "comment": "Malware payload", "value": "19991c70cfd516078fa6823c56ed080b6d3b138468247b0908ad48e039d70fa6", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776005516, "uuid": "c6a4d78e-c4c1-46d8-af8f-08b451ce2fa3", "comment": "Malware payload", "value": "d5c049fd0b8f8c8426af7d392fcd60bb5cc7353f", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776005516, "uuid": "c51a169c-58e4-4fff-b59a-33a442cb3903", "comment": "Malware payload", "value": "66f93d9fca10807cc81d7e8bda4351c49ed27f3ad41e98e430a67f873c14e024820db56313101d45390de4a857cf81ba", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776005516, "uuid": "ba7de25a-b998-4fd1-a0ee-8fc5117245bf", "value": "T18C2523157ACB1CBF53B0530A71EBD88BFFA44CC2491DE6DE85CF22829B9F2824A74445", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776005516, "uuid": "2161c6bd-6d3c-43db-a629-45d0f02d0be8", "value": "24576:Mp5NMWX3oYuo8m5UuNIyZHu9Rnowe/Y2sxmLitjspZe/R:4/XB8mKm36WWxmmx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776005516, "uuid": "8e1e18d7-435e-4669-88c4-b8ebbdc1dbd1", "value": 967902, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776005516, "uuid": "49eec203-aa31-4327-b9ce-6923dba9ac37", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776005516, "uuid": "74622813-8349-401c-9ea2-8f26f18caa17", "value": "AbnoxaCxx1Vsr3.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5dd0d33-366d-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1775998079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998079, "uuid": "3c791330-75c9-40b4-b132-209a9814e723", "comment": "Malware payload (Gafgyt)", "value": "303b92f60e618d5122ce5d81547e7434", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998079, "uuid": "82fdb5e4-98a5-4add-8c5e-a5d47197413b", "comment": "Malware payload (Gafgyt)", "value": "1a9d19450948fdc18d352f5e56e2b44d9e4f9911248633bffb3752f23e5d92c8", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998079, "uuid": "cf717793-05ff-4f11-8512-91e2bcd2aa65", "comment": "Malware payload (Gafgyt)", "value": "6e3c2adfa9173c28ea8c0af737a8f3ffae1f6298", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998079, "uuid": "30d6f319-a356-4a15-bfee-9770d76bea42", "comment": "Malware payload (Gafgyt)", "value": "db44f6435846fa4c6ddd1bf47c8c92e7de2fca602b82ee620af958afb64155fd1b51039dad4e6fbe66712b053822d27a", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998079, "uuid": "fc8f32d7-f0ab-48ec-8665-0ea256d2dfcb", "value": "T198D3127E89C0CE59860644EF3B90CAEF9441EA05F16D6326D844BAED648BB2733DD4E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998079, "uuid": "59960672-657a-44c8-b689-8b6bbfbb21a1", "value": "3072:LRSF4T6K96x/qDWDTCfsz+aUDI5PSZ9Jb3SkepsxldtjqOX:Eu9GZrUmPaBBtL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775998079, "uuid": "c0e42972-74ee-439a-b2db-cf550ea325c6", "value": 132252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775998079, "uuid": "0d30e5c3-1cbf-4538-9216-1ae4440410a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998079, "uuid": "4fce5643-14eb-4c08-be9a-a591fdc88b3b", "value": "redis-conteinerd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e74460ae-3665-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775994672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775994672, "uuid": "a1ad81ae-5898-421c-a640-d7afec095c22", "comment": "Malware payload (Mirai)", "value": "9fae178a4b386b3cb6405eccc4a96f52", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775994672, "uuid": "f1940f87-b621-479f-bfcf-79c34d92c7a8", "comment": "Malware payload (Mirai)", "value": "1aa9469b874f799876aa978e4461bd7e7978cb290594fa84fde975f6ab8e3cc6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775994672, "uuid": "42a67be8-6d52-45e6-aac3-928552dd9d96", "comment": "Malware payload (Mirai)", "value": "adc5c5b3268fbe3daf6f598f9f8a278df7429054", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775994672, "uuid": "62b49e63-bc1c-40a0-b1b5-33a1df798885", "comment": "Malware payload (Mirai)", "value": "93c0fe98452a4e77bc7aa296c5d07e9227a287acd07dd5636bc81cb4893b8ca5a2227a3c8bb9b1440b36d78c0afa7005", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775994672, "uuid": "cf0235b8-f137-4336-9e86-42800c724e9d", "value": "T1EC533A1179762F17C4D6B0B922F34724B5A47A5E3AB8C69D7C723E8AFF146C060072B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775994672, "uuid": "f18942ac-eab7-4695-8ab7-a0828c53daac", "value": "1536:f+YY8/acYmgBOwicSYmWWLI1fz/A0Lzp1pdYm+b:22DZYmWFxoYp1+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775994672, "uuid": "edde13e8-d561-4d78-bd66-868060c9bd2b", "value": 66200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775994672, "uuid": "df38f9be-d13f-4201-b4fd-f4cb56ae6468", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775994672, "uuid": "0bae48b2-ad86-409c-90f4-e30e63d2e68f", "value": "jew.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9968c52e-3664-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775994112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775994112, "uuid": "10f4e8b8-16b0-45a2-82b6-afb5b3ae09a9", "comment": "Malware payload", "value": "6586b380d22fd656c9c9d57880fe53cf", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775994112, "uuid": "bcebbeab-7046-471f-9276-13b5b672c3f2", "comment": "Malware payload", "value": "1acd8ffcc5f2b498b36f3ee91779851e71e7b185d73d61e1be8a7890d4a1adc2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775994112, "uuid": "6629557b-6efe-4f0b-8783-fc433bce246a", "comment": "Malware payload", "value": "84923f70564d3568d0b87ffdf7c35786cb87ec79", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775994112, "uuid": "6b962ce6-c114-4919-a83d-be5950d2fcca", "comment": "Malware payload", "value": "3a2b8726aa982918bf1196802bb2596868c9805a3ca93fd322c58e1438b56f69260c367bd7f2a7c6ba9125a5c003fc68", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775994112, "uuid": "65032824-f43d-49a9-b696-66d99c9e9063", "value": "T1CBD37D47B7A400FBE1778238C8A34A06E776B86107609B9F03A446566F27791AD3FF71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775994112, "uuid": "715feae2-d07a-4d1b-a503-93f974066e4e", "value": "a9dc487caace60d89b059ca331cc7275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775994112, "uuid": "6511d722-eb7c-4195-86dc-d29cf5826e8a", "value": "3072:0Yu3h7eKWtAC91D/Yt3r6PGQIgBmxOdvNmiNN:0Y1btAW/Ur4Gr8vNmW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775994112, "uuid": "7e05fbea-cdf0-4c82-9345-477ba45cd3f3", "value": 139264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775994112, "uuid": "8b50730a-da5e-4cef-b759-ab231ec6168e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775994112, "uuid": "2ba55d40-25a8-4783-a8cf-fd38b361805e", "value": "epdevmgr.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec2397c0-36af-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776026463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776026463, "uuid": "131bde97-7f38-43cb-8580-ed03057574b2", "comment": "Malware payload (Mirai)", "value": "381ea4f39de8a3361e18e14e38d64057", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776026463, "uuid": "601507dc-1064-4fc8-ba5f-961551a4c2cd", "comment": "Malware payload (Mirai)", "value": "1d977d7afd661f4d0ffa11ad557345d4ac519a36f6aedeffa655bb7ae563def0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776026463, "uuid": "888f7a2a-20d7-4526-b6de-1163d6b7f0f0", "comment": "Malware payload (Mirai)", "value": "96f8140e9cb9cbec7f1da31f09c0bbaa56f46bd8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776026463, "uuid": "db6f668e-b231-449d-b01b-3c69867d1e68", "comment": "Malware payload (Mirai)", "value": "2ef75e07aa250bf3075fbdf2b0c71215a83a49236fb21437f0239b85a28176f858b9a5f562245defd01adb21457cb32c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776026463, "uuid": "b9fbadde-9f4d-4efa-9c84-5d70ae4df852", "value": "T11FB57C47B708B9BEF646733784574A0E24047F12C0815F33A2B5F4AD5E7A1A91F3A6CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776026463, "uuid": "f177d172-9300-4abd-9098-416f29a899e7", "value": "49152:KbN2VjssXZjBfBXa1MyjH0hEqPvZbhrBksC:KbN2ZF+MgYPvbBkl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776026463, "uuid": "88a2c342-bf37-48e7-8eba-c49dd34dcb4f", "value": 2322236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776026463, "uuid": "31ef30a3-ddeb-42f4-9a15-8445b5851a7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776026463, "uuid": "ad55d5ce-1897-40c1-a222-1d720332bedf", "value": "ciubuc_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9ce3efb-3660-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775992421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775992421, "uuid": "fe8609ef-92d9-41f6-adc5-3a1161811707", "comment": "Malware payload (Mirai)", "value": "d427475c4749da58c1f256c743d12598", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775992421, "uuid": "f428e91b-6067-4d08-8623-ecdb0b08a885", "comment": "Malware payload (Mirai)", "value": "1dbcebd31dff760eef6bbff05ada830d43241121baaf6dea13a8232e8f561b52", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775992421, "uuid": "56ba2eb7-8acc-44c6-9e64-0bd344ce1002", "comment": "Malware payload (Mirai)", "value": "b6225931692392a95a382516a80db3a3941c43b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775992421, "uuid": "4de0d54f-0187-41ee-9007-d03a20506628", "comment": "Malware payload (Mirai)", "value": "eb521a0f1ae95235f01f2f1fbe3157f05b5affa4b55ab48f1b8091c519b9e5bed83bb0ca83df3c63f9fb8ee5b90a3a2e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775992421, "uuid": "aa1fb2a0-d319-4c25-a5ed-267d92fd2a38", "value": "T1B2E52B156F900FFBD86FCD3356E94B02258DA40622D43F7AB878D914FA5B60B4AD3878", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775992421, "uuid": "89b0f5ae-5d2a-4d20-955c-76e946267dab", "value": "49152:2lG2pASucy/4QXdbSC432Y2/GM4rU5lFOqlpQvPc4:+pgqPUpQc4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775992421, "uuid": "935ac199-4ff0-41a4-bc2a-e983600523e3", "value": 3164404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775992421, "uuid": "dc10a80f-47ee-4db5-b6bd-e6c2c4b1a003", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775992421, "uuid": "edda25cd-6d3c-4561-846a-75e784fdb4a5", "value": "ciubuc_mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9daa0f99-365c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775990683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775990683, "uuid": "1b1777dd-07e9-473d-b5a9-833fbbd32500", "comment": "Malware payload (Mirai)", "value": "6fd11c02cd93c2c2482fa3c0a27574b2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775990683, "uuid": "5c1cab9e-f521-4170-aa5b-fa9b700acfa8", "comment": "Malware payload (Mirai)", "value": "1e358f3e45faae686ff08398cbeef9425c96d4e0f7f7ca06d7a6649a70e07d04", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775990683, "uuid": "94f4f3dc-5767-4415-a66e-1cccca94d25c", "comment": "Malware payload (Mirai)", "value": "c833142e8e1ccc4341e944f1e09fc593cd18f8a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775990683, "uuid": "e7ba4fdb-58a1-4b40-8db3-83703d5f1dff", "comment": "Malware payload (Mirai)", "value": "42498d50f045fa5327fd45737c50c7370666490f2d02393e4f4eddccddd825069306bdbabeb65e5d9c3d7466063f6125", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775990683, "uuid": "4320eacd-ff72-4900-ba68-cd3e24fb7a68", "value": "T169C31ACABC858F10D5D665BAFE0E618D33134B78E3FA7103DE149B29278AC5B0A3B551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775990683, "uuid": "b0385d16-7937-4a19-b424-49aa03df5cbc", "value": "3072:mI2wShxZcG8aE6gfXVp/43VLJpppxDixDslxW68oFAlmjg2NF51n4:fGrUVp/43VLJpBD6s3W68oalUgUF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775990683, "uuid": "2091d76b-ec6f-4bac-ae94-73758d97be04", "value": 120356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775990683, "uuid": "983ee35d-c878-4569-a7a9-ef0ce9053c17", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775990683, "uuid": "66e2ebb0-f624-4e60-9be4-af73c014ebf2", "value": "splarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ba32e36-36a3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776020959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020959, "uuid": "75339d2d-1a51-4f60-8e17-6debf45351e5", "comment": "Malware payload (Mirai)", "value": "3754729e9834045cccff585fef39fcae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020959, "uuid": "26739892-535c-471c-931a-4add25610356", "comment": "Malware payload (Mirai)", "value": "22b1b5397ebf2832b9df17a5a96dbbe94cf875ba238eeecc3ffb1bd6637584f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020959, "uuid": "89ec0e6c-3820-4371-8772-bd6cd671824c", "comment": "Malware payload (Mirai)", "value": "dd4a784193a20d1fde7ef65b3bdcf35aeda68409", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020959, "uuid": "7230282a-fcd0-4476-924a-120442c464f5", "comment": "Malware payload (Mirai)", "value": "9e3fdb438a1678828412ca43e71be9fb913b9f5943ade371d234cea983ec9b136ecb248694b4895354dcd027b2a32c01", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776020959, "uuid": "096fb742-59a5-431d-aa64-670152aa690a", "value": "T195D2841FE2A0DE3CE8C4F3745A9FC1218160B0F4AB32615F6A40A5F73D867988679E57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776020959, "uuid": "8acb40d8-5282-4251-ab0e-4d9c5bd43678", "value": "768:mqAqdVtl9YQog4wIAYQog4wIAYQog4wIAYQog4wIALjbzrD7TLs1yP4xeXo:mXv3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776020959, "uuid": "570d6d23-41f4-4c56-97d6-8bad1bc25b6b", "value": 30648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776020959, "uuid": "3d9c023e-ab4a-4f62-a8e4-4048b787348a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776020959, "uuid": "e36fbfc9-2701-410b-8814-4d836e111d68", "value": "bot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2224609-36c8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776037184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037184, "uuid": "b4c77fef-085f-4be6-8047-5227f990211e", "comment": "Malware payload (Mirai)", "value": "b93a50b1943f209a9ac388aa2097d031", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037184, "uuid": "7d1bdb5d-a19d-4f72-998a-7131b0ef8b09", "comment": "Malware payload (Mirai)", "value": "22e323da68adb82410c295cdc1e0e3e30f8b979a5e170b72e2d5951010e8bc9a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037184, "uuid": "2703e23b-292c-4c9e-a285-70c65e90859f", "comment": "Malware payload (Mirai)", "value": "76b4a0fdc83bd495862c1d7040a3968497455a43", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037184, "uuid": "41a720c4-150f-42df-b2ab-151c74f8728a", "comment": "Malware payload (Mirai)", "value": "caa71f6b67054dbfece1119aa706eb90193a03167e2317448f35fd24ade45c6429f9f926e31a094688a7bdfc6f0e38a8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776037184, "uuid": "5a51138c-b6f5-420c-8e8f-62c3b73c381a", "value": "T17D630219128AC0A9D6A23F3BB58C434B278F77B4C3B9F022412415E6FED5931BB79785", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776037184, "uuid": "f4ad48ab-baac-4cd7-abfd-9e387055d6cb", "value": "1536:qdDA+7OgH+oRt0FSCwlbi+D/awKcrKLeQOYeWXea:q23FqZx/I2KLeoV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776037184, "uuid": "92507250-fa1b-41d8-a9fe-65ab0b237d5e", "value": 67896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776037184, "uuid": "7a9b8e70-b158-46a1-bd5c-f4d530b19e4c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776037184, "uuid": "e309ab2b-1889-40c3-b07b-63716c70e424", "value": "Hammz.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b0080c2-368c-11f1-a769-42010a9c0008", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1776011133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776011133, "uuid": "934a877e-9284-4c2d-a745-4deb239548a7", "comment": "Malware payload (ArkeiStealer)", "value": "435b33bf993d64b36e0ffcf824092f22", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.aaa", "colour": "#884164", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776011133, "uuid": "44b92c27-8311-4e57-a232-ad64503c1241", "comment": "Malware payload (ArkeiStealer)", "value": "26ce7bf6adb9e0906016c1c427425dcff27c2ffd8bf319c462f81d3fd03e01c5", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.aaa", "colour": "#884164", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776011133, "uuid": "9731b694-53cb-46b3-92b2-500029e98e2f", "comment": "Malware payload (ArkeiStealer)", "value": "811d97cc9893d296f65355772c453312a7900c9c", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.aaa", "colour": "#884164", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776011133, "uuid": "6934670b-0abf-4579-ae0f-f5f73fbc7f96", "comment": "Malware payload (ArkeiStealer)", "value": "81a1b42536c851658321fdce5c62cdd94a8c5a5d9d3ec970971799c06dc1f4011084dd23ce2ca5b1177fe83dc69d45da", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.aaa", "colour": "#884164", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776011133, "uuid": "20da57d7-2ede-404a-99df-f3bcca6de41f", "value": "T1E097BE22A6A2C5B7D7920031CD6A96BE63787D1D1BF072F7B68135EDED312C53938212", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776011133, "uuid": "5b500b2e-ef0d-414a-817a-10f0ef1086ad", "value": "ff962d91d5fd1c6b163f0b9db56fa5f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776011133, "uuid": "81caa5d0-9b21-4614-9306-005439d1954f", "value": "393216:3Z7BVXH8XEYsx//RcIBm2F3jYdx5ro5zQTADCR8PggvXSCN2mn+z86cI2kYEcd:NBVXJx//Rhm2F3jekF3hXtoXz8JI2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776011133, "uuid": "8f6fd54c-1e50-4438-b605-f08207f4a6a6", "value": 40859648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776011133, "uuid": "7ce3fe26-bd76-48f1-8907-c55b2d447b5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776011133, "uuid": "76a03acf-2999-4c52-b467-62cd5da414c4", "value": "Quick.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96d14478-366f-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1775998832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998832, "uuid": "b479304f-414f-48f7-83f4-8e5ee4b2df83", "comment": "Malware payload (Gafgyt)", "value": "ae9ce8cdce7e2f983d944ddda34eeca8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998832, "uuid": "36d326e8-81d1-478c-aef7-70c1079b1034", "comment": "Malware payload (Gafgyt)", "value": "2b03754d520f7be04c0f51c098d43e4d8acc4c09357dc34e7b1745eb98445dee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998832, "uuid": "4a8c7ece-8ad3-4171-ae34-9108b196fd56", "comment": "Malware payload (Gafgyt)", "value": "29bc3ed0751e9a073c70615aa5636bd510287476", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998832, "uuid": "be177b27-6e6d-4dba-aa8a-127b24fb83d3", "comment": "Malware payload (Gafgyt)", "value": "200c708615ec07b086ffb96de81e070c46d38d2795b8f06b720d8dace934f7102cc72d4f64872734539b1fb5b159cb2a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998832, "uuid": "44d9fbfa-e7eb-4573-b6aa-e9e42eb0f692", "value": "T1F3D313721216C383F0D4F5FBBA3D56DC531A9B3E614B30639A7138E9154F22AE8524EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998832, "uuid": "92dd02be-6d3a-4eb5-a473-1f0ca070a3d4", "value": "3072:InxKfyJzhpRIm6+Jv5m7tgZ0n72AjLHH8V4quMbA4TaW6:zkdpRIm6+JOtgen7loVvX0Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775998832, "uuid": "d94f6b3c-6f10-4248-894d-eac8f2707fe2", "value": 138228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775998832, "uuid": "239da39a-a5a2-416a-b6c4-cfb5ffcfb1a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998832, "uuid": "67a9db09-1c24-4796-885e-34edda838d3b", "value": "redis-runcd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2efbeae5-368e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776011972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776011972, "uuid": "55cc6ff8-cbf6-4f0f-8572-a52901374825", "comment": "Malware payload", "value": "d51b73e1ec93f23f121dc1827367607e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776011972, "uuid": "2d759169-918b-4521-b754-81c67941f213", "comment": "Malware payload", "value": "2b0d8c8e86dd372b44b99f8be4e4a7cbbfe5ce78bc10b714fc0735c15b7ddb32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776011972, "uuid": "cc81fa91-b6cf-44f4-940d-71c79e6dd021", "comment": "Malware payload", "value": "d0706b657a75fe7b8f74a666ca54e7ab14b8ad6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776011972, "uuid": "a12f9c4b-3790-4178-bdfc-c9bcba691c19", "comment": "Malware payload", "value": "9799a406231e61bd6d516ee1fdca62bea14ae4746cd3ed99e7d1053491066609c811c2d350adcad5632156e3e64fb30f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776011972, "uuid": "d7de20c6-5ff2-418e-a09e-b5cba2f87109", "value": "T14CD47C5663D483DDD23E9BB8C826470BC1F1F00107B1EE2A15EE45882F47AB6766F35A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776011972, "uuid": "aa122030-7578-4416-abca-891e05ee31b8", "value": "d386edacb5bc531cae23e0abe0d5b57a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776011972, "uuid": "ac481bee-285d-4c0b-a56a-7991eea4ab9c", "value": "12288:ySZjuQfhCPIfH3YJmRBQcUQzWAyByMnD1NyKXDurj63iJLnZQJ4pcd:ySA4JRBdUQeyGD1ngLZQy2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776011972, "uuid": "f699409e-c4a9-43dc-b214-4644aa36c01e", "value": 624128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776011972, "uuid": "1aae27a6-0f31-4139-aecb-836f7a2f8b98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776011972, "uuid": "e3cea219-73b5-4f70-9789-37fc159ba463", "value": "2b0d8c8e86dd372b44b99f8be4e4a7cbbfe5ce78bc10b714fc0735c15b7ddb32.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cf371a9-366f-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1775998789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998789, "uuid": "1afbc0d8-f1c7-42a0-b2a0-d78b5f81d43f", "comment": "Malware payload (Gafgyt)", "value": "da82ad47ea7588111389ced6c17df738", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998789, "uuid": "5058f695-c1fb-41e1-bcf4-614215be8ff7", "comment": "Malware payload (Gafgyt)", "value": "2ed46896bcf48ea047471359a941f17bbb668a2dd68dbcbf6e59989de21fc02a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998789, "uuid": "cedce3c8-9882-4750-8da1-8ce4a62f5728", "comment": "Malware payload (Gafgyt)", "value": "58e67144a317e79dcd98e135c1531b53dd97761d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998789, "uuid": "3b4a41e4-5f5d-491a-9b87-e1bdeeb6ba34", "comment": "Malware payload (Gafgyt)", "value": "eb002738e9c959a87d93686e6b2054fe72b9d1dce1e9c061f68a2710ac80866d42063b51c9f23956354dfe7fb2030b05", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998789, "uuid": "fb15c990-5493-439b-bb33-1e8d5a60d83f", "value": "T187D3126E84C36B9DE1450B68DF4FC84F5E0653B4F7F1263B90D3426A66CAE24135A6C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998789, "uuid": "96aad35d-f3f8-4ea7-b6e4-b125824b8994", "value": "3072:V3+UsdnLgkJj4FECORNwLl1r2s6cCLQs4vcRepsJfoaDW:rsBTJjGECOcn2s6jLQsyczdq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775998789, "uuid": "30526bd7-28b8-4a7a-b32e-9b2a00b96045", "value": 132468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775998789, "uuid": "30770bbe-1c4e-4b7c-aef2-f10723a86921", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998789, "uuid": "db99aefb-3c78-4f83-862a-c3c5639b651e", "value": "redis-conteinerd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb4d0d59-366d-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1775998034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998034, "uuid": "6b16c107-5729-4499-b46a-0ab355e10241", "comment": "Malware payload (Gafgyt)", "value": "55981a2eb93712da9a0e06c09bdc44bf", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998034, "uuid": "581bfc38-0b86-45e0-bb15-b3689c292f9a", "comment": "Malware payload (Gafgyt)", "value": "2fbcfd51276f446c199cb50ad3040167c9b398d521fb075cfca486f2c1fc3a97", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998034, "uuid": "57b335a3-c44f-4ec8-9575-8b4e47e78707", "comment": "Malware payload (Gafgyt)", "value": "a5dd622c759092b36efaa46d277ef4030669b8df", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998034, "uuid": "37ac612a-0329-443f-ae05-2b19d5ddba99", "comment": "Malware payload (Gafgyt)", "value": "0957f54f9a96f6df16830115d8dbbd6b2f17ebe701ff10e90566976d6b6d6dfb0ecac534b833d0327ccc7faa75d0f969", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998034, "uuid": "c6750d4f-ccea-4503-96f0-1f86a128ee27", "value": "T1C9A312827DDB2CA0DA3A1C36F1D893A5A4847082C43A18BFD4E4644DB4F7AF5416E4BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998034, "uuid": "3b76d976-6a24-4d53-a68f-8c4b64bc4a61", "value": "1536:YcRJol6Be1xbpxjuxsUEc0l23pTy6pHJLMFPGb/2/28d+xZZB3l2Ey:YlZbZ8lul2xdR1aGbG7d+xB3gEy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775998034, "uuid": "ded12dc8-f949-4a87-8b49-13ac6f1b9d6f", "value": 103884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775998034, "uuid": "91c7f145-ba8c-4465-a5cf-93bab935733b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998034, "uuid": "eac4fd14-4c56-4bfd-a2bb-52947cc70728", "value": "redis-initd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f334ad5f-3680-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776006288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776006288, "uuid": "0d1cb5e1-0f93-4538-b5b7-e51d00bb49b8", "comment": "Malware payload", "value": "5c99b47d7db86146e62875282af16746", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776006288, "uuid": "26c513b7-c763-483d-af88-a590ca6ddeaa", "comment": "Malware payload", "value": "3074a18a349d7e8022fbbdcfc059b7b729862488f1e23adcfe634bb94535fd61", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776006288, "uuid": "2b388868-3b0a-4657-885d-7417209b9447", "comment": "Malware payload", "value": "7a3800ebbc712a8a4bf7ca064f71b68d96fddb6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776006288, "uuid": "f8066ada-3ff3-48e6-af3d-44f42bf27a8f", "comment": "Malware payload", "value": "91636678fcc0fa6dd383adb56ec65f684cd047c0ec7d0b43e1c27f6f593b971e900de96075d6f5473360a37d01e7df32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776006288, "uuid": "0e80c91e-93f2-47c7-a337-a62c24985a26", "value": "T114E4234EBA6C8EFCF49B46B270945F426F7BB06146D6A24915F084AF2CB7C2D7261313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776006288, "uuid": "cdb5b779-6023-4ab5-bee0-c84fe9cd2154", "value": "9b760feffec4fca9c313889f9a05ee36", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776006288, "uuid": "0f1e083d-258b-4a05-b43f-97d6bca3bb1a", "value": "12288:+0/niRr9KW4bDRKnK5rgxiIr3WnO/rfKE4bjRK5Y5b+PiI9:+8WKW/nKyxikWgKEV5YoPi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776006288, "uuid": "c9b601fc-50a3-4674-ab7a-7919a2fe363a", "value": 697344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776006288, "uuid": "d9f262b8-8892-4bd4-83be-8a466fcef97f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776006288, "uuid": "bf5045f0-3c5d-4017-81ce-abaed52a04df", "value": "3074a18a349d7e8022fbbdcfc059b7b729862488f1e23adcfe634bb94535fd61.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dfd8c13-36a1-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1776020185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020185, "uuid": "596d329e-2b1a-4fc9-a55b-be7f8b201c1b", "comment": "Malware payload (a310Logger)", "value": "44df6e7445decdfa35ddb16efec1d96c", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020185, "uuid": "4cb57987-b927-4f65-a578-12aea8f8c538", "comment": "Malware payload (a310Logger)", "value": "32544d2666db007b1e18d698b39f46821b965e2af2bc318485cf1653b62ade7c", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020185, "uuid": "64c41aa4-03b1-4e7b-ae3d-54b3a1db4fa7", "comment": "Malware payload (a310Logger)", "value": "251fa9b467fe3a25b0fa239efdf46424e294bf82", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020185, "uuid": "43afbda8-de82-4386-a714-ca0ed80fa3ac", "comment": "Malware payload (a310Logger)", "value": "0ab49868f0df6ba0b94dc93be905c0556ccde6ea941ff63aae37fb025fe57cc2b5350b714ecee237ed6d0a62c5c7950b", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776020185, "uuid": "c51c24fa-ef3b-47ee-9003-c29dd2927500", "value": "T1F3451238BB28CA02D9E553F41962E37113B49C9CE421D3178FEEBEF77965B5A1818603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776020185, "uuid": "d09f8c3f-0d51-4313-a87a-be00e6c4d610", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776020185, "uuid": "6e7fbff7-f06c-44d9-89ae-08d994e29f31", "value": "24576:Z8+v9n31TE+BWGOwpsgANjPbLjoHX4xi8KXD+qCJ4q0a4LFnGWNY4GCO:jvJq+MtBgWjPbLcgi8iDZk0a4LtGW/G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776020185, "uuid": "581d000e-709f-488d-945f-5283aac54cad", "value": 1223680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776020185, "uuid": "ac32fe8d-6e8f-48a3-86bc-d43419ea2af1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776020185, "uuid": "e4665cd2-608a-4a41-a7ea-d29d78b4c86a", "value": "T. HALK BANKASI A.S,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7b845e8-36af-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776026455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776026455, "uuid": "4348b769-0680-4184-86ee-a1b367145c8d", "comment": "Malware payload (Mirai)", "value": "19f8c4f7d3fb3f5716fdfaf805edb5e8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776026455, "uuid": "9b405812-e5df-44ce-9a3a-f0248ef4dc16", "comment": "Malware payload (Mirai)", "value": "3276925185936efe3d3d6c2695e9f953311c7e4968b6a31c4c331ab38a1b1967", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776026455, "uuid": "aa3de369-cc39-4c61-8e21-55058400b433", "comment": "Malware payload (Mirai)", "value": "6cb3b93fc002209a9290f3240ae1d4319bc0b207", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776026455, "uuid": "db22f047-24f2-4caa-9ca2-f211b90cbc1d", "comment": "Malware payload (Mirai)", "value": "30af57b457a44d40d01fcc3ffad1d05b61d99432ec1c4653ef588254d410e8410a1f5e56e4e62c44b3d338add1d5b4cc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776026455, "uuid": "5f3b970d-77d2-4dc3-b03e-b17ec42921a9", "value": "T171B55B41FC51AA56C6E066BAFB7E828C33272BB9C3EE30174D04573477AA95A0E3F541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776026455, "uuid": "28e65f84-58f9-4d1b-80d8-77f40405e23c", "value": "24576:u3EWxhHZyLZNWwdVw3skzap/uCg2yHDQK+6gbciUcsbfy/37r1AfaDo+pWvPlevU:u3ONdwckQcHLWsjyz++pWvPle", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776026455, "uuid": "87620645-5019-4efd-85b5-eba62b8e6881", "value": 2490172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776026455, "uuid": "b5b80fdd-f868-402f-95fe-e32da3ce8a34", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776026455, "uuid": "a8c5504b-f39e-4c14-b581-92588f50659e", "value": "ciubuc_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "662d6b05-3630-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775971692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775971692, "uuid": "737cde85-2a50-43fc-bb48-f83b88fcbe3f", "comment": "Malware payload (Mirai)", "value": "af95384cc7ae87611983149e1d2b9b78", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775971692, "uuid": "d384273a-97b3-4a0b-8460-03bf634d5e48", "comment": "Malware payload (Mirai)", "value": "34cb1d415bc4a4cb0cfaaee49a95321dd69575b05c4cdd3683b655412a7b61bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775971692, "uuid": "41358e34-a259-4342-b3a5-024260370c0f", "comment": "Malware payload (Mirai)", "value": "536449a24b68fcbc2e98d6e5fdd15b6a1a494115", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775971692, "uuid": "fe62c124-c794-4673-ae7a-8ac75badce3b", "comment": "Malware payload (Mirai)", "value": "4db26da5bf75cd83173f90dd5ce09ab097698a67c3f8d5f256aa69dd01d2a76bcb9cec3da9bed60f460a7a65d13c9596", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775971692, "uuid": "3d4a0b5a-a80a-4550-a8fc-ea5847102c5b", "value": "T18CC56B55FC509A56C6E096BAFB5D828C33232BB8C3DF70179D0487743BDA9AA0E3B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775971692, "uuid": "5021f931-8243-4e5f-b514-2ae326d472be", "value": "49152:A9rt9FYq1BcUDoThSyolbI8wICjqqruyZWvPlamw:A9zFYcc+ehSRXwIWZWla", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775971692, "uuid": "c3018c56-6ae7-4142-b029-8dc5cd087feb", "value": 2498452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775971692, "uuid": "4a15654e-fac7-4d59-8138-f2e02dd47e13", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775971692, "uuid": "2e5ade43-bb85-482d-acc0-71d683a3fac7", "value": "ciubuc_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ace8b416-3649-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775982548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775982548, "uuid": "e8e2e4eb-dcc0-4f6b-884a-14db1df7b171", "comment": "Malware payload", "value": "660df10a6d5c35999c2cf6f8f9cd40ec", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775982548, "uuid": "f550cc80-2b03-490d-ab7a-9844780c4524", "comment": "Malware payload", "value": "35070656aa1627e6b1a65f5c6bde5f8174ed0bf7f8d56ffe7c1da256b347db79", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775982548, "uuid": "a2ba96af-833a-49a2-a602-ac6d55c79f92", "comment": "Malware payload", "value": "a0674f14a75c08a0f9676f518344b95be49e4c31", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775982548, "uuid": "18c8ed2b-27ae-42a6-b165-04ba85fd4a63", "comment": "Malware payload", "value": "0400142fa1f9745a28425ab1cc1f1d53dc3d2d208642d60df1adb1f89f4c419874ba9e00c01cafdce0430e8fa3628a70", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775982548, "uuid": "06929086-78d1-4160-b235-c4d45308cf4c", "value": "T13D6723ACED8ECFD89DECF47069EF17846E5086DDE523881062D9F578F20394607528EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775982548, "uuid": "fbac3871-d4c8-4a43-82bd-ded6a83b5460", "value": "786432:cTKV7OHYl+ZvBG9h5Uy2ozF8ABxrLvcGVZlFi:ceZVlS6UbhAHYGVZlw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775982548, "uuid": "34c1aabe-776a-4aae-9781-74218ad158cb", "value": 31463289, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775982548, "uuid": "971f0f69-e712-4fc1-90b4-8b9d0a51c0c0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775982548, "uuid": "986742c1-7af8-44df-be47-3f01d9a75cf6", "value": "Setup.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bec1b1bc-368d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776011784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776011784, "uuid": "c443d4a0-9b83-45ea-a4db-84b46257c3a7", "comment": "Malware payload", "value": "b18c86cc1233a6fae7b0b2ae8bf80127", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776011784, "uuid": "b060acbf-0f05-43d7-ba0f-af97a3bfb91b", "comment": "Malware payload", "value": "3511e2bb89f64555acdef3b486717fd517f500c8c630e02e9c6fa0ac5bed8950", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776011784, "uuid": "676f7b8f-fddb-44ba-8c49-b0f28bbcf1e8", "comment": "Malware payload", "value": "19d000380c551d19c856eedbc519721201df79c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776011784, "uuid": "a1833671-5b12-422c-ade2-57e823017207", "comment": "Malware payload", "value": "dd52943026f520f3dd3a5ad8fedfb2bca8f4a89c8bfb88c5bc629c7b292e653d4618faa82d4c1c71ca64e7c5eb57ddb8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776011784, "uuid": "4f65ed1a-5077-4f7f-941c-7b7d2f134b1b", "value": "T1DED45C51B2F503E8D07A6778CC0B920BCAB2F2815971DF2A15E505A50E8FBF673AE345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776011784, "uuid": "d391c962-735e-4ee3-a866-4c18bd5f4901", "value": "d386edacb5bc531cae23e0abe0d5b57a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776011784, "uuid": "48047b26-6548-4157-91b4-ba2518105924", "value": "12288:svlJLjmlTApf2DtLWIGUcud7nOox7QodF/D8zfFJSVXEB+a:sTLjm9cvIG4ZOo5QQ8RIVX4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776011784, "uuid": "e33ee7cc-45a5-424d-be50-e90e72dfa579", "value": 622080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776011784, "uuid": "f58886da-2505-4e87-a51b-68792693c09c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776011784, "uuid": "4e2124d2-5c85-4550-a722-db249634eb93", "value": "3511e2bb89f64555acdef3b486717fd517f500c8c630e02e9c6fa0ac5bed8950.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65fac1c2-368c-11f1-a769-42010a9c0008", "comment": "Malware payload (OffLoader)", "timestamp": 1776011205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776011205, "uuid": "eed36a86-d9f2-4f5d-850a-65d92069a232", "comment": "Malware payload (OffLoader)", "value": "3b756f571fbe76c8dabc38147a6b10f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776011205, "uuid": "a94c1cde-99f1-4cd2-9a11-8dccfb18ba00", "comment": "Malware payload (OffLoader)", "value": "352e6eb7fe4e1b568aabd0c8e272a8cbff55937082ef72d66a7ea1e67ef4bbde", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776011205, "uuid": "a9f3539f-1e11-467a-b707-3ba3448bfd36", "comment": "Malware payload (OffLoader)", "value": "00f5ffa170f885161f1d2343181956ece5aca8fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776011205, "uuid": "d73ceb71-4826-4c07-822b-905d9c24834e", "comment": "Malware payload (OffLoader)", "value": "145723761766ec35e2bc65ae0f2626d8d7e5db8cfd3d446203c6f6ea66566465674f9da436c0c690589e179ff7daa9c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776011205, "uuid": "12d09edb-0fc6-4968-ae6d-1b6ad67c29e3", "value": "T116869EE0A959ED0BF353D4356435F908E27620D0EF6664BAB0EB697CA6333C0185F687", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776011205, "uuid": "5da8b225-c2a4-453e-b07e-6747ea033c1f", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776011205, "uuid": "b5fc18e9-f9c0-4106-82c5-f31670816109", "value": "98304:QN66jFnHWLWiTTMIs8J1+GYTr33VZ9wvD9KrNMZAodJDMjX8RYtE0Nh/xGBHo9tb:Exc/MM1+G0VYVyods8WtrNlkI9t5N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776011205, "uuid": "3e394514-8235-43de-9265-169e708fc529", "value": 8170390, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776011205, "uuid": "74f828c1-3c48-4c52-8a5a-0967ac14ad05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776011205, "uuid": "c365fc8e-9753-4104-8cf3-d150b1de5a28", "value": "Yflabmd_2026.04.11_01.15.07_SETUP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb5677bf-3655-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1775987807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775987807, "uuid": "f0725272-c1dd-411e-b209-a34a8a3c6c17", "comment": "Malware payload (CoinMiner)", "value": "e13371d3f70757a5f49a200b0dc8e18d", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775987807, "uuid": "8c5a110f-5bb3-4be0-944b-7a28aac46d0f", "comment": "Malware payload (CoinMiner)", "value": "35e59b5009e69db255faf59c842918af9d24a41dff0179dba8b00cb7895bde0f", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775987807, "uuid": "984fbf0f-7ff1-4554-8feb-474549e444f8", "comment": "Malware payload (CoinMiner)", "value": "ff84d60cbf14edd8bfc4660d6bf1222b87132639", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775987807, "uuid": "60d1e5aa-51ab-4bd8-b044-129c77c4a2f3", "comment": "Malware payload (CoinMiner)", "value": "1026d1ea7a4c63bb09ee9a58ef49b6e5ff1a71ec2d6eda27ebe47c6941fcb254221aa0b6369e8546f53977d223a8f0d3", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775987807, "uuid": "0aee3a37-d73c-4bbb-8190-6bcf9d9d3354", "value": "T19F33E9E4FCA8D93132348674E6CD9501F9A70A3B421A3514719EAC1C7F3C795B1AEE2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775987807, "uuid": "df043f37-aac8-4817-a359-7e17a497fc09", "value": "384:6a0KQ0VX1ibU72K8ZB4gmSOU3pWxTN+b4mUjI5RnTO5H15/ZhzcFLU7SWioxD5vW:6aJQ9OEJ3Gk5RTO5H1FZSvr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775987807, "uuid": "11270ddd-5373-4154-a7ff-804d0b492c41", "value": 50144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775987807, "uuid": "cc9e6ccf-920e-4154-a819-4edb62492614", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775987807, "uuid": "c7c6ce86-855b-4141-a5a3-eb06e780088d", "value": "q12.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "240a5509-368f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776012383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776012383, "uuid": "bb107e76-f535-4cfc-8c0f-895107e746eb", "comment": "Malware payload (Mirai)", "value": "c613778095e4ecf8fc038f8c0de14ed6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776012383, "uuid": "a59f7a03-1e95-4a50-9b21-c8933e4f149e", "comment": "Malware payload (Mirai)", "value": "366303af183968e57b2c7f07b6be4355680b2e05482b27379cf5424dd7a0a73a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776012383, "uuid": "73c389c1-927b-43c1-a437-1e0e1fff562d", "comment": "Malware payload (Mirai)", "value": "219b933874857163d56e665b46fe729b1170345f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776012383, "uuid": "56bbf429-0f5c-44b7-bed0-2acb9524d3bf", "comment": "Malware payload (Mirai)", "value": "0c57dd2907901da62b900c256fcbc4ba4ab8ec14c7ddcedaf387413f2cc983d66020b00cbdf59071a7d1fc39a20a7b04", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776012383, "uuid": "2fb371a9-053d-453e-9e53-67481a12040c", "value": "T19CA35AD7B401DDBEF80ADB7B44530A06B530E3A24A831F36625BB957AC361985C37F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776012383, "uuid": "e34f123c-083c-4100-9585-e9b586e852f3", "value": "1536:J+r3ti/yLHHUBiLqx8stXzx4amkm/ns8Y3KHskBTJ321Ye6KDT7htfTcNra/MX:yUoLqx8IFjmkm/n3b32OeZ/TcNr9X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776012383, "uuid": "091795b9-cfc8-4c02-890f-1da5fff88027", "value": 99572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776012383, "uuid": "59642685-bc29-4d21-ae13-eb5d2fe1ab18", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776012383, "uuid": "fccd8064-d2cf-4281-89aa-48670f880a24", "value": "titanjr.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea1885c3-3662-11f1-a769-42010a9c0008", "comment": "Malware payload (PurpleFox)", "timestamp": 1775993388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775993388, "uuid": "a4ffa658-a7a8-4fa1-b1c1-2643697de2d5", "comment": "Malware payload (PurpleFox)", "value": "4323e1e0b821683ecace3fb52d22065b", "object_relation": "md5", "Tag": [ { "name": "PurpleFox", "colour": "#FDE7BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775993388, "uuid": "1a1ff54e-018f-48f0-b588-939d1f0586b4", "comment": "Malware payload (PurpleFox)", "value": "36fcbb6705cfb33700f750b218cf948f73590504a9fc31b4c1d9d8b517e5b8d9", "object_relation": "sha256", "Tag": [ { "name": "PurpleFox", "colour": "#FDE7BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775993388, "uuid": "a9e2d650-be2e-4d1d-8bd0-92eb6ca3dedc", "comment": "Malware payload (PurpleFox)", "value": "0e60f947ea79156b55a857bdf8b114eddf5b4321", "object_relation": "sha1", "Tag": [ { "name": "PurpleFox", "colour": "#FDE7BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775993388, "uuid": "83515f6a-2cf6-418b-b55d-021091d6b01f", "comment": "Malware payload (PurpleFox)", "value": "51e6cf9283cf90d1df6c7ed2be374e557433ca3ba1871e4004bca0253ef43cf1321f2b662875aaad4b02702de95bd590", "object_relation": "sha3-384", "Tag": [ { "name": "PurpleFox", "colour": "#FDE7BD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775993388, "uuid": "137977e8-adc8-430f-9e04-323c718da49e", "value": "T19875DFF4FB50B7F8D4001C72C265895988B97B9BF926A703FDA19E7922219BC5F80374", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775993388, "uuid": "a37c2c81-8fac-4f3d-8005-60aedeb3c7bf", "value": "ca9d692a628aa9acda2c33ef6b018c9b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775993388, "uuid": "247c9d3a-829b-457f-9e01-d561d59be478", "value": "24576:3DukRWNvfyPwv67lbcbDLVLNOS7EghCexQ+2+d:3SWeDxLYM3hRWM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775993388, "uuid": "f1203435-3bf2-4cd1-aa88-dc8db58a56d4", "value": 1644032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775993388, "uuid": "85d6903c-b5dd-496c-a66b-9360e8bb5601", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775993388, "uuid": "eaabf5a3-97b0-4a15-b0c9-a2fce0c4a8dd", "value": "openclaw installation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bb8b1af-3687-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776008933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776008933, "uuid": "8ce02535-eee2-4e05-9767-bc75b05ed375", "comment": "Malware payload", "value": "adab6c337e403af0040d77a56daf3ba0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776008933, "uuid": "e87e30b4-d806-4d26-a3e6-682f18f88112", "comment": "Malware payload", "value": "3763b9e6eeb9a18875c45ba7d1a4f9fbfd6e80d1aea434e88ad99ee5b1bbd790", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776008933, "uuid": "c5304af2-a118-4eed-90e7-01a48558ecb0", "comment": "Malware payload", "value": "ac4a2d0b92990b7f8bab39a69117e326ecd11df6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776008933, "uuid": "634b37a6-d022-4dfc-a628-59d47302e242", "comment": "Malware payload", "value": "3369e7fa29dc09417803f75fc2ca24bf3d3a77cf72806a93334189f5caa5b8f7edd29c2bb38a04fff74c6d4db3e996cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776008933, "uuid": "97616c96-7cac-44cb-8f94-76239d937230", "value": "T1667423D220EC7A3DCC2A4435B11FAEF2F66AA21D15633F79B58B425D404223E31B5E36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776008933, "uuid": "f3855120-b4e2-46a8-9267-dce95a1ce2ce", "value": "9b760feffec4fca9c313889f9a05ee36", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776008933, "uuid": "41d3f3b5-c8cb-4c91-a686-04bb1df8ccff", "value": "6144:zQICImaBPWn5gyCCkRK2s+IX/li0QpTt3pLoR20wZRNnbPZTiQf2y4+p:zQIZ6n8RXF0QpzURB6RZxfKu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776008933, "uuid": "6377a22d-895c-42bd-afa5-5b23ee16ec2f", "value": 354304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776008933, "uuid": "cc79d394-334a-4dd3-bd42-f3ba3bea5ee8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776008933, "uuid": "fd6e9111-9157-4723-b461-770bbf9f2cee", "value": "3763b9e6eeb9a18875c45ba7d1a4f9fbfd6e80d1aea434e88ad99ee5b1bbd790.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ed16e53-365f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775991732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775991732, "uuid": "135135b1-f846-412c-b155-6c10204fbc23", "comment": "Malware payload", "value": "69329f154b2dc21d221add8921e5a0f0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775991732, "uuid": "0cc508ef-c41a-4f28-b75e-dcc7974d043c", "comment": "Malware payload", "value": "38530ff8297aad43ec0b29daeb8dd054c7f0e02790260b1925a9244f98a1814b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775991732, "uuid": "88fb6abd-a8de-4e11-bf08-80b0edd17581", "comment": "Malware payload", "value": "c167df68b7715ea011e08154e8c9e68604602be2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775991732, "uuid": "16bb23fd-b19d-4d65-84fb-91f8ce8bd123", "comment": "Malware payload", "value": "79ed442ba9291a899dc329469285cc8922dedfbd6f08e9cf2577f0929547d2ba5611e2039b1285ae33f5cbee53ce8b88", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775991732, "uuid": "cf36d138-9c4b-4aab-a36b-c893d0998b80", "value": "T1C7647E227584D031CA9211316B7DAFB79A3DBA705FA15AD773C4493ECA202D29632F1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775991732, "uuid": "3ee0fc6f-207d-4ea0-b2d9-26f792520250", "value": "e2b637c92f8975b7a0569ee52753b3c4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775991732, "uuid": "e6eaa918-456b-4589-a72a-a906890d0218", "value": "6144:8EPBvUBcbwYj5W3OEV2TlsxwgFeJMSm8Ega9uxYZNMndu5geLiQXWSB2flVI6+RU:8MUfB2fb9vCjT5T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775991732, "uuid": "0f8846d8-8ef7-4787-8134-48c782d8cd5c", "value": 317952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775991732, "uuid": "c22f1a17-abd2-4f98-9253-e4e757b32787", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775991732, "uuid": "4d93dbbf-f828-40c4-bed8-1167bd1c01c2", "value": "cgi-bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d49562fa-366d-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1775998077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998077, "uuid": "29569581-78e2-499c-b89c-ae46500116ab", "comment": "Malware payload (Gafgyt)", "value": "88114dd513f96890241e784ac4b5df77", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998077, "uuid": "acc46678-ba42-4dca-903f-39fb53c6b78e", "comment": "Malware payload (Gafgyt)", "value": "38d795d31c30127d0980a08e26d34dac8fa2cb61eb0de5b0217707f02cdb39e1", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998077, "uuid": "c0fbeabe-f6b7-478e-b850-0769db3f027f", "comment": "Malware payload (Gafgyt)", "value": "6b6b3057148d7285d60bed305aeb77bd5513b636", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998077, "uuid": "dab33d75-7047-4bc5-b133-b28b78f9d2bc", "comment": "Malware payload (Gafgyt)", "value": "5d45ef7009527a3975f894429c16bec9f4ec2297eb7d61b892ed81aed5e949db75c85d459054b4d66f9836ca768b9828", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998077, "uuid": "9230ed54-2586-4dbf-9260-2ba9129cd427", "value": "T109D313C948809D0A5BB416327F7B002F58010D1DB3D86E5BF3B2D9A74659B01BFD9DB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998077, "uuid": "3595e151-bf3f-4188-883f-8e3bd989028b", "value": "1536:129eLx3GENYxga9fXIUgtfIBUOMTcKVcTBRpWrpr7eYyA6nZ9bEUQFkuYAg33NL:1u1ZPgtgiOolUNK5h2UUQmRAkdL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775998077, "uuid": "1f32faaa-d05d-4ff9-9580-d435a173bcca", "value": 130092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775998077, "uuid": "71661a70-65ce-4f32-a2e1-cb31b0ad1937", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998077, "uuid": "41361a94-2aeb-4876-a01e-c6a528b077c4", "value": "redis-conteinerd-shim", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6794f972-3631-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775972124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775972124, "uuid": "ea642d3c-34aa-4245-be9c-8f301ba84ed6", "comment": "Malware payload (Mirai)", "value": "1b710b3c2b3d0d2cf07e6ac440b0e52a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775972124, "uuid": "a98343d9-5eda-40ed-a962-02964f5c6ea3", "comment": "Malware payload (Mirai)", "value": "39dbb95d83c35dd6841fe21dc1ef27a4b498b526db3dccb99882e8fa4ac37d5a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775972124, "uuid": "d36fc6c3-f782-472e-b60f-1e48b5058479", "comment": "Malware payload (Mirai)", "value": "268169e9510f6d414a064fa37475008fce9fab11", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775972124, "uuid": "5167a19c-69c0-4d0c-9d52-1aafbceb52cd", "comment": "Malware payload (Mirai)", "value": "6287c6eb67e44cbb235894e62ce2a484df807ca95253eff0ff74a9046efe2af565dc5f1c555d586f23d2b26f10b25a73", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775972124, "uuid": "926bbe4b-2944-43d5-9530-679b95dfcff1", "value": "T1E9E52B156F900FFBD86FCD3356E94B02258DA40622D43F76B878D914FA9B60B4AD3878", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775972124, "uuid": "ad4749dc-6d75-4848-85cc-35937ffea84c", "value": "49152:X3H9Tdp5Ec6pK3739jtvTGzG/2UnvzQWAWtAqgSpMvPG7:9Td9l/TJ7pMG7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775972124, "uuid": "ccabe82d-3904-4d56-86fd-f0b60e9e7e25", "value": 3164404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775972124, "uuid": "77683d26-e2d0-408d-93a3-1ff478d6e596", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775972124, "uuid": "a40c3c7a-1b9e-4b8c-a962-0fbc224f31f3", "value": "ciubuc_mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04283141-363b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775976252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775976252, "uuid": "2af886da-7ee2-45b2-a838-19c5cad681b5", "comment": "Malware payload", "value": "530fa158fd6ade8d0fa457dfabd94048", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775976252, "uuid": "fcf26bad-7c07-41b7-b4e9-a99331be2ad3", "comment": "Malware payload", "value": "39de38944110748fca8c0c971f7399dfda4c0834f2c7008cbd9e3b5d54936e06", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775976252, "uuid": "d65fe1ae-3036-41bb-a022-bab5d9d9b7b3", "comment": "Malware payload", "value": "01d98c5c39ffa5243325a40df4850d24288c1edc", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775976252, "uuid": "5073b4ae-252a-47d2-b84a-b127f909012a", "comment": "Malware payload", "value": "e95dcbd008f0be6affaff20024001c95743c0ea0752d02a872ec3b92a1bec44799f94b79bc442beeaa5fd09d17b6651d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775976252, "uuid": "53223eb1-0410-4fe9-9adc-5691a130af6f", "value": "T164441A2D6EC685670CA451C3AFB44FF4B4622B0550B47B092F0A29662F57F39276B8FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775976252, "uuid": "3df4635f-71e0-44f5-af4c-bc11ff4accef", "value": "384:Fi2IBNXfcbS9JelbDNIu6YKQT7OYB7WRaNwsuP8YOCDROhS9JeOi2IBNiwOul8Q2:Lw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775976252, "uuid": "14b73857-10ab-4409-be60-f3b1630286c1", "value": 266834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775976252, "uuid": "a1358eec-5d82-4726-8658-ee17a84ab109", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775976252, "uuid": "93e9d628-4ee6-4a67-86c6-f56122be38b7", "value": "PO-HTSS_0410026_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "908d57d1-366f-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1775998821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998821, "uuid": "b8ce62bd-64ad-4049-8dbd-1252f9498443", "comment": "Malware payload (Gafgyt)", "value": "b7f22ebd21270d86d75bda289ffc2b10", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998821, "uuid": "f70a0351-01ee-4c9e-8e6e-cd0270c239fc", "comment": "Malware payload (Gafgyt)", "value": "3b196593f9d94d1d39ad62211dbaa8b15d0946d61605c5365100b383818836bb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998821, "uuid": "c5a18b77-5f6f-4fc1-9ee8-c067e1b27e91", "comment": "Malware payload (Gafgyt)", "value": "32d9522234102e4bca3abcffcd6cfd3db87a5de9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998821, "uuid": "a4112c6c-b55a-4b64-a0b7-5c9c7b3c9817", "comment": "Malware payload (Gafgyt)", "value": "958ca93ea42fb48f2f2a9487f40a500fee96169d8eb6e52cf6ccb4d393367ae9fb67bee2ad11b281af9eb80307d865d5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998821, "uuid": "d1fa37a6-2d1e-4055-a233-5482a69fe72e", "value": "T1ABA31281F6C118845F0869661D4DEECF690DA3E2422CD2B563A0C8DAB47DDE4D3F74AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998821, "uuid": "74bb66e2-8419-4a3a-932d-391d4deb4808", "value": "1536:Ae6QRpSoffWSQ4nlRz9TGzOTkHaJB0HTHgEzIIolK5tn4MGRmOqvaPNul29:OiNf/9jGh6b0jgfIolet44a1ug9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775998821, "uuid": "d3387ee9-a68b-4556-bb0d-63c239c74f7c", "value": 104040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775998821, "uuid": "f12d1a36-db4c-4ad6-b840-652d2d0ce354", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998821, "uuid": "54b22f04-8589-419f-ab71-3a2d6fea1f9f", "value": "redis-initd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cd7851a-3646-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775981125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775981125, "uuid": "5426f98e-88bd-411c-898d-fbd221701737", "comment": "Malware payload", "value": "0d69e5fbfb421096cfac6369262ee63b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775981125, "uuid": "1c31babc-955d-4a63-9943-2cb8e424d555", "comment": "Malware payload", "value": "3b4b474e294bcc558b971a20b866652a61e00722079554ae0a03053b3ae91a42", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775981125, "uuid": "9f847a13-6594-4c81-9d2e-85af191502ad", "comment": "Malware payload", "value": "580d126d6e32c7c67bc6928a5aeb3763c0a9babf", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775981125, "uuid": "f3104be2-0f2f-4350-84ac-61e4e61cd0ea", "comment": "Malware payload", "value": "058141d3649ae251ecb6b5022ce24ba9373946be18fe9ba982e032337d8a996e565138e384127f3f418f364d86760129", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775981125, "uuid": "341bbca9-a6e8-4384-98ba-ca5d9ae668ff", "value": "T1A81101070BA85673D56A0B794AC641067BA194F007C393071F91A53A88463915CB4E21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775981125, "uuid": "9db6afe6-df8e-465a-8033-990a121af3b6", "value": "3:GltlVg//t/vkxdlldvl5vxQ/8l9l9l9tll0l8lvl//lvFI/t:ya3t/88SK1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775981125, "uuid": "4caee79b-7bb5-46a7-9e63-14fe8377a1ad", "value": 1024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775981125, "uuid": "60bccf6a-861b-4c0b-9bee-cf6434948ad2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775981125, "uuid": "2d1fed62-7e7b-4a2a-a107-bbb6f9b6a40d", "value": "test_windows_detonation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15f9f506-368c-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1776011071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776011071, "uuid": "350f3333-d992-4e10-9bde-ff5e752cb02d", "comment": "Malware payload (QuasarRAT)", "value": "0d01639976e4e658f74ef82e7fc671e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776011071, "uuid": "59a663a9-ade9-4b30-a88d-9e9cb84ac73f", "comment": "Malware payload (QuasarRAT)", "value": "3b82b24a851210b94f8db3db951b4a3a0ee48438c36f8c845827ef4bd67d1760", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776011071, "uuid": "aa861ff4-5a69-4e0f-b490-64ba488ec2c8", "comment": "Malware payload (QuasarRAT)", "value": "60426d227c05ea9816fa3d8f4c017793d9cb6990", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776011071, "uuid": "b4855470-8fab-4734-898f-84b727751974", "comment": "Malware payload (QuasarRAT)", "value": "5422e97e813ac6bb283b71a27b4ca3604e698711e179654238e9e75e577544ae5a6ad28995dcc283df76ed4a10584de2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776011071, "uuid": "7cd5fc6e-77cd-45cc-b33c-e11be71706cc", "value": "T162873312E387699DC9A7C6B89307E773BD307C084139BF63A386CA332A51DA1916D74D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776011071, "uuid": "87699d75-ee97-4191-9893-d8dcf67c8aeb", "value": "4e09edf4d2c143776135d0d82a980620", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776011071, "uuid": "399d6b65-a1f2-4834-99b4-501ab2631098", "value": "786432:hjr9O+WuQPJ+Hjup8iuZwHIb59+3x9a0QZNtU8Eerb93m87ZhsnfPd+YZfqR:prYzJRbc9oLDQZNtpZrb922ZhsfPd5a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776011071, "uuid": "39bd4048-de5b-4335-9192-a30181a45f3e", "value": 38023248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776011071, "uuid": "cd045680-3ae9-4886-9f92-b676365017b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776011071, "uuid": "3b0e2f93-e4af-457a-bd56-0ada7c48f7d7", "value": "LetsVPN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e47d08c-36a3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776020964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020964, "uuid": "bed2dcb3-8b07-4db6-b362-71b20d6fe9cc", "comment": "Malware payload (Mirai)", "value": "c252dd890eeef1f22ccb3b29c88e0b4d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020964, "uuid": "50c72a51-5a10-4eab-9b15-6a79d9742306", "comment": "Malware payload (Mirai)", "value": "3dc13fe171d2071f88fd1e4d6b28e0a50753bef309539aeff65178e5b4b47f72", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020964, "uuid": "59898e1e-052d-4ef5-8d80-979cfa1bc0af", "comment": "Malware payload (Mirai)", "value": "a7a3fcd29a83bc5e6ad1d9f0e7d986d0e88cc99e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020964, "uuid": "1fb3996f-c577-4d39-a16b-0273bd84fe89", "comment": "Malware payload (Mirai)", "value": "f5812dfe00a39b08b4fddc9b3fb5c0bc6757d41441f0b8f2b1e21f6931d649870ea8f9bf03b59525c944b7d3575babab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776020964, "uuid": "fd55435a-7f12-4389-b891-5dcc173c8f8b", "value": "T153D42955F8809F61C6D139B6F75D42A873074B79D3EB72069A244B343BEB86B0F3A601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776020964, "uuid": "380d2261-d665-4919-83fa-07bfccdf21b2", "value": "12288:p1IB4vMBCOIHlRWRNHIASL8KWqSeMHr5AA+g8pbExQ:bIB4vGalcfInEqS7V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776020964, "uuid": "3bf35bac-b101-4258-9d4a-da321ff0ee5e", "value": 641612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776020964, "uuid": "8421ce46-ae78-4846-8e2a-749f8f5e5fcc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776020964, "uuid": "429eb3c9-ecf4-4eb1-80d4-8b19a5f927ee", "value": "bot_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ade093b-3658-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775988826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775988826, "uuid": "d050e8e4-37f1-4344-8cad-a5ff20180e04", "comment": "Malware payload (Mirai)", "value": "39aa8911159b31c26cb36ec4b11362de", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775988826, "uuid": "5a196bd3-eb0e-428c-b73e-a971170863af", "comment": "Malware payload (Mirai)", "value": "3ec9e137ab496ec7c9e3850d4affef1e35caef2841ba879dc9041fea712bcff0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775988826, "uuid": "ef053466-7576-4f00-8832-342d3571b10d", "comment": "Malware payload (Mirai)", "value": "b5777edc0f64dbab635620e3e9a645b4c039a67c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775988826, "uuid": "06c846be-9fba-4541-8654-0b660c238b44", "comment": "Malware payload (Mirai)", "value": "c15f074152d4ad02a890e21ea88dc7c712ba3a35d3f7d5bbf5f91d776c4291a7dab2158c5c15eb654b2d4991a60bd333", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775988826, "uuid": "a91118d9-369e-418d-ae29-1e169a7e2fda", "value": "T102B31CCABC818B11D5C656BAFE0E61CD33134B78E3EE7113CE185B2D674A86B0A3B551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775988826, "uuid": "4fa93677-8042-46ca-aab2-9c7ecbb60c84", "value": "3072:4j2WN7Edp8fG9EbXf5UxZuset/25TZXU4t/PnqmoKC6In4:c9flRUxZuset/YXb/Pqmvn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775988826, "uuid": "be443e7a-4a84-4080-8f0a-ad040bc5a019", "value": 107900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775988826, "uuid": "c8846ce7-a505-4705-a0dc-c4e290b9f393", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775988826, "uuid": "3f932e59-4b92-459a-85a5-374c84a21b4e", "value": "splarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40ada893-3632-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775972488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775972488, "uuid": "61318ee2-ea64-4f15-ac77-5b9a8b751e63", "comment": "Malware payload (Mirai)", "value": "38b34c5f90371835ceab5f32829b4531", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775972488, "uuid": "34c2f00b-c6b3-44d2-a359-d27bf8624a2b", "comment": "Malware payload (Mirai)", "value": "3f941e25b0bd671da7be9eaa0e1f743d4bd4f7324cf12c4a31c1dd8061fd7f75", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775972488, "uuid": "e2d345eb-c010-4108-8aa8-34137514eb0f", "comment": "Malware payload (Mirai)", "value": "e041e3685e52696274ff0bf2e9b3ec6661ea9869", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775972488, "uuid": "9e0e6ad1-5f90-4e15-b74c-8f5a3cb65636", "comment": "Malware payload (Mirai)", "value": "14a87105d146ae0de0e70b6d3befcc3e96ed0638fcb302a3c396097307e8c0a5f5a1d6e5cd4be7a2b55d4e0bcae042f2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775972488, "uuid": "1931a1f0-0a2e-4b71-8e95-21939ae05999", "value": "T155B57C03E683C4F1DA560BF4125BFB7B893699164121C963DB98F929BD72312E70A33D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775972488, "uuid": "829f30f1-9b1c-4f5f-bfb1-f0b1141f8171", "value": "49152:7TK3oDoEDzAmKrjljve3X4cMxxppkVo8:7TK3jED8m6vm4f7ppi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775972488, "uuid": "ad04a162-8c38-41f0-b0cd-7df385c79c88", "value": 2411416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775972488, "uuid": "5540c2ef-d28c-411a-9126-1ff85b30bd2e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775972488, "uuid": "e7708860-79e7-4d71-aa03-e86e6cd90eae", "value": "ciubuc_i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "856c7b55-3688-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776009540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776009540, "uuid": "15e3fc5b-d1ca-4d51-94eb-b59bdbe19f6b", "comment": "Malware payload", "value": "ded3144b72e86b5b00b231ba8363af9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776009540, "uuid": "bb134d88-cd0f-4978-bbb3-cbb082563c28", "comment": "Malware payload", "value": "3faa6ee5b544afa0d2a0a73ae3e4f9f181a3e635ec9bad1f75eae33b2908fdd5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776009540, "uuid": "4867dbcb-9e4f-485f-9f63-cb97551f51dc", "comment": "Malware payload", "value": "9643ae65c39421f7b1f9a5f116b6bebfd1fb4c29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776009540, "uuid": "e36aa27b-6e02-42c2-b019-a05bad62aac3", "comment": "Malware payload", "value": "8a42f6213e7be9595f8978a7bdf835b890219ce8e2ee01bfbb33945cadcf583183dae5690d65f71c4cee8e8a66333805", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776009540, "uuid": "62136837-72aa-4d51-9044-7d2c0df4088c", "value": "T1F7C623E009D156F0D0DA0720B18B579E6481A9AD91FD2E093DE16C475B4CEAE284FFFB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776009540, "uuid": "60662683-0fe4-492e-8ab4-d8ccc00fdf1b", "value": "1c6154cd25d5ff1274f5a46422ab9443", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776009540, "uuid": "4134ae67-9380-42b4-bdd6-f378b1a0ffdd", "value": "196608:GcHfQ8++fuEzs/lX9QKzgg0wQENH7mcMLjcJR5ydJ781TqKy3yswJ5V8K6B:GkfQafQ/510g0wNfMLsydt81TURgVG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776009540, "uuid": "2fefd6a8-f4a6-4c4b-a987-899794badf79", "value": 12382208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776009540, "uuid": "0d12bbd9-278f-4170-9cdc-b550dbff4364", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776009540, "uuid": "d690114a-dde6-4b45-b49b-ec32dfcbc0b3", "value": "amp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0ec34ab-3657-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775988622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775988622, "uuid": "50aa7162-000e-4e64-8a78-4331780712cb", "comment": "Malware payload (Mirai)", "value": "c4687c1f7d0957513b674c95a71e3870", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775988622, "uuid": "81ee10f2-7d4d-4d7a-9e44-9ff5615354a3", "comment": "Malware payload (Mirai)", "value": "4006734e924b7288acb33050e18966673dcef5725af55f1748af6b8b923cf0ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775988622, "uuid": "954055e4-5450-400d-b4f7-515e7dd011dc", "comment": "Malware payload (Mirai)", "value": "4e2b8039f7faa9715e59c4197ccdc8977dd6009a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775988622, "uuid": "a1157e82-0218-4a9d-8831-74e24aacfc44", "comment": "Malware payload (Mirai)", "value": "a6d37cfe9ae1456b485d9c25c224f25edad52240594118d6865cf9f843454b694037194b0ece11043b984762dd3d5df8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775988622, "uuid": "8a952048-6849-43ce-80e9-5d979c44cfcf", "value": "T1E6A3490273654447F2E74DB11C3F6BF2A7EFD5A121A0A286694EAB0F8135E321586FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775988622, "uuid": "d47db771-6d42-4fcb-b553-ac3042d877e0", "value": "1536:p1bpHcOOTWQe5bkrLYIHiv2f9soSGx5FUXVomGig4t3l6uqzcJ9eEJUaLDd61ZnQ:2OOTW7sso75FUXVedBMJEEVQnLk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775988622, "uuid": "c30f2a95-ab61-4fb2-ac3d-969273eead85", "value": 103916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775988622, "uuid": "1d3964d9-359a-4b2e-b164-9db98e08402c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775988622, "uuid": "78f71841-1f4b-4340-9909-376c11a63ca5", "value": "splppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db67353c-36c8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776037172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037172, "uuid": "72e2b184-e88b-49dc-af82-e024c339f37f", "comment": "Malware payload (Mirai)", "value": "82cdc6cc6c31d1875ee9e91c332cb2ed", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037172, "uuid": "67283128-0f88-483b-bbcc-8f9192d32672", "comment": "Malware payload (Mirai)", "value": "40115d502e72d412604c572d80bd9ea9df4cc75293eba2b17cc8b0e6877fa545", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037172, "uuid": "898f16f4-6669-4d8b-a4cc-fb4183521b0b", "comment": "Malware payload (Mirai)", "value": "632ffd38ec31497e6bb5a81317eea1ec970974b2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037172, "uuid": "61c5cee6-8132-4215-b452-d7e6e1cf4961", "comment": "Malware payload (Mirai)", "value": "45a0cdd173b84b375703de046723a26a8599f244b9ea3d8e2e4a5f18e61b1ec51ead5ba54d4951833cb9f8a45a915d8a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776037172, "uuid": "a45c4872-e57c-4e59-91d9-901e55e35b71", "value": "T19613F1EF9DB27603D97D1877625215D5ADACF3C1260F9F5087034A85FE2C786B10D0A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776037172, "uuid": "0be692f5-e7ff-4455-bdea-7196b44a5eb1", "value": "768:zb2jPbFp8UeiR9VCReVQKYPOyJEBTCAdxYsvYi1hVOWnfEUe2Wl9AWS:zb2jPbApirVOeVWdJEhRYi1hhsUed9U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776037172, "uuid": "d860237f-0e1a-498e-ad2c-0041d62c51b5", "value": 45032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776037172, "uuid": "e917dc2d-940c-480f-a71c-21e0c821d911", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776037172, "uuid": "9e0daa07-289a-4d61-a143-40f2b6dcd731", "value": "Hammz.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5d05e73-368b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776010937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776010937, "uuid": "69dbeb31-a46e-47f1-b778-0bc9440f7aa6", "comment": "Malware payload", "value": "b3ac76cbbfa27d4a1bc6e2c86e33af42", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776010937, "uuid": "5baf3e78-2476-4a36-a834-a34f7f2dbd75", "comment": "Malware payload", "value": "4070678717cf011417c9e4307c9ecb4d481563db4758ffaada5fa6870e06a4ac", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776010937, "uuid": "6ee5d663-1dba-4817-9d55-dacbaff6f028", "comment": "Malware payload", "value": "7b99cfd811d2de5dd191151a42c102036c50bb08", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776010937, "uuid": "bc4b9a29-dba6-4b97-8a98-cf0c78f7a71a", "comment": "Malware payload", "value": "86e90a15af4ca5d67be59071f47d492f017237c180f0d3792792acec0f4a1e440750e75c81ccab65847b2286d4458ed0", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776010937, "uuid": "399098cc-ddfc-4fd2-abcc-004f43b7237b", "value": "T1976423576F509EB3CE1F55F651E4612B2FB1774181646B4F1B0F4278AAE2A320EF2821", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776010937, "uuid": "49afbde7-96df-4369-ab1a-92171bd84fea", "value": "6144:aaEdDdHklhDP/nfe8lGCLSNdBm5LzXJA2xhN9CK/F4ec:aaSklZPPW8GqSVm5FxhN4aF5c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776010937, "uuid": "844c52cb-ad18-4d3e-b368-59d1185d9ec0", "value": 312197, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776010937, "uuid": "ab63bf35-e1d9-4702-b0f8-ad9dce34b9ee", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776010937, "uuid": "11d7c595-baa1-45e0-b923-b0d286206b41", "value": "evil ph.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65415668-3631-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775972120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775972120, "uuid": "4ab986c1-ef05-4537-8f8d-cd7badd67d1c", "comment": "Malware payload (Mirai)", "value": "9d670a39d3df77bcf156ddb5b6f17631", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775972120, "uuid": "8ae6cdd0-da86-4b00-93f3-16236a0519b7", "comment": "Malware payload (Mirai)", "value": "410498090afa41352ae2da53b4ecd74e9f40061863c056f1e581f3c5108f0f8a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775972120, "uuid": "9eb58dde-d88d-4aa8-857e-baa1d425ecea", "comment": "Malware payload (Mirai)", "value": "158b9f5ca4e544c47d10e69b93ad4d74b9aa768f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775972120, "uuid": "104e7eb7-a4f9-4c88-9139-d5d499d0a9a7", "comment": "Malware payload (Mirai)", "value": "43f589782a7543a0a32dbdd6594f058e3c32db92e80f7e4e55a54d79c6500fae56ea50750ae2ef03436d6bc6a1710f94", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775972120, "uuid": "d830929f-0ea4-464b-97cb-4ec25fd3429c", "value": "T155E5E91B5E319F2CF7B487344BF34B34E7AA22D617A1D980E1ACD1145E6424E681FBAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775972120, "uuid": "01da3ba1-0ba7-4fb1-a722-b541f8b3e279", "value": "24576:nnMkmAjUa6h/I9krprGG4WqzXHqc35gXBaL9UHFFqKsICwonU37qYu0okHhHpNxO:vmAp1WYHuXBaL0qKsENJxE6vPbosI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775972120, "uuid": "3307d5fb-8f0e-4230-83c5-f59cd08e474b", "value": 3166420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775972120, "uuid": "9ceeffb4-2052-47a7-99c3-a53755fd4703", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775972120, "uuid": "cb269f62-0deb-4dfc-8c86-29f1055aa295", "value": "ciubuc_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f89b4cb6-362b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775969790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775969790, "uuid": "a93d3c72-20d7-4cac-ae3c-7eab342ef869", "comment": "Malware payload (Mirai)", "value": "82c1bab1d229caf18ddcd6732664c90a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775969790, "uuid": "cd6ab286-e081-428e-9efa-ace79f5c8b12", "comment": "Malware payload (Mirai)", "value": "43d1311c51fd07e6a5e9d1b2b0d3926cfd3c6c757d1cbb59e6a4291a176a15d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775969790, "uuid": "ec4387c5-4af9-49f5-accc-65b2890388a6", "comment": "Malware payload (Mirai)", "value": "1baa880ce72b1b8a3134d53fe1ad4949aa33bbea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775969790, "uuid": "2db79e72-18aa-4984-b4ef-b169bff3091e", "comment": "Malware payload (Mirai)", "value": "63972631f694daa327ac39e3d3554daa8f4303fd2f82ba6cedc6c9ba444d9a179555ca83e04141283fa1a734dc862dbb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775969790, "uuid": "998aaef3-0e2a-4ecb-b48f-cef866e9213e", "value": "T1A1C59D629968BFEFC526D571A538CEF20B53680052160FF63996E3B44947AC2F3067F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775969790, "uuid": "d75eee11-9e1b-4da3-9fe1-24352aed7fb8", "value": "49152:5ARHGcCle3OChduWbcUDzH/Aaw+p8sclUb+Ug8ESzgVpmvPse8:mmQ/fLErpmse8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775969790, "uuid": "2bb9677b-f86f-4ebe-8477-b7356e295b68", "value": 2694952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775969790, "uuid": "07c313f4-df82-48cf-bd7b-e46378bea2b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775969790, "uuid": "9a54d462-04cb-47c7-85dc-07ccff141daf", "value": "ciubuc_sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dde3a393-3655-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1775987784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775987784, "uuid": "cb0f70b5-f24e-4663-8d30-cb738ed180e7", "comment": "Malware payload (CoinMiner)", "value": "a07ae9cb4d29460e13fea3eea1885a5e", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775987784, "uuid": "a87d1bb0-1c9a-4147-a149-80784bd382c0", "comment": "Malware payload (CoinMiner)", "value": "44d2e656cd3641bc336724fef0692528b309a189fb5ab18861d0d498e5164437", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775987784, "uuid": "b5ac521d-4d5d-482d-ac79-9611520ad814", "comment": "Malware payload (CoinMiner)", "value": "a10ab46f014356e673041d9783ad530ef2186616", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775987784, "uuid": "7e6e4a3e-2c0c-4c88-9788-60850b2478f4", "comment": "Malware payload (CoinMiner)", "value": "bf3a09252607ac09f0abd3cdfe7b15886bb2b7fdf568a3854972e6b2d31cce067ac0034a7c1869d84ae87383b9424e58", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775987784, "uuid": "f8b11eb6-de93-4028-b52c-b36e534042b5", "value": "T1ED13E9E5FCA9D93031355638BACDD401FB670A37055A3104719EAC187F3C799E1AAE2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775987784, "uuid": "e134ed18-4a4f-47d5-942e-f2ea77bb4a7e", "value": "384:1aRKQ0VXvoQ2itS7s3RWA0m+EwvE4qN0MH8ns1irDy07Srgb6zakqpxYAVAD:1aMQoio334qf8ns10DCx9Ky", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775987784, "uuid": "81cb6874-c1bb-49b4-b1b5-23c831409e5a", "value": 45302, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775987784, "uuid": "eb94da53-c4cc-4025-8e0f-0a5ac987bdcb", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775987784, "uuid": "e194e12a-0bae-4071-a695-420201b9e91d", "value": "q11.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fffb8a5c-365d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775991277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775991277, "uuid": "b60c4d51-a619-4c9b-ad55-978187ba77a4", "comment": "Malware payload (Mirai)", "value": "f1fcf4a4b7a84e55697f03ee7781f37e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775991277, "uuid": "822732af-4173-49aa-9812-49130904e126", "comment": "Malware payload (Mirai)", "value": "459af02f0f41c767a4835138ff12243f3b8fec3dc7f0daaec6ba5966d2573d59", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775991277, "uuid": "518fa4e0-5f40-4286-a0af-5c999f84a6d6", "comment": "Malware payload (Mirai)", "value": "c00f083e437723550245156763e1e2f41b4120fe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775991277, "uuid": "1f7fb6de-cee3-458f-b772-bc465569e0fb", "comment": "Malware payload (Mirai)", "value": "ee72bceb26d9818d288267abc7d71971a3c066165fbf7e1d997bbca44ece1a5d5129bb1fbfb4a5943f7aa747a6559b1d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775991277, "uuid": "7fb02035-f8cc-4a9d-ae48-7cf894f87d69", "value": "T1F9D55B41EC509A13C1D15BBAFA7F82C933332BB4D3DB70164D18AB706B96B5E0E3A945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775991277, "uuid": "5aa95471-5291-4139-9bba-773c8ecf49de", "value": "49152:BMYRhCelUldZoz9wl3jYEOSZWvPla1vMyqKya82xyPgAKR03:BMYi9Z+OkEFZWla1UyqKya82QPFKR03", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775991277, "uuid": "ac23896c-6be7-497f-a57d-1b709ae1c8f7", "value": 3017121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775991277, "uuid": "a786d4ac-a0e7-4df9-aa09-b9e98c4099e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775991277, "uuid": "dbeea7e7-a74c-4f9c-9365-28596d05a9a9", "value": "ciubuc_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3a12bee-36af-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776026449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776026449, "uuid": "a05baf8b-6737-4001-bc6a-5386dd3b6602", "comment": "Malware payload (Mirai)", "value": "562dd0e546942e44488654787db7c6b9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776026449, "uuid": "5743b305-736f-42db-ad35-fb19591314c8", "comment": "Malware payload (Mirai)", "value": "47a6be407d3f7d633b396e32f3f9c11dec9c7e7761650bf1ca3d0ec51886ec11", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776026449, "uuid": "059f11f8-b3ba-4b62-978b-cbf280189255", "comment": "Malware payload (Mirai)", "value": "0448c1ef0ba2cc9498a00d6f9e6a74b0514da761", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776026449, "uuid": "f5f2d02c-dc11-4ff4-af60-19ff46f30dfe", "comment": "Malware payload (Mirai)", "value": "f20cf2f21b19fa5858a8af7fc63fd318836ce6ff3bdf39ddaf543268d7f1ddc82810890f0179ea45d5d0f6444708fd64", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776026449, "uuid": "9127a23b-e51f-422f-8a0d-620edda0d627", "value": "T1A2B56B43E683C0F1EA1206B11117F7379A399A154136C9A3EF98AD39AE71742E71E37C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776026449, "uuid": "552e463d-b13b-4865-81b7-1cebc6a9e320", "value": "49152:Sx8SdDeQetAaEMuLZLEQFibuVfDidafpekVpDf:GdmtoZiYfpeA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776026449, "uuid": "bb93a1ff-b8cb-45ee-a991-49217ddeb03c", "value": 2411388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776026449, "uuid": "d16f6299-8cb6-4f27-b2ec-26cef7b29a5e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776026449, "uuid": "00d1efdf-64ed-4580-a071-db6ae343afd7", "value": "ciubuc_i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a99849cd-3663-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775993710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775993710, "uuid": "b5db1578-3f7a-4bf1-9eb2-730e45ca0f57", "comment": "Malware payload (Mirai)", "value": "573494fa89bc57f006791869ba4d2788", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775993710, "uuid": "93baa03a-56cf-4df1-8ecc-97ad39b6b5b6", "comment": "Malware payload (Mirai)", "value": "4869033bd86e5eac8d838ea9037aa5e09a8d9d5b4d5b599cd7880b2bff8ce920", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775993710, "uuid": "c69ee147-42fc-48f1-83a1-9737ec2eb9a9", "comment": "Malware payload (Mirai)", "value": "6d3aef69e254ea7fa8d916e8b7140fd80744f33a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775993710, "uuid": "0c08cfcc-86c0-4dfc-afca-dc2610be4706", "comment": "Malware payload (Mirai)", "value": "4ef025adc4476bcaef0d8f2f770d1425e9a4f77396653128e471faa3fec90100e96072e73a53820c54640c90f18e223e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775993710, "uuid": "c754b5f4-9d34-459e-a859-80d9ab5085df", "value": "T1F7730A46B9818E12C4D512FBFA6E008D33227BF8D2DF7212DD106FA4778A5AB0D67712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775993710, "uuid": "95b8fd35-1894-4d8e-ae77-4220ace626f9", "value": "1536:kNn4cmyFCnViZkms0eo+4zbh30mMsZvNzSJI7dn7MmilUsazM3d42+Zj:amyQVQkz0CSSmt9gPUsazMNsj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775993710, "uuid": "22af1e1e-a2bc-4c03-86d3-19058744f292", "value": 77396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775993710, "uuid": "63c90c9f-dee2-4e80-a36e-209eb5349ed7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775993710, "uuid": "9aa5f75a-cc37-47ed-8ebc-6bae524de082", "value": "jew.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a5981a1-36a3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776020957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020957, "uuid": "669506c2-92c5-4be2-87e2-a31f834d1c8d", "comment": "Malware payload (Mirai)", "value": "41ac84848b5e44936d0c72dfe2fb2ee9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020957, "uuid": "b3fc6b91-0abe-436f-8b45-5537b4458bff", "comment": "Malware payload (Mirai)", "value": "48b7dbee0e53fa4cb62959cde8b2594dd6716e1b385fd4e05df87a1d5e285c43", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020957, "uuid": "e503b976-8853-4587-8c69-566e38d758a3", "comment": "Malware payload (Mirai)", "value": "2931e7527faccd3fbd29019e4552668d27b202ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020957, "uuid": "ab5d44f3-ff10-4496-86a4-47e715053a24", "comment": "Malware payload (Mirai)", "value": "9890df755142e3a81bf02cdef1302926a0fc8459c98ae5db99211781dd83b0ba18e24538efa2237d79c8c55ceb16af12", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776020957, "uuid": "7adcc072-a654-49b0-a873-f1fd0c5b8b9a", "value": "T1AFE48D9AFE0E3C42E3D7E37CDB4993A1A22B35E1D32351627942030DD5D6AE9CBE1911", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776020957, "uuid": "6a6257d0-49fc-45f6-bd5c-1d4420d79cab", "value": "12288:yD9KUVi0tg0rNq48W0d5iMSZTl/eqhEv3IYs5htBs3U:yZKUC0Cjd5iMyDhEveG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776020957, "uuid": "c402bc3d-358d-4d89-b311-e20c2cbc088e", "value": 690608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776020957, "uuid": "4227aeee-f6c3-4384-b408-9d1893deb629", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776020957, "uuid": "5d19d985-fa27-4514-9749-c1cc3f05a394", "value": "bot_aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07767b16-363b-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1775976258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775976258, "uuid": "6aadef15-692a-4476-81ec-827e730af564", "comment": "Malware payload (Vidar)", "value": "d879dff22ab6235ded0b580f999aee36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775976258, "uuid": "ae1a6135-a45d-4097-8e41-046f90dd1dfa", "comment": "Malware payload (Vidar)", "value": "48d90beab7edee47b4c89c378cda7d0673cdfb13ae1fa30908f27c9cd8ac6834", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775976258, "uuid": "8d7dd33c-a7e9-438f-bf32-d357298b27ce", "comment": "Malware payload (Vidar)", "value": "813f8731d32c2ad449b23e90e4c7845f26f0ba56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775976258, "uuid": "c1f6ae56-8612-487a-bbaf-6709f785567e", "comment": "Malware payload (Vidar)", "value": "fbadfaa6d1107dec0f841c5d96ec7158e925c8bfd493099765f42949cd6f378b21f300f9f955af43eb3cc936600a7138", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775976258, "uuid": "26e21b51-dec8-4110-a165-43b8f58ac72f", "value": "T141D57D176DA145FAC4A9A7328CB61191BB34BC490B3223D32ED0B7782F767E09E78754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775976258, "uuid": "50a6a851-2364-4ec8-bf39-13cd1db9e238", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775976258, "uuid": "dddb91d0-42c2-493e-8cd8-97552974d56c", "value": "24576:Yp2f13ooOTPRMwui5yxPBTqxNavf6eBC5DXAeGt6gh8WHlOOmgZH3Belehn9mYyX:YQdYo+RMhlqxNNeM5Rsl/RQfv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775976258, "uuid": "48a5fd9e-0d73-427f-8b6f-f23380d2bea4", "value": 2867928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775976258, "uuid": "86b23dab-defc-437b-bf3b-5d344de0bc71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775976258, "uuid": "c45d3480-19f6-4b31-9527-a86bb5b21296", "value": "48d90beab7edee47b4c89c378cda7d0673cdfb13ae1fa30908f27c9cd8ac6834.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fedd1eb-36c7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776036428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776036428, "uuid": "19b0bdd8-5c91-4996-9df1-4cf7858c7bdb", "comment": "Malware payload (Mirai)", "value": "9e6930334c96c0607b249e96a5e2422e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776036428, "uuid": "70d32d00-f3b1-46a4-952f-e9ad2108dec1", "comment": "Malware payload (Mirai)", "value": "48dae240d44d8929a690576512aa157e510ba17cfaa68ad2a459a8af33b04a90", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776036428, "uuid": "d024dc97-3ea9-42de-a0c2-cf02e2b4ab66", "comment": "Malware payload (Mirai)", "value": "9b521b341a0e11ad398d40ea49271219df5a43a1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776036428, "uuid": "8197fa03-041d-4035-8eed-73f962ca0374", "comment": "Malware payload (Mirai)", "value": "a092424134097d3f285fc2df678d655ffd53d242ae7a92e79d1735c867b52968f1586e3b87e492e98dd95b6e8a74b958", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776036428, "uuid": "c9e72c00-dd73-4e3f-82e3-fc266950d2ae", "value": "T194649D16EB0A8C66C15606F98ECF075D5333C0004F1BDBD77E2C6A38BE5769EA95A780", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776036428, "uuid": "3fbe7879-a0b7-49f0-a91b-aa26adc592e6", "value": "6144:nL/yNxQfdg3MTXTt0GrCDdFcnyqSiHfqV1+i8XmvU2U8:nL/MtcnOzDEy/5+jXmvU2U8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776036428, "uuid": "2a800de7-b1e1-49e9-8bbb-6432947c69fb", "value": 318952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776036428, "uuid": "8586c068-a905-4fb1-b31e-5034e578415f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776036428, "uuid": "557e26ec-e592-4ed2-a7ab-de3f812e670a", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3226c8ab-3648-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775981913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775981913, "uuid": "937a27a6-ce71-433a-a45b-a5ad81cb3783", "comment": "Malware payload", "value": "ab368a36f8644395340221a6261757fe", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775981913, "uuid": "fec356a6-dfd4-419c-b4d5-94ef75b2111a", "comment": "Malware payload", "value": "4a5d990946d332ddc65fa8224b88a8426b16e29ce67afaf3dc11f377198c8f35", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775981913, "uuid": "c0863027-71a8-4845-a2e1-d29de2d9ef15", "comment": "Malware payload", "value": "13dd177ec03c01a02421e8b65c9331b75cfab11d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775981913, "uuid": "1edc881d-e8cc-4767-a93b-1658104b1c66", "comment": "Malware payload", "value": "0ecf796dfcba40bb680430d5e200ce414bfbedee9990247091409eff0602c81ada3afaab725a31f60569f8928c7e04bf", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775981913, "uuid": "f710278e-05bd-40eb-85aa-2122fb338aa8", "value": "T1C785122A2FDEDE17E1A49EB8CD765206C335B55086FF92A3CE664C2CC6267C07639350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775981913, "uuid": "f97bd406-86b8-4850-8851-745f96dad168", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775981913, "uuid": "ff5ef115-d37a-40d8-9472-c94e9e4a4c41", "value": "24576:+jPQIt1NpQwLciEUaWBBdjAimMoutGtdyKNsl3RphYOCvqbOilpzwKl7dHAwavPj:+j1hSwLcirBl+Mou85eRphYXy5iYO2H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775981913, "uuid": "803413fe-3680-47b6-be13-d2069353cced", "value": 1871872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775981913, "uuid": "be4603b9-956f-4aeb-8bd1-2c4a46e76270", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775981913, "uuid": "6491bebc-033c-457c-b066-4bf68ae4bd79", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1431b3d8-368e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776011927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776011927, "uuid": "ee458c80-f733-4d2c-beff-f13d00498b93", "comment": "Malware payload", "value": "55b9a097a507192430a4727c94dd4be4", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776011927, "uuid": "a80f165e-960f-4672-8a69-9c8e57490e76", "comment": "Malware payload", "value": "4cf809b14083143e921bd8fdb7e7725e20e303653d9a3e6c848d9596a33f6c8e", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776011927, "uuid": "e6517c94-3e7c-4762-b60d-662885b156dc", "comment": "Malware payload", "value": "096b3200b7ab2efbc6165977b8ea8123032855c7", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776011927, "uuid": "9589fc8d-bdf4-40d4-81f2-eafb9684b017", "comment": "Malware payload", "value": "007822af0d8e72c0c0f493a62184fcc139989e1169ed86b12cd2496734516d0167357cc93730992082874eea40c9ede4", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776011927, "uuid": "312db2d2-6c88-4c85-bff7-3d3689997ddc", "value": "T1AF041352C7A99C66C72D5C3AACF4D13AFFF2F36681D087870516E1A898714B9CCB284D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776011927, "uuid": "9ea8eb86-7dd7-4eaa-8ce9-8c334395729d", "value": "3072:IbcP9hk9mdLhPd9rTysyTJsfMTFswu00+wBMAghNZV68C69/DkaPOb:Ibm9hf9h7isyTqf8uOhN9CK/QsOb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776011927, "uuid": "16d8ea2a-b654-4bb2-b322-7d00217a07bc", "value": 180996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776011927, "uuid": "157b8593-30a9-4a3f-9dbd-6b5de999d63f", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776011927, "uuid": "ec9d18de-ab9c-4667-b06a-31ec282c0b4c", "value": "PlayerVideos20260409.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0b8fd3d-363c-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1775977052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775977052, "uuid": "bee59115-5358-45ac-90c4-3e4de403f3f0", "comment": "Malware payload (PureHVNC)", "value": "d5d4993d7cac529952e4339037c2fb60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775977052, "uuid": "35c6d66c-9e47-4843-b723-7138656360c1", "comment": "Malware payload (PureHVNC)", "value": "4e50c2f08a73ba7e18643487c23f87d5e200b5ee50940b06ca0d61b5815ef4b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775977052, "uuid": "2727126d-3c95-4d78-b374-56d267203ebb", "comment": "Malware payload (PureHVNC)", "value": "2a3ac326c3e7601604067feb9bbe51ff3afad18c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775977052, "uuid": "372f429d-e338-4cd3-b983-b324752bad3b", "comment": "Malware payload (PureHVNC)", "value": "ea30c653d1156976c6d518564620ee959cffa0674ed686b0b8a6508e6c297eb826f3e2d9d447cc171790db2bc006ad75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775977052, "uuid": "2edf5b15-341c-4f37-a419-d7de03e33e55", "value": "T14DE4AF97B2178E21D1442377C1DB9A8193E89B45B1A3F30F718523E619463EECE0B7A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775977052, "uuid": "fad099d5-d37d-4cb2-bad1-b94651e28cce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775977052, "uuid": "adb7b558-3ecd-4489-b8ae-e68559c842b2", "value": "12288:bJf+m9qqd+Xk5en28/kWuIo6+xOWNevltelm4Sl/97UOcMqNxL/CN:Ff+mSQWur6PWNCltelmVgMqNt/C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775977052, "uuid": "0e5ee6ba-304b-4162-a35f-d19fa88467a6", "value": 676864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775977052, "uuid": "49f513c3-f430-4434-9557-4d62e16c7bf8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775977052, "uuid": "4569f957-e73c-4b0f-8f20-1fbef0c34f8f", "value": "d5d4993d7cac529952e4339037c2fb60.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3714f412-368f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776012415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776012415, "uuid": "b00a3bf8-2705-4435-864c-b0e0bd0fcec0", "comment": "Malware payload (Mirai)", "value": "e4bc52c85d2f536fbc30e260266fd2c9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776012415, "uuid": "0a387bfb-2e9c-453a-9977-589e1335bdb0", "comment": "Malware payload (Mirai)", "value": "4ed7a70c1441ca9e7d486f89ff89bfe60faf5217ef219eaa6b483299650445e5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776012415, "uuid": "c57c4e05-b734-48ca-a1d1-d97e7cb59eca", "comment": "Malware payload (Mirai)", "value": "54e59ef83f2cfa7b263afa23dd9a3167497dc99d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776012415, "uuid": "e8ca83ca-f69e-4600-bccb-c603c805da94", "comment": "Malware payload (Mirai)", "value": "d922d3398c635b51fdec34148888b03a14d283f93d1ef771421271d1256f43939a621e86f3b303579cdea1b58ddf62b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776012415, "uuid": "447a6085-7ce4-488a-b5bc-197d642a7cb5", "value": "T13DC3C74E6E218F7DF368873047B34B35E75923D626E1D685E2ACE6041F6034E245FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776012415, "uuid": "3abf052e-0ca9-4607-af0a-9e0250fa079d", "value": "1536:kZL2huPXpW8V1YCs2WjHQAZXISSL9KXean+FF9+7KRzEMzEfbheTQarC3pYfo:8Y/jQgLMO6+GRzmfbqCag", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776012415, "uuid": "c830ee14-6fc8-44cb-9ef4-5702e1aa909d", "value": 118396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776012415, "uuid": "8358ddd9-6460-40a2-a42a-b96f016d174e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776012415, "uuid": "97d22885-5911-49dc-8902-1c4d00bb7983", "value": "titanjr.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4505d16b-36a1-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1776020170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020170, "uuid": "fc3431df-aa9b-452d-bf75-5fecff61d657", "comment": "Malware payload (AsyncRAT)", "value": "7fa30f4968b9602164fba34674c62ea7", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020170, "uuid": "18619503-e11b-44cb-9df6-b117e81f3483", "comment": "Malware payload (AsyncRAT)", "value": "4fcbe167dcd88e72b52ed43a3bc0b27d3a68f64efbd1f23e0113cd9f55a55f12", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020170, "uuid": "9811cad5-e95f-4f33-958a-5a02d344347a", "comment": "Malware payload (AsyncRAT)", "value": "af8fec7cc9843306e9c604b2dae9498784f85ba0", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020170, "uuid": "b77c55ca-60c9-42fe-84fb-d4c5ba5682e5", "comment": "Malware payload (AsyncRAT)", "value": "7b7ff8a4b87ccbe0af0dd45eddf1eaa9ce86a5ca1957eb1063270698fe07485077365de0f66a8d2c435bc0f093313eba", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776020170, "uuid": "f8f3c732-578d-4369-8cfa-39f462e22e74", "value": "T1C805F10626AECD03E17A5B7048F1D0B407B52E89E522D69B1FD97EEB7A36BD106C5303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776020170, "uuid": "1ba8f67d-7fdb-4bf5-ace2-a4f74a1a3ff1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776020170, "uuid": "3d73068c-3b75-4dfd-83fc-e55e86134305", "value": "12288:f53qwhbgK+58uGqloDdiF69f9Nf8CbMriymhhv+k/uMIVuZL9:fNXW57GtJ265L/bMriymhhv3JIkZp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776020170, "uuid": "01ebc866-ecab-4f1e-a0e9-4c409f6b287b", "value": 842752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776020170, "uuid": "dcceb68f-1897-4765-9d65-2f1f8163733e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776020170, "uuid": "bc97b9e9-871a-4b15-b0a5-1ea542b1749f", "value": "PO_MARC_26PNG965.TXT", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "257afb92-36a3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776020976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020976, "uuid": "de9b4143-b573-4fc5-9502-2112762c220c", "comment": "Malware payload (Mirai)", "value": "ce8ace1775fbba214502170aed6dcbc3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020976, "uuid": "684336b8-219a-4e80-b03e-7c7cf69250d7", "comment": "Malware payload (Mirai)", "value": "5073f18d5b8b7f98e7fc8159c81d4b7bc1e744714a424ed292f2e54e5e352003", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020976, "uuid": "bf5fae71-6433-44e1-9a36-9f30243c813c", "comment": "Malware payload (Mirai)", "value": "c361a9e04f9a5f35e89fa10994188928661d1826", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020976, "uuid": "a5a47a9e-8d26-4900-b215-b287c40af318", "comment": "Malware payload (Mirai)", "value": "18d5194a22f42fec54d16907e10fa05b9afc0e4ffd6cc5252f3dd67b5b5fd2039a4abdec79e0588933dfdcaa8d116006", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776020976, "uuid": "d7ab9a88-2a16-4596-9f26-b9dc1e1e63ed", "value": "T198E5F81F5E319F6CF7B487344BF34A34E76A22D617A1D980E1ACD1085E6025E681FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776020976, "uuid": "c518685b-6bdf-4cf7-803b-ba3ff7ada994", "value": "24576:BwKu0rTYj8xlxZMeLfLFa1NGDdW5pxhPW8aDHCywkbQXLDM/3endz1TrHrgeUtIp:bue2eVMcuxhPWoywk+l0t/YvPigYI0q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776020976, "uuid": "6abdadee-1db8-43fb-9a75-27fe68a870ce", "value": 3168508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776020976, "uuid": "376f32c2-99cd-41bb-b2e9-af18d6e2f62e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776020976, "uuid": "01de98a0-8fc5-4ed7-aaff-6d45412d31a7", "value": "ciubuc_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfc9ae9e-3678-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776002820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776002820, "uuid": "6a1e0184-7912-4fab-884b-6b530890fe55", "comment": "Malware payload", "value": "0ee046f0a37ff8e8eaa4b41a2844bc46", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776002820, "uuid": "4d5a0e13-315c-48a4-967b-8504ba2ddd3b", "comment": "Malware payload", "value": "517918964c3dfb29aea63f9ed3f416472b826cc232ac67e93dfb79862f33d7d8", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776002820, "uuid": "e2392a82-2883-4101-8ce8-18e9079b7734", "comment": "Malware payload", "value": "e184d6e167941782d4399afd4b3dcf28518e196a", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776002820, "uuid": "fc7f2a6b-cad2-457d-bed1-ae97d6f79f8f", "comment": "Malware payload", "value": "a5e9a9091934d975ac72050aebf85a0c19252619ad88d8cc707b53a796048e2d83726b2a1ad4fa228a321080b9a3387c", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776002820, "uuid": "ac26d53a-9923-470d-b653-c3b4c8ce4654", "value": "T18BD335C89A8E88B84F2F7534411F4C578E9DB22B061DC5D07ADEAF843F146A474BE9E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776002820, "uuid": "bccdb05b-84f4-4bc1-a7cf-2ca35a002e78", "value": "768:UmQRHkqQ84E5rhfOo55lXqPCLv6iRDdH2sO8An80N616x6I6E65NavklpMbjMVeF:61rhfOoRXqPCLv6iRSvcO/UGvxe0/YiB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776002820, "uuid": "11a17ae4-fa25-4536-98de-272b7d71967f", "value": 141696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776002820, "uuid": "723e6413-cd40-4a17-ac6a-3cb6a00ac8f1", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776002820, "uuid": "31c351e8-0859-41a9-ad90-4a70bbe07425", "value": "Tokyo_Dataset_Monthly_135.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed2b94da-368f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776012721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776012721, "uuid": "f400d09d-2f8b-4da3-85bf-ce4ba9472ee4", "comment": "Malware payload", "value": "c781b1b559a585bb764b10176d64486c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776012721, "uuid": "2c9f9d0a-8826-450e-8d14-5be6b9d43fd3", "comment": "Malware payload", "value": "52862b538459c8faaf89cf2b5d79c2f0030f79f80a68f93d65ec91f046f05be6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776012721, "uuid": "727f667f-740b-4c68-97ce-820b0e4ada42", "comment": "Malware payload", "value": "cd6f8e3afcb3cae3972d35b648cffe344b057523", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776012721, "uuid": "848bca62-c4bc-4b38-a8b9-fbd173216900", "comment": "Malware payload", "value": "174d86e5eccc07469b64bd1e06825437b692bf5bf97448e50a14a7ee7a27e1c57e24c8bf136a44ba58d0df7dc298a4e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776012721, "uuid": "1e88da5f-6d52-48e5-98df-2fea7cd25229", "value": "T1E9D47D56B3D453E9D33A5EB9C816470FC2B0F0024BB1EE1A14F959892F4BAB6721F385", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776012721, "uuid": "2eda6e50-ec6e-461e-b3a5-3825743d62c9", "value": "d386edacb5bc531cae23e0abe0d5b57a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776012721, "uuid": "eb766082-4652-488b-bdb3-0020be0c8213", "value": "12288:I6Spuh5j1NU0IwPH/W1Lk0cGnnrkBd/VM1CbMLDuecbJGtf06kLOb:I6Se5J0rwJVG/SOb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776012721, "uuid": "9d898f49-4c16-4d24-a8e4-e122886d5e58", "value": 602112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776012721, "uuid": "23420250-9fa8-4b9c-b2f5-332eff7c2552", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776012721, "uuid": "bd5030c7-4460-403f-a24c-cecf105fb551", "value": "52862b538459c8faaf89cf2b5d79c2f0030f79f80a68f93d65ec91f046f05be6.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df3c7e08-36af-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776026441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776026441, "uuid": "2bfa9279-c805-4f37-a05b-87581616667c", "comment": "Malware payload (Mirai)", "value": "2dd8d5a3965b091b3cde8787fd1ada2f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776026441, "uuid": "a0dce955-e68b-473c-b4d2-3d9548eae374", "comment": "Malware payload (Mirai)", "value": "53a3e89e1fa5415fc425ede158eb8bf69177f898956777486a3460282b595165", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776026441, "uuid": "2af119d0-5c83-41da-a4a6-ecb2c7fc05ec", "comment": "Malware payload (Mirai)", "value": "a387aeb6228d31796e0f143bec9db1e378dfa3b2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776026441, "uuid": "954eeab7-20c3-4e35-877a-073fa303c760", "comment": "Malware payload (Mirai)", "value": "67e6f4a11388851363fe2be4fb11844d26fe497678ce69b23758414084038abd8b1442ec85b8823b565c984c9b2080df", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776026441, "uuid": "09430601-3259-4d28-9ac2-a43c54e9c450", "value": "T1BEB56D99EE0E3D42E3C7E27CDF4A8BB03137B6A8E32680B37952415CC0DA9D5D6B1615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776026441, "uuid": "5cd12526-3a17-4bbe-91f1-271bcad102fd", "value": "24576:c3u8q8j0kk1SlmT9mnjz9YhCfqp7Y0aC7Un/8nChwja3y6AqBA6ltqeZJ2w4VfaP:4PzkCbp41aMrsSlWrDt4yPc07P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776026441, "uuid": "b8782039-374d-436a-8846-e2a411f12d93", "value": 2489264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776026441, "uuid": "6ba487e5-0e86-437b-be52-0eba5d06639a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776026441, "uuid": "0e8e8dee-4f15-4f73-bf3b-171db3fbaf3d", "value": "ciubuc_aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aed7d80-36a1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776020179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020179, "uuid": "dac648c1-fbf7-4f9d-9d65-a02e72b96a04", "comment": "Malware payload", "value": "6c4fadd3f08871ca404283d95fef054c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020179, "uuid": "e6255597-a414-4dda-98d3-8940fda9fb53", "comment": "Malware payload", "value": "55b94d2169dd83841a2a564691e72f6c80fa3b7d422bd17fccc1e9bfc1bcf8d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020179, "uuid": "f7550f3f-d8c9-444c-a4cc-f73af5d5ac7e", "comment": "Malware payload", "value": "b7650afd89d66fd8b4f79f90c4d52914bc3ddf78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020179, "uuid": "d4c364ba-9f71-4cd8-bccc-03a720ac8dff", "comment": "Malware payload", "value": "f8e6f632f4abf9555c442f9646fa834dcb715d0428e548b04e6f7b280cfd43be994ead79a75c693b9fd0854a5e3acc51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776020179, "uuid": "462f6528-a209-4091-8e10-cdd3deb454ab", "value": "T159C4CF72E103E686D91578F9C9279DD924C4EC59D0E0E8B9B0AF7B39C0B1B51858FA0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776020179, "uuid": "68d8ea2e-c105-4e73-95c7-04b4d269faee", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776020179, "uuid": "c649c7c2-78dd-4d04-8f47-b221d7285c24", "value": "6144:vmOPM7+Tke5chEWo6hUl43iDNDRizFaBo3r+tA2Ohr/iaJuVnNfs0VhkdsICLb7x:E5oOyDNDRiD7+lOhrXunfPkd/CH7x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776020179, "uuid": "4ab31239-3aa9-4dc7-9f9c-d55c22709b3e", "value": 575376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776020179, "uuid": "cd81ee84-61be-4bdc-a639-57fb941b4597", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776020179, "uuid": "32bd9f06-ceb4-4695-8e3c-277507360193", "value": "shipping documentations_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30c701e6-3681-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776006392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776006392, "uuid": "9cdbdb2f-b55f-4ddb-a637-cbad507b12e9", "comment": "Malware payload", "value": "8b2c4c7a62b230bf365852a93f8d7d05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776006392, "uuid": "1b33671a-8246-4866-beaf-ab9ff1fdd53d", "comment": "Malware payload", "value": "58460f8009df7ca5d2a9b2e9346d940388472cd4cd808ac6c797942824bde299", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776006392, "uuid": "a056b12b-71ce-4e5b-80bd-ab2d6935e5b6", "comment": "Malware payload", "value": "96d77e3109c4c8419579395212c2574b2f398c2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776006392, "uuid": "58ed9080-68a8-43c3-9654-df1fc81ec297", "comment": "Malware payload", "value": "a6b938a2582b6fea101a65481ef08a6f12d397e5a50afaed0337de417647c2eba25124d85a258af1bc930663ace58d96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776006392, "uuid": "e363c028-c015-48a5-9035-1917396df393", "value": "T1DCE4234EBA6C8EFCF49B46B270945F426F7BB06146D6A24915F084AF2CB7C2D7261313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776006392, "uuid": "a86d217e-2d17-4ea2-bcf0-8acda56e9bd5", "value": "9b760feffec4fca9c313889f9a05ee36", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776006392, "uuid": "0d435c71-b768-4d0a-893f-7d3bad8046ef", "value": "12288:G0/niRr9KW4bDRKnK5rgxiIr3WnO/rfKE4bjRK5Y5b+PiI9:G8WKW/nKyxikWgKEV5YoPi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776006392, "uuid": "b5459e2f-ff63-4cff-ac8d-b5aaaac7cdf8", "value": 697344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776006392, "uuid": "e7825cba-5e7b-410d-8a49-4e453987abe3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776006392, "uuid": "a922b5f3-778f-4120-a478-21433c6785de", "value": "58460f8009df7ca5d2a9b2e9346d940388472cd4cd808ac6c797942824bde299.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e15d3b7f-36c8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776037182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037182, "uuid": "815248d9-e076-499b-ab13-8ae7fc40f608", "comment": "Malware payload (Mirai)", "value": "39a1ca6c59c83d22e266f321a7c3c3a4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037182, "uuid": "48901ae5-0420-43b8-b6f8-993f3f4c955b", "comment": "Malware payload (Mirai)", "value": "59018be66b2da2924ae6e7fdca586fad4b346365ca0b1ea53b849791a7dd78f1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037182, "uuid": "83be5f66-2874-482b-b3e5-04fb993b2dac", "comment": "Malware payload (Mirai)", "value": "e4a5587b66eca4385d83254368ace800c56f401e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037182, "uuid": "ff1ed45d-e2e3-4589-9e4b-f89021f95514", "comment": "Malware payload (Mirai)", "value": "a9645ace5f1f15cc7cd3d5f134ee0040ab9d6bac44c21863025d4551cde9c8125b341b382375e5904cf8cb286c795c77", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776037182, "uuid": "f7a62a13-d0ba-4d52-9a9d-ab612fa56999", "value": "T11213F176712A2DC9C3A15CBCFD30C291576236BD91FEB4A219768F7472804033CA5BD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776037182, "uuid": "d5626eac-8a15-4557-9c3d-41135c6d7d70", "value": "768:WFVQEJdHdGkJygJ/JNtBvB6SudmQDVPU91+O+W2hMk3s3Uozn:aGkUgJBbDLudmQFUT/h2hdqzn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776037182, "uuid": "694a1759-32a1-4721-828f-c564612e0b03", "value": 41960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776037182, "uuid": "922284a9-c620-4e45-b715-65496f3d54f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776037182, "uuid": "06f5c4b3-8abc-4bc9-a600-48113ba087ad", "value": "Hammz.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0151d11-368b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776010873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776010873, "uuid": "5e9f8e3c-b90b-4190-a312-d0b96026d442", "comment": "Malware payload", "value": "26f65f0f3a5fdaed0207c77a8bd3c8b6", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776010873, "uuid": "77735350-fd64-4dd0-8a98-35b451a70f45", "comment": "Malware payload", "value": "5948a349b534156f5734b3a99e761ec6d84e527ab729b1f28242049b3afab2e6", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776010873, "uuid": "933641af-3f0a-4140-99d8-cc591955a9ae", "comment": "Malware payload", "value": "33d2c67e40989c2eb93eae7eb4d4538bb097e834", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776010873, "uuid": "59ebcd12-ede3-447c-ba8e-b3fb860676ce", "comment": "Malware payload", "value": "6617521a3fceb950ffa1a5f83fc6dbbda067507da2d6bc9ffa787ef3f5a31e3d91ee4c31f71dd7b58a893c09708bb9f0", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776010873, "uuid": "c1816519-748d-41df-9717-90790ac1a7f2", "value": "T1EE252346E73DF0B4F39A6E79AAEB8430CF9611991034C7D35078C924122F6839F7AB95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776010873, "uuid": "8ffd48fb-fbb8-4803-836d-715b78924222", "value": "24576:vswKOhjjVLEVVbM2hjjVLEVVbMQhjjVLEVVbMjskBNySIzJM:0wVhKVVbM2hKVVbMQhKVVbMjDJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776010873, "uuid": "c0c2eb5f-0ebd-4b25-bf43-f9a83b951bdd", "value": 1045679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776010873, "uuid": "769ac608-48b4-4631-944c-c9553e62ef52", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776010873, "uuid": "445b0bbc-51e2-4a03-bdf1-e20b54f2851b", "value": "\u0411\u043b\u0430 \u0431\u043b\u0430 \u0431\u043b\u0430 \u0431\u043b\u0430.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a5bf670-368f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776012421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776012421, "uuid": "d8003687-d135-4666-9568-2a8e77a70afa", "comment": "Malware payload (Mirai)", "value": "6bcd1e9338d56638b37ef41eb6aa5d48", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776012421, "uuid": "143d154c-8e4d-4c4c-a3de-0a6dd1e43b40", "comment": "Malware payload (Mirai)", "value": "5966922cefc1787301fe9fe0b1ae47876f309adffa398f18f84f75553ba8de41", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776012421, "uuid": "b7cde8a7-acfd-47da-a759-76e9153178f7", "comment": "Malware payload (Mirai)", "value": "669c78c6d27923f14b4ad3b6b50b557e2e42dd50", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776012421, "uuid": "a1935eb6-1664-4ca3-8479-4e7244a43bcc", "comment": "Malware payload (Mirai)", "value": "083dd9edb4aed1e97db445f1ba30a34ec16aaa51d23ef4221acc595b2c7a2fffb7df8707c17a6dc4257f3b5b839fa5ac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776012421, "uuid": "a5a9177e-6b49-44bf-b2e3-b7f17bea05e1", "value": "T18F432B95FC9245AAC7D117BA771A978A336263A9C2CF7313DC080B5036CA64F4E77B42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776012421, "uuid": "8a117919-8cbc-4e6c-a5ea-f120b9b86a36", "value": "768:iuoWI5sMjTXqsYsFew8dV8ff7QyZMoPrdBC9lH4jMNx2FT0nQz2j3:8d5sMj+XVnT87QSdPrdBC9lo4y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776012421, "uuid": "51637ece-2e27-4f21-a92c-9d2aa3b99a9c", "value": 55304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776012421, "uuid": "c66c7bab-ce8f-47b5-ab6b-d489ae332df7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776012421, "uuid": "5ed4ee3d-ce0b-4e37-a10c-3c47909680c8", "value": "titanjr.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97462813-365e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775991531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775991531, "uuid": "00069f00-0d12-448f-ba5e-726b76d25a02", "comment": "Malware payload (Mirai)", "value": "f5015765de3ce9274f344f3fe86665a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775991531, "uuid": "db75c83b-6ba4-4298-b614-370db1661be0", "comment": "Malware payload (Mirai)", "value": "59989a7476e9e994a44b2e2ea9f80b38a5d40a7a61c00e0452d41d49a1c7bcb8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775991531, "uuid": "373e20fd-4f74-47c2-9f5a-7300d03415a3", "comment": "Malware payload (Mirai)", "value": "cd3472320c6e0b410bf88fde5945a06c9ba89f74", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775991531, "uuid": "990700e3-3e2f-46b3-94fb-a5273d42df4f", "comment": "Malware payload (Mirai)", "value": "69764f96fd11885e9f62ad7a05132ca7443efac68851b798b88036db7e636fee7c4f5ee6162a833b77eac2749cb916b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775991531, "uuid": "2387e3c9-572d-4a8d-9856-a08863bcc646", "value": "T16CC56D027B1E09C7F1A71DB0263F17E9C7AE8AD631F9F146254EA9CA1375E3012467CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775991531, "uuid": "82fa5944-d821-47bc-b746-22bdbe64248b", "value": "49152:eBqEE93V9H/CO773hTZSX8ygBBc/W5JGuXHr5HFac8ZsvPX9ws:eBqE23Vp/CO773hTZayBy/W5JGuXHr51", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775991531, "uuid": "1fd36c80-10e8-4699-b0eb-a8c203492907", "value": 2727564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775991531, "uuid": "3874b8e8-b210-4f8c-bfe6-91620bbc6880", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775991531, "uuid": "ec23b66b-0ea9-42db-914c-c0d33954712e", "value": "ciubuc_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10004fbd-3692-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776013638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776013638, "uuid": "f01e53c4-1c87-4722-8a1f-5ab4b84d9fe1", "comment": "Malware payload", "value": "03933eceb3b4462e52ec267342a188f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776013638, "uuid": "0c9d0b6f-1478-4219-9e0e-2ec21285b7a7", "comment": "Malware payload", "value": "59998bab01f780b60b4845b34f1791ee8b1f6827bde5ba3361d054e0809e2d94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776013638, "uuid": "a59e57a5-67c8-44cf-91ec-228467f8b214", "comment": "Malware payload", "value": "383168149571236fb39a86e623148d972930916f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776013638, "uuid": "d0dab76e-39d0-476f-99eb-86b81b7c70e1", "comment": "Malware payload", "value": "6c6b96757bd9c91b3349ee093ad5bb16bf4b3da51cff24b5c3d001fd272cbc8a11b016beb3dadcdcfe0a95e187082f84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776013638, "uuid": "d25ed50e-4eff-42a8-bdaf-716cb50df06a", "value": "T18824092BA3A34DB8CA57D1768296D7B2A831FC140334F95F0654DB323F26D684FAE548", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776013638, "uuid": "9fb4fe15-f36b-4b32-a348-dccbdf31b036", "value": "14117968c52953e451d195099ac0c3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776013638, "uuid": "6fb02523-c1d2-4094-9ff5-e1ca52978625", "value": "3072:zRbHhykKD2n5/AE5YpE9Cw3FdSt3FTf0NlJxQa2fQ7RC10LplB9U0slvLy7oz4JA:z/jYjTf0vJKvfQ7R5nB9U06CJP5L5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776013638, "uuid": "d2386fe9-83bc-43b9-9687-d4269a2b163c", "value": 209920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776013638, "uuid": "95cb74af-4da5-4e90-a02d-4ba9005fde43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776013638, "uuid": "a8dd6d82-dfc6-436c-89b8-7e762d383226", "value": "cache.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a7722b0-3649-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775982329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775982329, "uuid": "eb89fae0-4f41-4bd7-b2d5-4cc505dc1e17", "comment": "Malware payload", "value": "16f7bff8307067af232d7476104dc9d9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775982329, "uuid": "c19a6eab-5623-4c48-9c12-d91288019d7e", "comment": "Malware payload", "value": "5bd601ab93ad86e227939ba637fe5cbd896c7e74e9a64c10a5d37169d5246c7e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775982329, "uuid": "6fb5bbfd-6966-4de3-9323-a1f34e31335b", "comment": "Malware payload", "value": "34207c1a86e9559389a9dd2ce1af2b38b58eb08b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775982329, "uuid": "55704be0-394d-4895-a465-c66170828467", "comment": "Malware payload", "value": "a4eed9ad883d96b27efd90819600a1af322f6938bd1ba78effba77f6db5df06e111f4e21e79c7def811ef55e21e0b072", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775982329, "uuid": "2d21dcea-9257-4cca-bec9-75c00030eee6", "value": "T1BCB02B04A0097CB8034B17C9455010A10112CC0B010C4893020000ECC4E054C39B1413", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775982329, "uuid": "6a7fb8df-f337-457d-83e0-b7f7b0d3e463", "value": "3:gdQTtQ8wTdt+g9rmfLcsTDNkxLNBkMxhJH0fJH6tM:gdhXH9rUr1gf/jUfJH6tM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775982329, "uuid": "8a77a413-9423-4360-a8a5-d561bc10a3bf", "value": 129, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775982329, "uuid": "dd7cc1de-5db1-4872-8c5e-88dc264178d2", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775982329, "uuid": "fa1eedeb-0ea2-4105-bc13-93fc3bba3410", "value": "phpunit_env_exfil.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "629bd45e-3683-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776007334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776007334, "uuid": "eb88adbd-300f-46ba-b43d-f11309bd6520", "comment": "Malware payload", "value": "86dba5b78b5a951ab2b9224fafcf0c70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776007334, "uuid": "5920a4d1-4e57-435e-98ac-76017a28b374", "comment": "Malware payload", "value": "5c37b35929dac5c640d1d14e6dc74009c5072536d7fbe0c58822bf2387a8a22d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776007334, "uuid": "1fa2526a-2dec-4005-83d1-e51f28f19929", "comment": "Malware payload", "value": "0d0f9155ac39e70c02f68a43c2792a2c596abbe4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776007334, "uuid": "b5d7e874-8dc2-46be-9302-ab79e659ff83", "comment": "Malware payload", "value": "9284f06ea5c26dcd4bd4dcbf893ddc7071188094b7828999f79e4955a1b9e2b483d3303340a5344038a88d9ddf22245f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776007334, "uuid": "d6355c0e-a691-4de0-94d3-492174f052c6", "value": "T151E4237C53115776D6B1597D004AECCB59C62F9222CF9AA7E9E04F1EEA2FF89021D023", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776007334, "uuid": "d12c23c6-efcb-4038-9137-2f8b301a5943", "value": "9b760feffec4fca9c313889f9a05ee36", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776007334, "uuid": "588556b3-6db6-4ded-8bf9-0f8d5d6bc394", "value": "12288:0TogDAWMKqUu2aj5NPE0j/fw/gfaeisx+EDAcMiqUu4Ij1LLw07/nwPgJawis:0TogDAwqJl1Nzj/ooSKx+EDAqqJbJLzz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776007334, "uuid": "0a286198-c041-4308-9678-082082196d1f", "value": 703488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776007334, "uuid": "0a7981ad-8680-4865-991d-e6ed56e05ede", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776007334, "uuid": "af957670-509f-4f56-94e5-0a06fff36de3", "value": "5c37b35929dac5c640d1d14e6dc74009c5072536d7fbe0c58822bf2387a8a22d.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1e793cf-366f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775998851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998851, "uuid": "a9099b11-c55d-4bf7-a97b-65f0aacfe0f9", "comment": "Malware payload", "value": "69f4c5d186777c581b754f68b8269dc0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998851, "uuid": "044fbb68-ea0b-43e3-b07e-4be5fb2ec97a", "comment": "Malware payload", "value": "5d4bf73abe8e8a76fc4bf6a8b4e878be894c97beee4271d27f9e807f4e1d17a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998851, "uuid": "33dec289-3d18-40bb-9fd2-441c4b42ece1", "comment": "Malware payload", "value": "aa7d0be534b9e94ad6b3e473c83f42dabc511021", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998851, "uuid": "ae75d45f-6f1a-43a8-bda4-1185d2a19c27", "comment": "Malware payload", "value": "14f2e43d3557af77dc88a5195cd36fb97da782e57811e16611f0e2cc0ae13b9124a0f5e972faf8d58659be813e341e75", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998851, "uuid": "327eb574-05f5-46e7-8c70-b0e708129909", "value": "T12AE31218F2505734C3C2AA7EC7D5F563C10A34AA65012AAD48FD2DAB75B88717ED4E4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998851, "uuid": "847ae065-835e-42d0-9905-749eff85daf0", "value": "3072:U7o4GDndewFsnNapQYPAr3atYia4XVR3dvrn5GPe:UA8NaWGttYH4XXNznZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775998851, "uuid": "2e1f5a15-c1a2-4560-b626-f3a815febcf8", "value": 146568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775998851, "uuid": "c81e1aec-2f7e-44a0-8984-9d385c6f9f8d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998851, "uuid": "8704d097-8ccc-4456-b822-888920a2950f", "value": "redis-composd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d75b5621-366d-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1775998081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998081, "uuid": "124b8fa2-7b24-43ba-8219-9b0a98d52ee4", "comment": "Malware payload (Gafgyt)", "value": "c2a14cfa657bc746f9c606ef04493fc4", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998081, "uuid": "15c3136a-dc3c-46fe-8b66-37164c40242c", "comment": "Malware payload (Gafgyt)", "value": "5d9f2ba5c70589082e30c99a07588fdde3f0219fdbc259ae31d7648d614751ed", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998081, "uuid": "3d3ff6d7-d8a8-4763-a1bf-d2156816f27b", "comment": "Malware payload (Gafgyt)", "value": "859e15af2e4d53ac0e78834aa521c27b84fe6cd3", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998081, "uuid": "08e4ca28-c500-4bbb-8b32-40ab99a40285", "comment": "Malware payload (Gafgyt)", "value": "3e50bea90f80142235157c4afd5a5eb86a4066e44235ca563a602823ff32bafd8ec2199e8281441835f634dafac74e92", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998081, "uuid": "0fff414a-1172-4b75-9b9e-151c86ce91b9", "value": "T16FF34B17A88044FDD0E9E130CBDF812766B1F05A66317A0F4E811F612D5AF24AB7EF96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998081, "uuid": "54c18bb3-417c-46de-837d-82087b89f8f8", "value": "1536:0wug66/pgi/1b3r6kCuZYkfTW/urIdwD6MZWN/4SJsN3q4LvRidSRaly:0wV5Bgi93vFfxt6MKRsDr1R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775998081, "uuid": "83121cfd-2ce9-47e3-bdd8-66d119adebff", "value": 164408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775998081, "uuid": "5e1a3065-dd23-4f7d-86d8-ff549bae0a69", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998081, "uuid": "5feb3970-bafc-4362-b4b4-1df06ee38e68", "value": "armada", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8ceb734-36af-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776026457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776026457, "uuid": "b0dfb468-7dc4-4ad0-96b2-696ed37d57b5", "comment": "Malware payload (Mirai)", "value": "ebc35f79f0b3191c709d2f5a296a892c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776026457, "uuid": "e755c46b-80e8-475f-9f21-3938ec42252e", "comment": "Malware payload (Mirai)", "value": "5e4f5e4eb365d83df9fbfd6693db40be369f52aa47e501c6c49285775cae1ca3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776026457, "uuid": "e643c260-32d7-462d-8c8b-33c3ad499d52", "comment": "Malware payload (Mirai)", "value": "973191203c27130263378846c23b805050eca0f0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776026457, "uuid": "20cc4c59-246e-442d-bdd6-3938c39283f1", "comment": "Malware payload (Mirai)", "value": "061554b951d78263458be6fd42ede1211f4b49e31ae3066f76f9b60fcacef72621e788041367ea5c588658cf81247a76", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776026457, "uuid": "36c87e9b-012c-402a-9bac-3390e22aa393", "value": "T1B9D55B41EC509A53C1D15BBAFA7F82C933332BB4E3DB70164D189B706B86B5E0E3A945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776026457, "uuid": "9de3dccf-83ed-4db0-841c-33a044a145dc", "value": "49152:MuY/PGdPUsKwvks2l/GAWSZWvPlagdQQ1NyqKya82xyPgAKR03:MuYGEwd8NNZWlagdbyqKya82QPFKR03", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776026457, "uuid": "d006f411-ce0e-4871-a652-5d8ceb102ae1", "value": 3017279, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776026457, "uuid": "1ef6b776-3910-481d-86c1-c8089443b775", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776026457, "uuid": "91e9b29f-7226-4e15-b28e-4fdbbff28483", "value": "ciubuc_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adcfcaaa-3630-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1775971812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775971812, "uuid": "7627a9d7-ba9a-4faf-bff1-d0e7ccefcc04", "comment": "Malware payload (NanoCore)", "value": "a196bc59e167c1c5b13da94ae0154ec9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775971812, "uuid": "4b44a6bf-b925-4ea7-ba31-89854d29602d", "comment": "Malware payload (NanoCore)", "value": "5fa887c8e22c01beb651f843bcb6534b8ab35db986937baaf1f04dbad78ca806", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775971812, "uuid": "424ea0cf-d05d-48de-9210-6b68bbc923d5", "comment": "Malware payload (NanoCore)", "value": "ff7bcadd603c90a1a38f803eb38f6515f3e41cf8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775971812, "uuid": "0d429471-23c2-410f-b469-b11205806ea6", "comment": "Malware payload (NanoCore)", "value": "e46cf8d549a5aba8b71d13b7a7b4aa96e993e58102313bd0384c9de08b043e1cda543a8bacebd83ee848833f3f41d73f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775971812, "uuid": "a7b344e8-227e-41c8-b39a-0254a39ef5f6", "value": "T12314CF5637A94A2FE1DE8979601212528378C2E3E8C3F7DF28D855B78F267E50A071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775971812, "uuid": "a06d411f-433b-4809-9e1e-3282cdfea823", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775971812, "uuid": "2151eb62-5b19-4270-934e-2bf377a96478", "value": "3072:UzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIA8GbuFQ67VzsYbRgtSCzWN6:ULV6Bta6dtJmakIM51Zyzsw36", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775971812, "uuid": "a40d6aff-4466-4e3f-bbe7-d7a7bef259d2", "value": 208384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775971812, "uuid": "4d4aacd2-5652-42ec-8f58-913ae7aeeb8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775971812, "uuid": "4f83d2b8-3565-49d5-8948-f74c44e7c486", "value": "power.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5057b6c-367e-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1776005352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776005352, "uuid": "0d058724-08b4-42a4-a322-384b8685298a", "comment": "Malware payload (Vidar)", "value": "2496fdb3b2ed11903e29a17965ca0473", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776005352, "uuid": "d95fd419-f909-44fe-a01f-aafbc5008a2c", "comment": "Malware payload (Vidar)", "value": "6118a4f19816556d85e162ca237ca7ee4123bb4d0c8e5491db5527bd37ac61f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776005352, "uuid": "a540698e-8bd7-456b-baae-90813056c917", "comment": "Malware payload (Vidar)", "value": "102c2d9fddec7aac0c32b4559b9da62d958d9487", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776005352, "uuid": "4c112de2-2788-4c72-9190-feaf85941441", "comment": "Malware payload (Vidar)", "value": "ad99fc0a3d8300809f5f7145b9cf288ea4659759044c29264173bc11e00773673492183b256754bfb74ef752635e9aba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776005352, "uuid": "968f4b38-d661-4354-9fe4-2df8c5a0fc4d", "value": "T10FE4094294699E97FDBCD5F8581E2C7D52BF8518C362702A709C1E832A3B3373D985A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776005352, "uuid": "e283e9b5-d428-414a-9bef-da4b9115c540", "value": "12288:eh4J1yd3v9nTlaiNwrsw7yLWsoNdaoEGOiqxw5PLAUajFEJ6R7J4wDCRDwKB+XMR:eh4JYd3v9nhaCwrsw7yLW/+vUhAAouMw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776005352, "uuid": "470ac25f-bb2a-4d29-9415-330458ba0978", "value": 678400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776005352, "uuid": "c1ccc4ba-422a-4b27-b3ad-be5705088cb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776005352, "uuid": "ee48223d-7766-422f-b5f1-63bd43141e22", "value": "2496fdb3b2ed11903e29a17965ca0473.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e49a8271-36c8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776037188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037188, "uuid": "42b25f5f-c4dd-432e-8c28-9dc15ee66cab", "comment": "Malware payload (Mirai)", "value": "aca522d05f05a3c3b9d5200aed99df2a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037188, "uuid": "f62d06c6-481c-40b8-9529-c16a3f543f61", "comment": "Malware payload (Mirai)", "value": "615d0b3c6009e3209ff128b840c18c3ba1ed3e35b9de7e6414d216b75464af01", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037188, "uuid": "f583b4b5-7ba0-4a0b-80dd-5c1ce1eacaa8", "comment": "Malware payload (Mirai)", "value": "c3214bcaa6bdf23b40309895c141db7a21603707", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037188, "uuid": "27603f5f-eea3-4db6-a2e4-69e9dda2b87a", "comment": "Malware payload (Mirai)", "value": "b39556b73e465369beba47ad5615161aba4e7be2f5fbe68396c2901b214fa582d19f673b19ff6e7111a48e265972a2d9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776037188, "uuid": "e4d492e3-248e-4ad5-bdbb-12dce4b92dcc", "value": "T1BD13F101B28898B3D07B10B79DEF7E0DC910F08F57EDF2A2DB047A1659DBD1E2526985", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776037188, "uuid": "5ed1084c-a410-4eb0-8a4a-39d5413bdc03", "value": "768:FRklTZrhmE10L3I4XIYhSPxOOy6fnMibFEzpHf1aQLd24HxZ4jB2nbcuyD7UGQRq:FRytF8Y4X1QgOhNFOZLd2sxZ48nouy8G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776037188, "uuid": "e7f75f29-9813-4a60-a391-a91d6b60638f", "value": 41812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776037188, "uuid": "a0b75121-7b07-4d6f-bdee-c503b0a91c65", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776037188, "uuid": "9a3144d4-fb47-4410-ba7b-f9b0d7edb690", "value": "Hammz.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4807e15f-365d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775990969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775990969, "uuid": "258128ef-dbee-4dcb-b559-206fc563dd8d", "comment": "Malware payload (Mirai)", "value": "6a68cd39908891f79faf82848f93f936", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775990969, "uuid": "9172f6a3-1455-4832-9c8a-fe58e1b152ba", "comment": "Malware payload (Mirai)", "value": "616922376e145bacf6ca2e972869be9aed61674aa19462cb0d26150a4bd4dd03", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775990969, "uuid": "1d43924f-37ec-4ca6-a3d0-445b4d6b4fd8", "comment": "Malware payload (Mirai)", "value": "9903cfeff1747bd37e7d606d2b0a0de531e0bf21", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775990969, "uuid": "c6dd5f84-0ac7-4a33-a68f-9cfff32e044d", "comment": "Malware payload (Mirai)", "value": "5f1e8995e8e08c6af9398913cf36854d4f7b36987942815127f0216451ee241151031620822f7a07638fb712d258ef6c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775990969, "uuid": "72443c44-ca8d-487e-84f8-a042c3a04bc1", "value": "T1FAB56D99EE0E3D42E3C7E27CDF4A8BB0313B76A8E32281B37952415CC0DA9D5D6B1255", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775990969, "uuid": "65e2ae39-010d-439a-b31a-d121303ef41e", "value": "24576:+zYo1AC9ZPau5VTlf7nH98hCTqNr8D++7QzDszC9wP+0imkDds6hJWCVVCI4i3du:0+qPlU54gdZzEahjat4yPc07PX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775990969, "uuid": "6f1c9aa5-a1d5-4b59-9759-0a7f189a6f19", "value": 2489264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775990969, "uuid": "1bcbbb02-6e60-4134-8fb2-2564990df1e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775990969, "uuid": "07f7376e-7e7c-4231-8398-be6ed38121e0", "value": "ciubuc_aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12e956d8-36c9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776037265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037265, "uuid": "ded93480-21a4-4946-9b37-328f38d24d09", "comment": "Malware payload (Mirai)", "value": "6484514b82f1099466d77d83be3c2aca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037265, "uuid": "34cc8992-b612-4e01-9054-8b70d5f35f24", "comment": "Malware payload (Mirai)", "value": "62da408c52958eba60b0dfb29321c83922511688d301322476308bddf7fc2e36", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037265, "uuid": "619233bd-ef3e-4b39-8aec-101f4093f3e4", "comment": "Malware payload (Mirai)", "value": "5be36a5f0be6450e5d069818563ea9afd6d80ccf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037265, "uuid": "f6402bed-be32-465c-baef-447d2d5393bb", "comment": "Malware payload (Mirai)", "value": "dd06afbae211afaa417fee3a8e4e59e0eb6301661d625dbb4b77f7815d11c1398497f75933931d84b4741dd622025de8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776037265, "uuid": "78d7ba4a-36d8-4d8f-a89e-1d94d588e593", "value": "T18F935C01B3580D43D1A71EB0263F3BE597ABD5D122E0FB4A651E9B4641B6EF3144AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776037265, "uuid": "605cd91a-484b-4b14-9765-ec68f03d1132", "value": "768:nkn8h9xjbAvXMlRsDda+K2l89aDn8nYzDvF3g84Rsw/iNG92r0PFI/R+rxFpI+h5:+XfQAh/iwNw2g0+9FO+AmB+PTPRI5wq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776037265, "uuid": "95dea518-b240-4d31-a101-36b52a0e9bb3", "value": 91724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776037265, "uuid": "0473116b-57b3-4397-afe6-00737db1baf8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776037265, "uuid": "36b31ddf-f641-426a-ba9a-27fed5f3037d", "value": "Hammz.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f401c04e-362b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775969783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775969783, "uuid": "8a0c6818-01f1-408b-a2d6-d3dbe2367956", "comment": "Malware payload (Mirai)", "value": "ac31994f75920eb04c403adbfbddc71e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775969783, "uuid": "aff00817-1061-4281-944c-9e9a404913e5", "comment": "Malware payload (Mirai)", "value": "632f878140e0364956f2455422835e88259f57f601f26fc6a0b9b845016728b0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775969783, "uuid": "76f2b66e-2263-4ece-a5d7-111789ed1478", "comment": "Malware payload (Mirai)", "value": "c1bee184127e92c0992efdf58a34539e225a9e62", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775969783, "uuid": "293c4885-34f2-4f38-8c0a-0e9a7029c3fc", "comment": "Malware payload (Mirai)", "value": "f7bbdaf05bf49fa72e6b33e8d4d48b37ede9d73e3d2c0ba7faed43f2840d6e81a169bcf003dc33f9a6e971fadae39299", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775969783, "uuid": "61978b26-959b-4adf-8598-2d09bfeffbc3", "value": "T10AB55B41FC51AA56C6E066BAFB7E828C33272BB9C3EE30174D048774779A95A0E3F541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775969783, "uuid": "4853f2e9-08d5-46d9-9e8e-ff45b9277707", "value": "24576:AansSMerYzV0oNmabxfMsaY+4ifDwHnmtoDNLY8r/7QSZGruYF5WAmdJUoupWvP+:Aao04xUsH+FvtoZmS0rPIupWvPle", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775969783, "uuid": "2c892214-e8ae-4b2e-a729-480645419b33", "value": 2491004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775969783, "uuid": "f8ac2d80-7ee2-429c-9355-247b233adf89", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775969783, "uuid": "0a0ff75f-42d3-48d7-bd8a-a18fc6c68b3a", "value": "ciubuc_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8800956-366b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775997144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775997144, "uuid": "304dce2a-b25a-47f5-a917-2adbbefdebd8", "comment": "Malware payload", "value": "ac8aa8d3b237524cb413ce59afa0859c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775997144, "uuid": "5b00db64-fae9-4abf-945e-78b0dfc04776", "comment": "Malware payload", "value": "63fed6a9e93835189a188265819cf8ad1f39b6241373deaa3df5a3377d2a14d4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775997144, "uuid": "6061b3c7-25c4-4857-b8ed-50f238646764", "comment": "Malware payload", "value": "43696583ee644e8433d6c7aff3617ab0cc2d857a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775997144, "uuid": "8efc777f-c4f1-4266-ac83-00cede9afb99", "comment": "Malware payload", "value": "0627f5f6d4f7b534aab6fc60787c0cbbd121efa0887314492e0419934af78e584e81ad407bc6b6314283d7c6c7da8e57", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775997144, "uuid": "61c388e1-ef46-4016-b8de-06e91b8a8861", "value": "T17C9585181FEF80AE35A37D5045E0521B5B7BF6BBA6758B8F448103CD07B3508526AFBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775997144, "uuid": "3da7a4db-f522-4278-bd9e-4f764e1c5a69", "value": "24576:uLd2Hyn+4Ob4rf2oVKtC05x4rSIyL++FVAWQ:34KEt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775997144, "uuid": "bd978b87-3dd3-4c3c-9413-2cfa8ff597cf", "value": 1880672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775997144, "uuid": "319f2802-b88c-46e2-83e2-5070962f82c4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775997144, "uuid": "adc6c818-10c0-4d3a-8383-a20e63ba9c32", "value": "andre.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a75b4640-366f-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1775998860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998860, "uuid": "55582c6c-11ca-430f-b9d8-585427dcc2dd", "comment": "Malware payload (Gafgyt)", "value": "ebadfa1afb19c7b2e908e8f532df277d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998860, "uuid": "e543860a-0a02-476d-a5af-e0cb033e505f", "comment": "Malware payload (Gafgyt)", "value": "644c1ea101d65d7980ec36327585848cdd56c3963e34e64995d935c4d70840c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998860, "uuid": "8e24b96f-9d7a-4733-bb5d-b4a653c8b54f", "comment": "Malware payload (Gafgyt)", "value": "1afb922a3c39b0f67be70e9358695e7654458628", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998860, "uuid": "0630984c-5da7-40c6-8022-7b0462d365f6", "comment": "Malware payload (Gafgyt)", "value": "67d1264ac3624326a475702272db12568bf7c300cbdeaae53baf824f3dd98645b7a3702c27772ca2633e399fd336b3e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998860, "uuid": "6b09db59-5f0f-4321-bcb3-f6ead488d2bf", "value": "T192A31268BF105DFAB56C2571CECB056BB6C12E9B36729988A6D133D0CE2F184E4D3523", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998860, "uuid": "dc7326a7-f76a-4c92-a4c6-eba945c72638", "value": "1536:KhsCFRUoopPfqrCn7PpYWxWNexAlyirde+FppBoIXhkoXA4Er9wE3tIzvl2d:KaCvoRfqmn7pNx2JdHFN1A4w9wE3mrgd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775998860, "uuid": "f400f44a-ef10-48ee-9093-10c1dfa5c065", "value": 106016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775998860, "uuid": "9c34c30a-38ab-4710-94f0-d0f0bda3b661", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998860, "uuid": "af207431-4b83-44b8-8699-1b220f6f7cf6", "value": "redis-proxyd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4ec681d-3683-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776007553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776007553, "uuid": "4adc5e13-23b2-4d10-8cf2-335a43c0623b", "comment": "Malware payload", "value": "6075c226f1f4b338bdb29362d4fb4a12", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776007553, "uuid": "d86a3702-526a-4454-8d47-4dc48611e0b9", "comment": "Malware payload", "value": "6491ae22755f4a60cc56c1e8ddb9837c58b05ba7b60e2c9061bbb6c1e95b7c21", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776007553, "uuid": "af2b9291-e124-4bd7-bf03-bb9b4a228db6", "comment": "Malware payload", "value": "ce196ab36307aa5b4587560cb036b19d0046b170", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776007553, "uuid": "b882a80f-8637-4151-a168-853dbf63675b", "comment": "Malware payload", "value": "91fe0a9988aaa0ab13e2117ba9271066f796eb8257d4dc459e26aa03bd9aecc22697f2968709e3815c7e0bfd1e65bbc9", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776007553, "uuid": "1ecca798-6471-4c23-a951-c88bcc1cde9e", "value": "T1AFE3FF5A8E9F83B836236C6911AF2003FBBD961A170CC5C0F75FF6505F2865991D2BCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776007553, "uuid": "bb0c7f38-2b1f-456a-9ec6-95e755e4cbcb", "value": "3072:xtttwe/Ne/8e/ne/tooEsnylOviYzRir1vLlibqASWwe:xtttwe/Ne/8e/ne/ioELLlibqfWT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776007553, "uuid": "cca4d032-5f8a-4ea0-bf82-b516b7a5e071", "value": 149030, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776007553, "uuid": "e31d8489-4e4c-4659-967d-517e4e6624b2", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776007553, "uuid": "0c8e71a2-51dd-4232-a2f6-cf1c7bb6b47b", "value": "Network_Session_Temp_6503.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "959832a3-3689-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776009997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776009997, "uuid": "43ef3c2c-42a6-4799-af7f-b13517036b9c", "comment": "Malware payload", "value": "245f0c568d816b2ba3878441bdea9974", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776009997, "uuid": "f4339dec-5d86-43df-9ae9-8f0a09afec3b", "comment": "Malware payload", "value": "64adf1715483f63fc47283393f89857f0545a45d9e7382417189b5084d19c37b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776009997, "uuid": "f1b536e1-bb00-454a-b1ab-778092078c0e", "comment": "Malware payload", "value": "aa0b98b71f1f1b98313a4ca44169d9844d13a481", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776009997, "uuid": "b99d6f33-b323-4165-b63f-1688aa79b0f7", "comment": "Malware payload", "value": "0da46ef0907855c9e494a6fd0565a700fbbc58bf7d661ccad65813aececf6e2845c392e0f559fe286590a4b792dc0f91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776009997, "uuid": "4f1f981e-a8d3-46b6-abf3-0a237180ad4f", "value": "T17AD46B1166F503E5E07BA738C817530BCAF2F28119B1EB2A05E905950ECBBFA776F215", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776009997, "uuid": "925a77b9-93a6-4e91-97be-87da303225a0", "value": "d386edacb5bc531cae23e0abe0d5b57a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776009997, "uuid": "22295196-809b-4bb9-9ce7-2c9e774b13a2", "value": "12288:3mRTlZmX9xZVLcftzbJF8PLC4/R5D+ay3keyd/:3mhrtftkPLCMgn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776009997, "uuid": "25441b2a-1094-465d-a095-5be5cba39940", "value": 613376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776009997, "uuid": "09bee51e-aec9-4cfa-aac5-f8bceece763e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776009997, "uuid": "cc4b27b9-8801-425e-b729-36102e0352f1", "value": "64adf1715483f63fc47283393f89857f0545a45d9e7382417189b5084d19c37b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e37ee935-36af-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776026448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776026448, "uuid": "84a43937-35cd-4450-8656-d463d09171b1", "comment": "Malware payload (Mirai)", "value": "f5db78fdd03bd8b365fc5426044786ff", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776026448, "uuid": "1c6fccc5-5b6e-47f6-a1cc-e483ab7f8526", "comment": "Malware payload (Mirai)", "value": "669cfe080d1ab5aa8eacdd9401235a291eacd7f9564b94739780b55fc5c22f3d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776026448, "uuid": "5c48fba5-85a0-4a0b-ab36-a9498dd9f10c", "comment": "Malware payload (Mirai)", "value": "acc61583a70383eeadeffe03ae0715cea51e6d9f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776026448, "uuid": "a5df0f1c-b9ee-464c-ae67-53e601e32702", "comment": "Malware payload (Mirai)", "value": "e7a24ad8797c8eb49ae53753d39c68219b918f62212f05262dadf54662ac02020857c503e16a38310190b78a8a74686c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776026448, "uuid": "348ba1e0-a9e4-4b8b-87dd-230baa49429f", "value": "T1C4C56B55FC509A56C6E096BAFB5D828C33232BB8C3DF70179D0487743BDA9AA0E3B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776026448, "uuid": "b28a4f0d-ceb0-4ef7-8049-5324e3fadd9c", "value": "49152:M9TVUblpZ5n8gMaPtbP0XI8wIeSU23UyZWvPla/QFrJ:M9CblZnVTPtwXwIlZWla/QFrJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776026448, "uuid": "29f82321-7f58-4692-93ac-eb8ec5374d7e", "value": 2498452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776026448, "uuid": "0f7d9af8-bb8a-4b06-8150-4aa2d88e9928", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776026448, "uuid": "964d3a0f-a27e-47ff-ad0d-2684816a3326", "value": "ciubuc_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e507ea55-3687-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776009271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776009271, "uuid": "57f44097-437b-4e2d-a4c8-49eb80b08f7b", "comment": "Malware payload", "value": "014f38401b98d524c4e536f9a631c1dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776009271, "uuid": "5af263df-75ec-49b5-9f7a-1f253cb124e8", "comment": "Malware payload", "value": "66a155f6672fbbb041cb754c143db91b30084f98e9102c280ba95ffda156123b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776009271, "uuid": "253fa213-cfcf-48d9-ad0d-6677834e7a9e", "comment": "Malware payload", "value": "ccb39bce0c7cd26d27db93361164dbdecfdcc443", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776009271, "uuid": "b420fff9-cf06-4f35-ae6e-f1c7986738bf", "comment": "Malware payload", "value": "c20a63ec45761bd16fda83418f475b50bf1eabba1a2b6ea4dcd9c72d8c5f12116e0292e192a5baa63939e3916daad4e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776009271, "uuid": "5c94f8ad-e980-48e2-94dc-09f43a445359", "value": "T1A4E42365F5264FEDC22CE73DE48A0917F716A611F874274E5BAAB1413E1FB18A0BE600", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776009271, "uuid": "855d15b0-77c1-4838-a6cc-84fb5c7f96e6", "value": "9b760feffec4fca9c313889f9a05ee36", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776009271, "uuid": "2072f70a-29e1-44b9-b9b3-8a79d965c490", "value": "12288:A83yNxxLAfRP4OmKBi1gBTABqH2oGRxwupyfxxLAfRF4W22BiniBvAjMd2oGRxU:V3sMflmKBi1gFdaxwuKMf122BinixPwS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776009271, "uuid": "3b4db24e-d88b-49ea-87cf-4d98c3835f5c", "value": 702464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776009271, "uuid": "3ebc69a3-53f7-4175-970a-051e160d8d44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776009271, "uuid": "21591a0a-b2b9-491a-ac5b-51fbace7968f", "value": "66a155f6672fbbb041cb754c143db91b30084f98e9102c280ba95ffda156123b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "272f6709-36c7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776036440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776036440, "uuid": "69ad85b5-00f0-4331-bc0f-a7d97696464a", "comment": "Malware payload", "value": "b3c2f54f1cba176cfa69ce97261f715e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776036440, "uuid": "f6f368c0-2b62-4b9d-9430-ead1cd39db78", "comment": "Malware payload", "value": "699d5f1753dbe8bbce7d368e9d5549ae66f8291311b061874a8bd762d9826f19", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776036440, "uuid": "c5ad0320-fb25-40e7-be42-b8433766f4f5", "comment": "Malware payload", "value": "56ae0663ea27d67439e896f1d2b6b79c990d354d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776036440, "uuid": "1dc26230-eb24-4e94-b3e3-d674ac51ddf0", "comment": "Malware payload", "value": "9b74db541741482227b9ffbad7bd397bca9c29c35065551112ba8f901af180d09062a7d0a24f91f79c8f208234ffc554", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776036440, "uuid": "1d3e20c9-f5a8-4444-a252-ea716a223877", "value": "T11D0112CA52203FA6C024CF14E1770D94420AD1D0B1E2B3E9A9F6003F8E88681F91CB87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776036440, "uuid": "fc2c741e-2ec3-4da9-8615-cedb1527cb15", "value": "6:SonH5fSUJLqnH5xQxpenH5SFGNIMSF+5cTnH5qX7K6FqnHaa8xnHLkLBLI7nHhAt:x3LijMgPNIOGUrK4iWauBI7X5n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776036440, "uuid": "b07cd328-c6f8-40e5-a50f-0f0313581a69", "value": 664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776036440, "uuid": "df0e7ed6-f555-450e-8b3b-ce2048aaaef3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776036440, "uuid": "3b752df4-23d0-46cc-a85d-b3b6ed7d3aac", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba00bf11-366d-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1775998032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998032, "uuid": "98d473bc-fb3c-413a-bce4-7acfa231da30", "comment": "Malware payload (Gafgyt)", "value": "02268bc0dfea9802a52033fd274bcfa5", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998032, "uuid": "c5915202-0c60-4af5-aa4c-dbd30e9492ec", "comment": "Malware payload (Gafgyt)", "value": "6b18fd6b8c8fb20954da96b7a6daf2534069f4d22f441ecedf0296819e4c0a9a", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998032, "uuid": "85cedfcf-ee86-4f65-ae3a-bface85432ba", "comment": "Malware payload (Gafgyt)", "value": "b821c9552a1eb1d052f7c8ed38af7f5832689551", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998032, "uuid": "92055cf4-9cef-42b1-8c22-5bf00ac3343e", "comment": "Malware payload (Gafgyt)", "value": "a871be3dd3550aa7207b312e3b10d5d335164ce9cc59192ce98a643c2567ef7f7795f222b915051e82a87c939e52351b", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998032, "uuid": "273599aa-0dad-4e31-9763-06ca34e06ac9", "value": "T1C0A3120D9B05E493F1C364E547C60EB933018AB6A1D3F0D7ABD05CA9654B3E76BD8606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998032, "uuid": "342b9844-56c3-4a4a-8e0f-e1b1cff5ea28", "value": "3072:p4IgazrE1xmzSaN0P7zWYwOa3HXDhS7EkE2rdD8VTCtyYg0o:p4IgSmxI/YwOaXXDR52rtMet6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775998032, "uuid": "2e678779-bed0-4438-a446-44693bb79778", "value": 105840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775998032, "uuid": "27f383a8-2d80-49f7-97a2-7b87ddb64552", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998032, "uuid": "b46c01d2-84e7-4a26-9c2b-8e13716cd5dd", "value": "redis-proxyd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "996c4efd-366f-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1775998836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998836, "uuid": "243fdb90-0c7b-44b3-9b44-453fb05f0a61", "comment": "Malware payload (Gafgyt)", "value": "0fb48410fd9fba2b7198d85395ad7897", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998836, "uuid": "7a2335e7-d9b1-4dc8-9eeb-cd11601c84fa", "comment": "Malware payload (Gafgyt)", "value": "6bf0662be83a2470033ed43d09aff6513efe0a8c644d0afc5e231e7dc98e0d12", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998836, "uuid": "c3bb85d7-d203-49f8-a56e-8f36fcab8092", "comment": "Malware payload (Gafgyt)", "value": "c1ca6198882ac2d962bf3c7849b9cdd1f1f7a10c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998836, "uuid": "29a7892b-121a-4637-883f-7ebe7c683db6", "comment": "Malware payload (Gafgyt)", "value": "982ce86579e4dd9dd896c7c715160c60111dc44e0b7eb48cd4ef6b6fb114f6b75bf945d706c75719fc92e547338aa867", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998836, "uuid": "53ea92fd-66cd-4161-9eee-671c78130ed9", "value": "T127347C73D9219E96D222A1F0B1F1CF780F62BD1989471ED9A5B6DEF44143EC9B0093B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998836, "uuid": "5a658872-d6b4-485b-933a-4830e1e4a2d0", "value": "3072:AeorHtRJxEmO7aG56AroeDie+H07GTyvQ5epOFPuNgmS4A/2KOnWPmRZTB5yix0g:tfmIocDie+Hly45epOFPuNgOnWPmzJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775998836, "uuid": "16415451-7da1-4211-82af-013ba0f71ab1", "value": 233680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775998836, "uuid": "45d59251-159b-4cae-a583-59a0e7a46462", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998836, "uuid": "3cd53648-6970-47a2-a28e-37c1fd542700", "value": "redis-sbomd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f2bc736-36a1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776020160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020160, "uuid": "8b2d5d38-a4e0-4caa-bb71-c43ec4c91ab4", "comment": "Malware payload", "value": "f3cb53dcd26738ac4049580fda971126", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020160, "uuid": "2df5912d-fc83-4bb4-9db2-e6f4d30449be", "comment": "Malware payload", "value": "6e28e9fe552be4d4ce1c9651b5a6409e7e66a80073097bace3e0f2b26d4a334a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020160, "uuid": "5dc30f64-691b-4632-8059-27bb43161fad", "comment": "Malware payload", "value": "d9bc2ab5961ce6003eef7350c9130fd3bc29db62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020160, "uuid": "843a408c-67ab-4e5f-b1df-d5eff988b691", "comment": "Malware payload", "value": "0aa50614d8793a2f9af76fd427fd42982884b5fa981ade327fd44377de7bb3ad7a16a3e807ac7eb678e2660325aca855", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776020160, "uuid": "7a692a6d-0a02-4e2b-8661-2150ad595f5a", "value": "T1F895B4DD766072DFC867D462DEA82CA8FA5174BB831F5203902715ADAE4D897CF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776020160, "uuid": "ae0b6ede-9577-42b2-916f-67f54de7739a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776020160, "uuid": "5f1b4632-4dcf-432b-8f12-b4fae3b8f631", "value": "24576:VqcuBzW6wit1Ywr2yHzmvS+t5aFmFRb/JMjTmawBMhsqCilV6UiCNaEglUzoiB:VMwit1VHCvBt5akxfMhsqXlqCNaPiB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776020160, "uuid": "0844c176-0bfa-467a-b8eb-deaaf84dac8c", "value": 2031215, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776020160, "uuid": "41d7e1cc-9168-4392-8668-89623e532ce6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776020160, "uuid": "593654f7-3aa2-44ec-b483-7ddcb503cb83", "value": "f3cb53dcd26738ac4049580fda971126", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b439016-36a1-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1776020153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020153, "uuid": "460adb59-8e76-4e6c-8cd7-12d427717653", "comment": "Malware payload (Formbook)", "value": "6e29e8d1035d037789820fffb8dbf887", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020153, "uuid": "8390f65e-fe55-40ad-8efb-1fa0702f9b4d", "comment": "Malware payload (Formbook)", "value": "6e86685cb289714605ec8e482fb7e19c1fd408d57e39f100ff9390a29d579e25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020153, "uuid": "95436dfd-bf92-4129-a1bb-879ec68da190", "comment": "Malware payload (Formbook)", "value": "f7e2eb5fecb75ad5370325a744febd7763223b00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020153, "uuid": "11dccdd9-1c59-4fa0-b6be-1eba0b0e4444", "comment": "Malware payload (Formbook)", "value": "89c9cf6362a92d8b5430fcc50920639c5b0e59fbe5c663c056fc8ef5b5b807960b393a98a12a9209950988565279b622", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776020153, "uuid": "b2724857-5154-4672-aff9-894045477f06", "value": "T116450234EFAFCC65D45206385070D6341971EE8EA402D39A99ED7EBBBC347036A88673", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776020153, "uuid": "d0f2cf92-d6ce-43a6-9216-4f32c11d3d78", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776020153, "uuid": "e6facd00-8756-4011-a5a8-fd7fdc13218c", "value": "24576:epy+cW8+v9B1QLhUk0kLULD9Bml1tgbjyXZuauZ74BGfbMp85Y+Bk:epy+rvxYKf3HpHyXZub74Eb9DB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776020153, "uuid": "803d818d-27df-4662-a485-ff035110eb24", "value": 1172480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776020153, "uuid": "83ac5935-3f11-4afa-aa47-6f851849fc82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776020153, "uuid": "e33a7012-b5d6-46d1-b6e2-de1a2403a00c", "value": "Detailed Specifications CAD Output Packaging Drawing_xlxs.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5e91545-366d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775998079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998079, "uuid": "ad64bb08-eb74-4254-bd46-6846e4de6f58", "comment": "Malware payload", "value": "abfd9ffaec09a60f11f072074fc5367a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998079, "uuid": "b31d4fb7-1d6e-474e-85ba-794190d31f01", "comment": "Malware payload", "value": "6f4d43c722c62f42212ea9cf8d3d90a48291544c0989ac9944386afef949c826", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998079, "uuid": "09d7999e-4e02-4bdd-91b0-4e9a0aec726a", "comment": "Malware payload", "value": "ad9b94fb6eccc6a68151ee7c55171eadafaefafc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998079, "uuid": "8c12ee15-be29-4418-83b7-a982d1d5a2f7", "comment": "Malware payload", "value": "567b3297c3d151c354a591da895056f95085decd1b6f43fe7ba1e65ef750328c314248f4a65e6a7a56587babc7b8ccdf", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998079, "uuid": "1398c414-6b51-4f94-9dfc-9b7543a94b8c", "value": "T141E31368BD148381E33758BBA115CCBE456CF895E998BD601CEEE8E902F117C84F5E8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998079, "uuid": "43b3b055-12f9-4b9b-ae25-0e7c0b21633d", "value": "3072:GTDB68L+UMfhSgEnOXP039pwQ90yTEl1fI5R9zC4w/1ni5yjUFy6U:GfB6QjMfgjnO/gDwTyYl1fI5R9zC4YnP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775998079, "uuid": "66b06eb6-af0f-4e9d-b447-873c8b5114fa", "value": 146368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775998079, "uuid": "151cf616-2abd-4e79-b271-6ce5d2b6d9f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998079, "uuid": "c4aa30b5-5ba9-4a4b-8d23-42ffe8b116db", "value": "redis-composd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88de6beb-366f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775998809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998809, "uuid": "af4af8e4-27c0-43c8-8cbb-7f1536af111a", "comment": "Malware payload", "value": "e9b45478813a11d5bb42f9f0bebb14a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998809, "uuid": "de3a761b-deee-40cd-a5b2-e4f2be0eed21", "comment": "Malware payload", "value": "6fd609e316f68688764194b9a080595d1d6f9e908ca98350007ee07f5c056055", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998809, "uuid": "2ed314a4-d899-4d22-a435-cdbdcb2c8358", "comment": "Malware payload", "value": "3db2fe749da32eb18bd5500d159b0b9d79ce5135", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998809, "uuid": "e0bdefef-3252-48f5-a5d3-b727308e962c", "comment": "Malware payload", "value": "85e2a0e03bb631116b98f331b1de540bbdfd104fe2764fc7c76f173dd6d5ccf77ca4e71e78de544ee725a5581b3d2285", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998809, "uuid": "29f3bbd4-e053-4292-b8a1-b6fd2bb0ed75", "value": "T13BE312426F21DFB5F011C8B187043CC1FA9D21ABD9E8E987CDD55A265A7C40A3A24F2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998809, "uuid": "d322324d-c441-4b4c-9e12-d62cc3b24721", "value": "3072:2UsttYf+HmaG7zm6DmiDGC9Mcsi4YgJtgdIPf8Y:2tHmaGPDlDV9MTi4YgJtgd28Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775998809, "uuid": "70194b2a-575d-4398-8d09-4ceef13c4f71", "value": 145780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775998809, "uuid": "9a7b62a6-2efb-44a5-8c47-ec7e069cf858", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998809, "uuid": "016fbf92-a702-4f95-add7-26b13c7dc307", "value": "redis-credentiald", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f6039f9-368a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776010335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776010335, "uuid": "ab8e79b6-b856-4549-a193-0a30ea6725eb", "comment": "Malware payload", "value": "d45da46f866da60240c213af02f97ebd", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776010335, "uuid": "e07ddb70-3e35-47fc-8e56-c23a821abb5b", "comment": "Malware payload", "value": "7057b202a8f7ca309c40b64310aab4ca0a19292b89ca2f6b94423ad8ed37af3d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776010335, "uuid": "f460f52e-3dd7-43be-9091-734145c2ad62", "comment": "Malware payload", "value": "dbf2c25c6ca2fccf64841b7557ac8a8996cdc63c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776010335, "uuid": "62b628c5-83fb-44d1-8534-09d0329456e1", "comment": "Malware payload", "value": "00d492753b804e18a6e505135cf1427ab52e1cdf6e2feb797fbd096c583e45976d48536ca5ccc3155dd53fcf43b6a5ed", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776010335, "uuid": "324b2960-8691-45d2-b203-aa354391e475", "value": "T180137D6966857C24AE99883B1C7E2F0CB9A983E1310451EDBFCB3CF58C49B9CD21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776010335, "uuid": "0230aa32-7ef6-4cda-bfad-18672508ae64", "value": "768:bJ+o9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:bJ+1cy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776010335, "uuid": "03601d59-b2a7-4bb9-8dc4-5e44ac1be8e3", "value": 45519, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776010335, "uuid": "38bed13f-929a-4d01-9bc3-af3f9d3b24b3", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776010335, "uuid": "74e67394-2d54-49ea-89ad-523b303cca8d", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05eed39f-363b-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1775976255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775976255, "uuid": "c51b0857-ad85-4a23-a1de-a6c5af79b0eb", "comment": "Malware payload (NetSupport)", "value": "7ad27ad02b6b9716099035cb90691c20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775976255, "uuid": "05f016b1-6944-4229-84fe-58bc6e62a2c1", "comment": "Malware payload (NetSupport)", "value": "70861694a39dca31427cd9697797be05f9acdac214f9965a1969413a69831bfe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775976255, "uuid": "046c6e2f-0f7e-40fc-b25c-6724837ac44d", "comment": "Malware payload (NetSupport)", "value": "474f84527ad2f5dc56ff4bd7d703f5cf624bbc9d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775976255, "uuid": "c73eb8c7-89b5-4afc-9bff-51c6bd4a0e52", "comment": "Malware payload (NetSupport)", "value": "ee07d9c2461dc165d6921cc05191e28bd6ffe1785a7398a6d9db49dfcdd895f3bbd70a6da3140459863cb8b18d095cfc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775976255, "uuid": "1e0584de-ffaa-444c-b768-c9b4d3cc40d6", "value": "T183266D17EE640AE4C796A1784823E7C6BE28B400132123EB26DD63596F537FC4677F29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775976255, "uuid": "f9bdcd8d-64a0-4e27-b9cc-0d00567d89e7", "value": "3271ee162568f50a6810be9b8973807f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775976255, "uuid": "51ffad3d-8062-48b7-8d61-15f3eeea8833", "value": "49152:zfj3DL5oS11wE6pHFJKt5+l65+8mYjLQclzOJU:zf9n5SlkaIO2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775976255, "uuid": "20b48283-ccbc-4c83-853c-55f9a2e742d8", "value": 4499989, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775976255, "uuid": "86e7c2da-ea15-40dc-b682-70aeda0d19c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775976255, "uuid": "26462d21-4fb6-40cb-843d-d9dfc257285c", "value": "ck-3d80df5d12cdfe6450a782fc87bf66b444.google", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94cba0dd-366e-11f1-a769-42010a9c0008", "comment": "Malware payload (GravityRAT)", "timestamp": 1775998399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998399, "uuid": "640cc233-d926-459a-b7e7-9e21d031d178", "comment": "Malware payload (GravityRAT)", "value": "3581c2c21445840873d60e0633bfb385", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GravityRAT", "colour": "#4729DC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998399, "uuid": "99a74ff7-6235-4d23-8806-caa70a7b3423", "comment": "Malware payload (GravityRAT)", "value": "70ea8229bf843ebc65d7c57cad4fe04dc9e099ab8098d9278557e067cf006e0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GravityRAT", "colour": "#4729DC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998399, "uuid": "b6f9c244-a258-462d-9943-2c3f04b3ae7c", "comment": "Malware payload (GravityRAT)", "value": "5b99977bc25c3aa43434527cdf7565973041047f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GravityRAT", "colour": "#4729DC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998399, "uuid": "7fe1e335-4457-4972-a9a0-c33ca99019dc", "comment": "Malware payload (GravityRAT)", "value": "36bafb6f5b738257d2f637cde47b59f4f26d7465f66db7a01c355bf213e8e085e8215077b4ef83da0beabd0c63629ae6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GravityRAT", "colour": "#4729DC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998399, "uuid": "61b6df89-8da0-45a4-91fa-f6989a64661d", "value": "T18FB6BF32F6E405EAC2BFE274C06152217EB178675336FB8B5F8055E91D63BD0A92E312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998399, "uuid": "007e8ba8-f8e3-4637-83b4-c46c7618d835", "value": "f0070935b15a909b9dc00be7997e6112", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998399, "uuid": "71c917b1-455f-4bce-bcf0-e8a78fc28a8b", "value": "196608:I+D5q1SGs2yRwtkpqShRBUhRthRrhRShRnhRNhR8:DAkLRmR/R9R2RhRfR8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775998399, "uuid": "2aaecef0-ce12-4c81-adc0-c3deadd0e25a", "value": 11293061, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775998399, "uuid": "a8b24007-30df-4b90-9b21-414cc5d462e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998399, "uuid": "1da31576-a194-443e-a9b9-87c49042b946", "value": "jkum3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b71d6192-367d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776004899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776004899, "uuid": "abde15b2-9616-497c-8a2f-2915245518cd", "comment": "Malware payload", "value": "5f80d8a3a935d3fc7b72e1502262d8c1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776004899, "uuid": "7c895645-7f65-4adf-a8fd-18a212590122", "comment": "Malware payload", "value": "71331f019f2dd6e77bc397b3edb905b0e9213e9f808d3e4b64c1d4f41fa4c51b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776004899, "uuid": "f3229898-d385-4d58-92bf-760e775dd591", "comment": "Malware payload", "value": "caed2c814f093e1d4eb9ea7b859025964e560b0f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776004899, "uuid": "85fa134a-8f71-4832-be8d-00a39bfc7887", "comment": "Malware payload", "value": "60153a9065d792392659b7157e21bb1288faaf5b4481de9f93b4ece68b2d4db56672e07daab271b653f18dd2c14b54fc", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776004899, "uuid": "67229e86-09ed-4325-9bab-8134ead9d97e", "value": "T1C135AF05E7D421BDCC16E3BE65C68931FD647C09D425DF63260A8F72AEC061429BFA2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776004899, "uuid": "603bae35-64f7-4142-8004-b269991cab13", "value": "59cf6205f0d55e08de66f73ba4498e82", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776004899, "uuid": "f2a440f1-58e3-4a8d-988e-b91ab5c68ba9", "value": "24576:XoklfTZMbQLvXq8rW9j4EwL6/lhSjdU8WMBYoSHGAl2i:ZT2bqfIRA+tXMqoJi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776004899, "uuid": "26906f48-2d76-4a21-874c-e8bb2755d9c1", "value": 1119100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776004899, "uuid": "b0144d5a-8a21-49cc-8408-b09c51edf1db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776004899, "uuid": "3e75134b-0839-4e3a-adf2-bfc2a2ab0171", "value": "sqlite.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2995f660-367c-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1776004232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776004232, "uuid": "7ec6b644-f33c-4244-beb9-80867f6fe4a6", "comment": "Malware payload (CoinMiner)", "value": "468bb936f2ec98034659301d1621f86c", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776004232, "uuid": "78be1817-f77d-4caf-8721-d8f7b974689d", "comment": "Malware payload (CoinMiner)", "value": "72bb2e01ca126f936d500bb3bc05c575e6295a37806863cb556888b2aee8c40f", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776004232, "uuid": "242a644c-6d4d-44f8-9f9c-6b224d7a72b2", "comment": "Malware payload (CoinMiner)", "value": "eb4e05bc415d7586ded0b4b145e6a23c6c18ef20", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776004232, "uuid": "a6f92ff2-a902-4063-aed5-61e542148566", "comment": "Malware payload (CoinMiner)", "value": "52afe1992ba5b823ea3157be003930c86fd074ff82f1993dc176caa7592a42e96840e5cf4fd22e282b76c0c2d831d493", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776004232, "uuid": "1d9458da-ccf0-462b-a8cb-b724e8aaa0df", "value": "T12D33D9E4FCA8D93132348674F6CD9501F9A70A3B421A3514719EA81C7F3C795B1AEE2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776004232, "uuid": "10b18fa8-ab9d-4d7d-8535-2155b0bb0c53", "value": "384:6aVKQ0VX1ibU72K8ZB4gmSOU3pWxTN+b4mUjI5RnTO5H15/ZhzcFLU7SWioxD5vW:6agQ9OEJ3Gk5RTO5H1FZSvr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776004232, "uuid": "15e23efc-89c1-4848-9eb6-fc8ba43a0b36", "value": 50163, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776004232, "uuid": "5fdc6c44-fa37-43d8-913c-916f3e97831d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776004232, "uuid": "49bbdcfa-4dc3-4ee2-914b-032e2363646f", "value": "q12.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a5ade9f-365c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775990677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775990677, "uuid": "c7668982-e62f-4ad9-8abb-775f5729e601", "comment": "Malware payload (Mirai)", "value": "2c3d0a9a9a0f08920c57527e36de9539", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775990677, "uuid": "544c008e-5ae0-49b0-8584-bd91002aa537", "comment": "Malware payload (Mirai)", "value": "73f5a00310a77473eb3ea14fd5a3ded7fc3262e31aeb73e74ef69788fd913c35", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775990677, "uuid": "eacd172c-f272-4ff9-848d-55d44299031f", "comment": "Malware payload (Mirai)", "value": "8d7f8350e933eb674a5a341c526442fd62ff04bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775990677, "uuid": "20551f6d-79d8-47de-9c90-536d18d09580", "comment": "Malware payload (Mirai)", "value": "734bf71e8907a919796ee5168c926c936f099fcc8258eb5e60ae8f7173476a6ed567335cbd454e5ae9ce3d9f8d5e624a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775990677, "uuid": "640e552b-38db-4c2b-85fd-0a0017efe5a5", "value": "T1D2E56D62ABC7DCAFF7A9037516F389B4B3E8A05331758DA1C36B76061F251A4490DACC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775990677, "uuid": "ad164f7e-94b1-4dd5-aac0-3a524d262bbc", "value": "24576:tU6sNdHpqZl5mNm+9pSkXfp2UDRjY4d5pT6buoDSup3AVnn0mqYzIvAJPPAyqp/+:NwpqZl5mNmM20h2Sup3RuzPJPPAB/W7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775990677, "uuid": "90e580f6-d7ac-4890-876b-5bb6fe351a80", "value": 3081864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775990677, "uuid": "50096be2-1155-4ae9-95aa-1a2c929b0d2f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775990677, "uuid": "ffaaaac7-39b4-40f3-8e0b-e2fa7c301d6f", "value": "ciubuc_mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29c6dc7b-3690-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776012822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776012822, "uuid": "937c7475-92f3-4287-951e-52267dbd3664", "comment": "Malware payload", "value": "fd79d2d05bf5a6e241e8aa64455286f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776012822, "uuid": "ca67a049-6012-41b3-acb7-80dcfa46b4f5", "comment": "Malware payload", "value": "77eea991e5c11da46e10c208fb8920a08a9bbdd8ffd72d0d6548fd8e45aa4647", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776012822, "uuid": "7baafc84-08ce-4582-9fea-86909704e735", "comment": "Malware payload", "value": "1521c1baf8f031a596bebbf12702ad821283b7e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776012822, "uuid": "994af3bd-05d9-4cac-89f8-3833d4e631c0", "comment": "Malware payload", "value": "80d99cf9796ef538c6b36e9c87fbf5b9320354ab97bb8be0cc9c040b625a70720b9945f9acdbe812fba4aa4ef261c65b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776012822, "uuid": "20ce59ef-1e13-430d-83e8-0e7ea1554264", "value": "T17AD47C1162F613D8E0ABA779C807530BCAB1F2811A71DF2A11E505950E8F7FA77BF246", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776012822, "uuid": "32a302d2-3ed1-4b38-b68b-fb294d02e8e8", "value": "d386edacb5bc531cae23e0abe0d5b57a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776012822, "uuid": "d58830e4-0c22-41f8-97de-7b03736127e7", "value": "12288:tmJTPrntKC+rAGAPz+JxNqD0fpO3dD3UIjU7rRPI:tmpD0ClzD0fpAkIur", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776012822, "uuid": "a37ce568-ddfa-4b53-8f88-959a4144daf9", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776012822, "uuid": "352de325-c9fc-46c0-a2a8-be29fe22f735", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776012822, "uuid": "85882131-494a-411b-82d7-41299f58fca4", "value": "77eea991e5c11da46e10c208fb8920a08a9bbdd8ffd72d0d6548fd8e45aa4647.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3727e57-3674-11f1-a769-42010a9c0008", "comment": "Malware payload (Metasploit)", "timestamp": 1776001027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776001027, "uuid": "ea3dd9b9-bdca-4679-8f00-ca1141441dfa", "comment": "Malware payload (Metasploit)", "value": "082c0a4fc641539de414d4d33046681f", "object_relation": "md5", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776001027, "uuid": "03d2bbf3-7bfc-4cd2-a3d3-0128140086c5", "comment": "Malware payload (Metasploit)", "value": "78fa109c8570f62d2ee9ee6663bc2ad7b151b88029389470b57f54a30c102942", "object_relation": "sha256", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776001027, "uuid": "85111b51-0d88-46a0-a492-77de1c6e360c", "comment": "Malware payload (Metasploit)", "value": "107099136ea6fdecb8b700fa58da8719f0d41bca", "object_relation": "sha1", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776001027, "uuid": "ea5f7902-8f84-4d22-b8b3-c5f4afe1a37c", "comment": "Malware payload (Metasploit)", "value": "537544342429896db8ca047e3890e881489059585191b81d48fb25ffa2ac9985ee1a7cfb78fad437b330841123bcea8f", "object_relation": "sha3-384", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776001027, "uuid": "7ff2b630-348f-4304-9970-eb28b084dbc2", "value": "T1A851F6932051B8EA425283BB3A496BF7807FC224A146B044FB8C5F9DF5DDE63398D6C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776001027, "uuid": "e1d0fc93-b9be-4b9a-910c-cbd7009ddd40", "value": "48:q/SkuKZf+vDgQfBZL0HuQHFhFi5QsvuiBrVxqT/su:q/fuSf+vDgQfBZL0HHFmAiBrVMR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776001027, "uuid": "98c8cc7d-363f-4de3-85b4-2a9987ee9934", "value": 2503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776001027, "uuid": "ea9e5ea5-69d6-4ddd-a19f-1123f5ef8a33", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776001027, "uuid": "0150820d-3520-4d2f-b369-8a057ccc54d8", "value": "update.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e99a4edb-362b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775969765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775969765, "uuid": "96808ad3-399e-44f1-8493-602ea8f8650e", "comment": "Malware payload (Mirai)", "value": "db12c64b9e71d3fea70ad42b3891efae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775969765, "uuid": "ff19a66c-db67-41ac-9dec-666593651dad", "comment": "Malware payload (Mirai)", "value": "796bf71995682618f5b1af3ccf095924b02215702a4134f84b55a551474dfd9b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775969765, "uuid": "baab41be-d25a-420b-bcde-7de5da414475", "comment": "Malware payload (Mirai)", "value": "ed7f5da0e3853c4d51d5ac801c7ac53457d46625", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775969765, "uuid": "f778cd29-455a-4fc2-9df7-e2a37f3d72ef", "comment": "Malware payload (Mirai)", "value": "2846ff1246841d9e9e7c3fe99cbb15aa04205f937d49d78e0c2a4d3cb2623cd23c5fcdcbb1a43077beea55bb985c6015", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775969765, "uuid": "26af16da-2dd2-451f-8f26-99bbb5ae0659", "value": "T1E5B56B43E683C0F1EA1206F11117B3379A399A154136C9A7EF98AD39AE71742E71E37C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775969765, "uuid": "b6160a28-0ce5-416a-bac2-20a1e334b687", "value": "49152:PU90K5rREPoYUwLfNjQEgDd4fIlA9iDpZ1kVn4:Q5CPZeDl5pZ1R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775969765, "uuid": "68d0907a-06b3-43bb-a27a-eb1054e997c0", "value": 2411388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775969765, "uuid": "5202cb15-1199-480e-b795-cb3f61c88cac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775969765, "uuid": "451601cb-290d-4569-8e9d-7c8a058d6389", "value": "ciubuc_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6ada2bf-36bf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776033299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776033299, "uuid": "2ce57f4f-5b10-41d4-9de0-21907cc89d86", "comment": "Malware payload", "value": "033d467879ffca6ebde44e1feb187fda", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776033299, "uuid": "7c345ad8-520c-4124-9f76-5cb4043244b4", "comment": "Malware payload", "value": "7a1b59d5e3288bf4a4be566a311769bb5dd6ffc964cac4165aa8c46d386d3d8a", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776033299, "uuid": "fe54a8ba-b42e-4f08-bfc9-3cba85b1fb5d", "comment": "Malware payload", "value": "11fd4607d415a23b845b917c447ce4f725b1e428", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776033299, "uuid": "b5a1599f-15ba-4dbe-81ed-0f6dfead86da", "comment": "Malware payload", "value": "54fd1f539ce05a285db5868d4f89a61cc0d3767407a41365a308c41ebc90420787e582f434e4cfc2ea3f9e35d57d52b5", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776033299, "uuid": "8bad63d2-d54b-464d-a766-4b6b60ea1897", "value": "T10624B723E66288F9C49FC2749FCAE6B36670BC585174F11D5F804B127E0BF609E6D289", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776033299, "uuid": "3f2d3398-a6cb-452a-aec3-8043bd39207b", "value": "fb3237bad2e3a80d9e1f2968c22a2d78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776033299, "uuid": "1156e197-1e4c-4450-a538-c02afce095cf", "value": "3072:faKDJVZif8Kqr1CuJC7QmVQiMmYg4yfnfYL3YwcASWz27FLIJP5L5mtUt:LxCE8fKPc3WzLJP5L5mti", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776033299, "uuid": "0a4f7b46-01f9-4d40-9100-8f891db4fc77", "value": 221480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776033299, "uuid": "8d8f8aeb-4b59-4823-83da-d90843083d11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776033299, "uuid": "6fd02789-f8bb-454a-94af-d5014e01a30f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da405123-3658-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775989067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775989067, "uuid": "08f0f391-7b58-46d5-8f47-000b07bd5150", "comment": "Malware payload (Mirai)", "value": "5106b95e4021431db75eff0a9484ee9c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775989067, "uuid": "366493b3-f14c-4e41-ab3f-1836175f488f", "comment": "Malware payload (Mirai)", "value": "7ccd8cc0373fdcd489db2db9aeedd1bc4f4033d2a7f0a68f7f848bef8ba45643", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775989067, "uuid": "5888a36a-b080-4e8d-8d90-2f88a786066f", "comment": "Malware payload (Mirai)", "value": "0c7a62cc2d81e7c2ce4c366293cc516cfddd9aff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775989067, "uuid": "7d9313f2-5066-4ea2-9945-4323a878f687", "comment": "Malware payload (Mirai)", "value": "973ca5b976b14a52950c8bcd1e72fcd47a9bab24641d5a35ca14ce1a4d180da1467129e53dae8f9b4ba5f0ed4b9d49bb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775989067, "uuid": "d539192e-c7e4-4109-b42f-46f7bdf1b63f", "value": "T16FC55B55FC509A56C6E096BAFB5D828C33232BB8C3DF70179D0487743BDA9AA0E3B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775989067, "uuid": "fca2f6c0-268d-48d2-8d08-aa560e2f34e8", "value": "49152:O9rRDHOWNZEqUyLqw5UO7tI8wIO4k/zyZWvPla:O9pHO8EbcqwpXwIVZWla", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775989067, "uuid": "67182d0d-1314-440a-aa77-304fc626f975", "value": 2498452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775989067, "uuid": "23255be1-b50b-43b6-9880-d86e9e0e5cb5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775989067, "uuid": "34b1be59-9989-4513-8115-bd8525b1cc88", "value": "ciubuc_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a98553d-3680-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776006113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776006113, "uuid": "086abde7-4712-40fb-a8cc-7e4e762f9eae", "comment": "Malware payload", "value": "5915a81557144d9a7977d9e84cb8ac8f", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776006113, "uuid": "836360ca-d14f-41a0-ad2b-ecc204e82050", "comment": "Malware payload", "value": "7cd00e77960a6de868e965f9b0c10bb36a12334c03200ab358cdc72bde2f4e75", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776006113, "uuid": "7ad928ba-d2f7-4efb-9f03-9594d825fa71", "comment": "Malware payload", "value": "32cf505000f8894230b1b375e0c5c62222af1669", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776006113, "uuid": "c3f69a88-5266-49cb-96fa-8c1eda045b89", "comment": "Malware payload", "value": "753efc1524944b2b094180925096fae8ccb94251bb8d64685703faee6f4584fe1075b2039fd000d1fe2e7104ff3927a8", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776006113, "uuid": "8d656eb1-0096-4bd2-9224-9e77ff447414", "value": "T139C59C0B6CA549FAC4AAA73588B76291BB74F8090B3233D32E9176743F767D05E38354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776006113, "uuid": "be28ab46-6510-4809-91dc-d1404e43d028", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776006113, "uuid": "4aa5434f-5c5e-4548-a350-34f4ff34d0b4", "value": "49152:KE6wtiQKy4B5mpUPeFsqbXwd49ZBZfy8OBsT89NmxbpIjp:K47nErPcgmnfy84sT89NmxbGt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776006113, "uuid": "a5447fff-ece7-4638-a2ea-ba8344a3625e", "value": 2637440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776006113, "uuid": "e0c347cb-b83f-4fcc-af7d-916277a106c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776006113, "uuid": "a0537a7d-0218-4983-8f7f-c1b0c62123b5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fbcd434-36a3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776020966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020966, "uuid": "6189a909-ae68-41f4-b2bf-c690f3132e3f", "comment": "Malware payload (Mirai)", "value": "08e6f20c245bab3cf49c3d72a6d506f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020966, "uuid": "2a6ea51a-0afe-42b8-8c71-7c4c90df9fda", "comment": "Malware payload (Mirai)", "value": "7cd5ab7a58a6cdaa3dd2d09b0028450b0053339d6da05e7c1b23893ea0971b3c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020966, "uuid": "cb7c80d7-125f-448f-b5ff-198df50aab85", "comment": "Malware payload (Mirai)", "value": "d6b474e76626caf45316eda6270ffb20299f6527", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020966, "uuid": "9c0b07ba-eae7-4cad-a4c0-e870e78211e2", "comment": "Malware payload (Mirai)", "value": "d29c9a11bff0b45aa8e5ab84ee6ec3dc3e4ee8becc583a4b2fc015845cd59b6b6c8e235acd3f16b49c1c0938225b7a6a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776020966, "uuid": "81fda574-ab08-4a2c-997d-0e3ab792f06e", "value": "T1AD056C237B22CFA4E314D27009F3CA515AD525A20AF25489B2BCC71C7E6162D6D5FEF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776020966, "uuid": "bd2b0ded-2584-472e-838d-efe0aab99f89", "value": "12288:j434V0oAvbiyyLjwQftej6bks6tFgpDm5kAfaSXF/mEK8pWDAE/qK:jA4V0oAv/uftY6N6t6yySXFunV3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776020966, "uuid": "4b8e3e49-bdde-40ba-b6e0-38c6e167379e", "value": 804924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776020966, "uuid": "0b65ef79-d3f0-42dc-9454-be2442f39718", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776020966, "uuid": "3422937a-8549-444c-9fc9-d0efa4ef1b76", "value": "bot_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af15d1a4-366e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775998443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998443, "uuid": "84e2299c-f062-4d32-9db8-95d868a8458b", "comment": "Malware payload", "value": "5e7779825de29af9c5d8f963bbfdf08a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998443, "uuid": "aba4f7cc-58ed-4d84-8f78-5627b1b16770", "comment": "Malware payload", "value": "7cd7473941d737e0ccb7547830412ed7a4dec1adf810a83f166d95b9827714e4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998443, "uuid": "ea34186e-028c-4a19-a078-8d7036d22d1f", "comment": "Malware payload", "value": "922a084c214c3a6b057723f40079511d64f7a232", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998443, "uuid": "0074d811-62b8-42f3-a7d6-295e17e3625b", "comment": "Malware payload", "value": "e6b1d9bc3dff69fa2daf023bcf0d1a91934a2b264b5f6d451b5d7bb79f7894edbfee5115eb56d25fabb4a752fed6b0b1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998443, "uuid": "4a9a82ef-05b0-4b04-adea-bbda1a5b60a3", "value": "T13E21AD53A863D936F48B01799BAEFE44AF72F01B3420F854F49E18915F6C926E560B01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998443, "uuid": "cde111b7-d4e5-4016-99e7-3621121970f9", "value": "24:WCFMAXmWPQ3YX3nMbIjMv/PMP8McOMXMUwMG9MHiM/VmM/V0MMMds/MhCBls3Mau:dFMAsoXXMbAW3I8v1XZw19Iiumu1MYsB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775998443, "uuid": "8a24b060-6cf1-4b46-ad1e-599b74d51c8c", "value": 1389, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775998443, "uuid": "e03864c7-de6b-49cb-8515-25a204c37a32", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998443, "uuid": "0ceb49e0-d7f6-4be5-b0f0-62a14a86e516", "value": "init.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83e64b3a-3661-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775992787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775992787, "uuid": "e01275d1-5181-4f2b-9a63-e167cbf21987", "comment": "Malware payload (Mirai)", "value": "f9e14661da1086cc3d2f4e4e9b52332c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775992787, "uuid": "0a206352-6f60-4f38-ba88-d0b749835cdc", "comment": "Malware payload (Mirai)", "value": "7cf1481b34156d012da9c94d09b95390c5d3d0ef55795cee48b12c5be6ef7979", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775992787, "uuid": "672ccbf7-9e4a-42a0-87f9-5a9eba6bb537", "comment": "Malware payload (Mirai)", "value": "3e5e0e5099e535dbf679911148b02d388d918370", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775992787, "uuid": "648ee7f1-1991-4e75-a205-2db9f7d4eb27", "comment": "Malware payload (Mirai)", "value": "a186fcd1856d3a83da90b40ca4dff999e61d1ba107e5158b304e0fa69f2d29c6a43ebf41edd7fe90352bc175c9416216", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775992787, "uuid": "940802c0-adad-4519-a4bb-3ab0254eca70", "value": "T168C3F70ABF711EBBE4AFCD3345B54749289C460621B92F3636B4D81CF25A68F1AD3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775992787, "uuid": "51958429-c32b-41bc-9b09-4b6a9c4a2f50", "value": "1536:qCxI8wu8uMgen5/yGoR534n3if0kBq5YCp9bJs81mMHd+Ljd13yZfqFX39wu7r8Z:qMBx53d73V0FUlXTYDlZX5n40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775992787, "uuid": "9a29355d-65e6-4af8-8603-82e77207c539", "value": 127696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775992787, "uuid": "69e65015-51ad-49cf-b453-f748f6a9cdfb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775992787, "uuid": "98e461a1-e65f-4dc3-b5e3-70df24649879", "value": "splmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f77ba314-36af-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776026482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776026482, "uuid": "813e74de-5b50-40ac-b443-17b3266e8410", "comment": "Malware payload (Mirai)", "value": "de35831f5543f745bbbd51f466604d15", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776026482, "uuid": "55f6a18b-24b7-4b9d-b96d-12f58cf696c9", "comment": "Malware payload (Mirai)", "value": "7d6954bdb7b272e82982a64c402df5fadf8e25ead0559c4b12b9fabd62f0f01f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776026482, "uuid": "b2fad55d-7786-4997-b314-4e41aad2b2e0", "comment": "Malware payload (Mirai)", "value": "214df3e677fb423681d9bf76f3d1f5df7cfba73b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776026482, "uuid": "ee095fb3-6085-485a-810d-be2a1e5aed29", "comment": "Malware payload (Mirai)", "value": "3a66bd101420064eb545fcb14971c71755718a027dd501282007ddc64e18d45aafe9339f4d70657ceb11e924b6f6723b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776026482, "uuid": "d36692e5-1f2c-4bad-8cdc-e0c683f0990a", "value": "T169C56D027B1D09C7F1A71DB0263F17E9C7AE8AD621F8F186254EA9CE1375E3012467DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776026482, "uuid": "20a7f596-12f6-4072-a531-b8152531d56c", "value": "49152:hSgyA4GVIvNdOI1EhTZtwL1fBtPWW5+Gu1HrkDFatJ5evPNtjyu:hSgyjGVuNdOI1EhTZC5BFWW5+Gu1Hrkr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776026482, "uuid": "7813312f-289d-43cb-bdc7-0db5dbd71d75", "value": 2727788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776026482, "uuid": "69ab95ed-9bcc-4d41-8822-31036d5649e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776026482, "uuid": "0d4f0490-351c-456a-b573-1334828aec93", "value": "ciubuc_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6d68b23-366d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775998027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998027, "uuid": "690065bc-bc50-4bbd-9fba-9884f432efb1", "comment": "Malware payload", "value": "1189653a00ac34113425435a53985ebf", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998027, "uuid": "27a8ff4d-b4ee-4389-95ea-b543876eb674", "comment": "Malware payload", "value": "7eb2c72f4aeeac4143bbac729845f23e051c735bf9f693d9783ff92fee0b6d37", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998027, "uuid": "6854d318-c798-46a7-ba51-199e345a6682", "comment": "Malware payload", "value": "ebbda4a16acce99d56da6b9619cb737df09b06dd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998027, "uuid": "42148a10-864b-434e-a7c9-71a304adc14e", "comment": "Malware payload", "value": "ba7805d09ec963b70e43a4833ef712f4ec237f94b916d447eb88f7e6be4046aa6f4c5896328e28f44c886dcb3aa975be", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998027, "uuid": "fef85387-3dfc-4016-8b83-2c2769a46cf4", "value": "T17FC31377BF44F514C1424AF85BEE00FD7E58F0BF969602B9D44119FE1260A4A4AE863F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998027, "uuid": "9b349409-c9e0-4af2-b43a-058f4d260af0", "value": "3072:NSE2A0fM7TT/F/7DiOV7hl3E2KhijWBZymUXswBxOVbDFNdxd:NSE2A6M7pxVPU2U9BZeXBxOFF3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775998027, "uuid": "371e49f1-5c19-4d9d-8357-81e6e81b2eab", "value": 125456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775998027, "uuid": "3bd7a31f-c3f2-4cb8-8eb5-0c0f92c9863d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998027, "uuid": "9488cbeb-9d2c-458e-8c98-96b0205a84e6", "value": "redis-scoutd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8900633-366d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775998030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998030, "uuid": "3bcd9b53-7c2a-4d20-ace2-6f40dc87310c", "comment": "Malware payload (Mirai)", "value": "6593c5faeaec5a155602221165acd1bf", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998030, "uuid": "b6f067d9-5220-42d0-b75f-53747699db84", "comment": "Malware payload (Mirai)", "value": "7f306047fd8f8be61ec871181c0419d58f02e5c8c0857f7259a39b867f53b7cb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998030, "uuid": "b1489ef7-29b7-42a1-a7f4-c1d633c14b22", "comment": "Malware payload (Mirai)", "value": "896699d9516fe199cae9c65a9e2c28ee78aed297", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998030, "uuid": "23bbbdd6-164b-410c-9b2b-9413de4c5495", "comment": "Malware payload (Mirai)", "value": "5bbfcf4950dec6d9b898d4885483146e8218cda6a2786a7b79e6b1ae9981464a296eab1f3d479cdcb0f4cddd85553ca0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998030, "uuid": "07b1e6e6-38d1-4321-9fb4-65e42fcbaf12", "value": "T14B545C83F900CE7EFC4B937649574915B030FB7608520A77B217BD9A9E3E1DA2522F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998030, "uuid": "a80967b4-039e-4b3e-ab93-29ea4647cdec", "value": "6144:Scry3Z0hU5L6R3VNrPdulMyJcuOzFFSzF0XpOLEGsN:POepNy2aFsGsN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775998030, "uuid": "b148976f-f510-4ef5-8685-4c55cb2096f9", "value": 279920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775998030, "uuid": "a935cf43-098f-458c-9200-23f26af32d6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998030, "uuid": "e82a3fa4-a219-4e4f-98f4-3bdaf7907d38", "value": "redis-scand", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dbdb563-3680-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776006038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776006038, "uuid": "5be3282e-2119-416b-90e3-4b07afcd2142", "comment": "Malware payload", "value": "769115973d1fb8d65f4a76101d273615", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776006038, "uuid": "93b525bf-a5a1-49f1-aa82-d037add9571d", "comment": "Malware payload", "value": "81eda518ff6ebb25e6aa8d626b78cd2eb6cb38b5d7efb34e021289e76993414b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776006038, "uuid": "0f873bcb-638c-4118-bfe4-d924d9790e57", "comment": "Malware payload", "value": "33eff2e75599884763cc369ac6a0387c279e3cd7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776006038, "uuid": "799fea80-02e8-433e-a012-a8a4712c81f9", "comment": "Malware payload", "value": "2d1c608f3ab218d375b4032f0e8376fde373cb92808f9ca5f4925e0ff4f11eba43949cf98545a403c9e47eee8bad0c92", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776006038, "uuid": "2574ea86-3b2d-4157-bdec-79cd7cd6410d", "value": "T186D51282E189A8DBE47A42B39C7DA4505126BE6DD079562F2493F62955F3383303BF0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776006038, "uuid": "40459879-9e8c-49b3-b0d8-aff96ca989c2", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776006038, "uuid": "7e82db5b-31bb-40da-8110-888fb5c2a69d", "value": "49152:IGWhaJXOysh8slCRSxfljmffdDylwLrnDITMSbsTsuAihSezsmaD4r4F7Ht:HWoXOy2RCgxfmVDyynDITMSQT7jhSwTQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776006038, "uuid": "a2ba5e10-eb84-4ef9-a961-a9c125cadd48", "value": 2959360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776006038, "uuid": "2dc608df-d1ff-4048-b8ad-88f70025b525", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776006038, "uuid": "2c04fe4d-6123-42b9-b0d5-f16a6dad57a2", "value": "MidwestGrey.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "777e1347-36a1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776020254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020254, "uuid": "da601c56-4d6c-472a-b8fb-4b617223e174", "comment": "Malware payload", "value": "c704bec583d615517ebde47c73201957", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020254, "uuid": "1ec6529a-4145-473d-a62e-27c12b398c6e", "comment": "Malware payload", "value": "82088351e93430b2d0140ecce7bee663989a8230b6891e7a5089830c2d17e812", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020254, "uuid": "6c1c210d-6653-4941-a568-b1d8350b3205", "comment": "Malware payload", "value": "19b6790c31b6b458a4725ddc7122fb047fc8ba28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020254, "uuid": "c9ba38f6-345f-4ba8-b44c-3cc7961f0c30", "comment": "Malware payload", "value": "2165d8d85e6f3c49549d41a6ba7c757b01fcec735793af08f387e4cf1a9396fd5c31eb9505c00ce0648d6cce8e77bacc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776020254, "uuid": "f876c34e-006a-4f71-83f5-96167cd1f7d6", "value": "T1BA167C83F1A791ECC029C074535AB237FA227C4D07256AF757D087212E65BE06F7AB1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776020254, "uuid": "ef44925f-7b2a-4e51-80a1-59a0378d0512", "value": "1d4c4464549640f508be67e3b9f0ce3c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776020254, "uuid": "89aec3ca-de7e-429f-b376-0654e1f10d8d", "value": "49152:d9eG6UPqvkAusBBWAchMJYgrrbJNlxEJSqtGtgJ93pHmIu15vi5FLKYLPd3FBln2:l6RcvgcJxRu15vY/Hn4sC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776020254, "uuid": "09bc1e36-affe-420c-a0fd-e40e6de39961", "value": 4086784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776020254, "uuid": "89142eeb-e332-415b-be11-1d36a44afd7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776020254, "uuid": "e9e09b59-157f-4976-9eb2-653718a4168e", "value": "inkleaf_v1.0.0-dr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d65f1314-360b-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1775955989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775955989, "uuid": "9837ab65-4f65-41bf-8ea2-8d1a155be861", "comment": "Malware payload (Smoke Loader)", "value": "7e15332c806e870b20009be7c536f339", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775955989, "uuid": "56de23f6-0bd7-4bff-b776-7c0697e12c1a", "comment": "Malware payload (Smoke Loader)", "value": "8267d77005e7daeb6da69c4bf60be0a184867a7ad06322187f8fdfc1cfccf17c", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775955989, "uuid": "1118f70a-c9d9-44b6-84f1-e0e799cb2239", "comment": "Malware payload (Smoke Loader)", "value": "ac3545200f1ac6100d927bea6d7ac321ea5cbc25", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775955989, "uuid": "8a0779da-17cf-4dc5-b016-b66d6f0c0459", "comment": "Malware payload (Smoke Loader)", "value": "f3e5b67f118dfe75efbc952ed4e958185239ab4fa0c0a9e0847c3295045b1e18f1d805f40be410386f480b1b8ab05652", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775955989, "uuid": "77092acb-fe13-4c17-b779-559cd5d5c2a5", "value": "T13D752203A7D4246AE5B1A37041F10A931B32787513B643FF6AE9917C5F833E46E32B5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775955989, "uuid": "673950a0-ec36-4f7a-b35b-e46a24412564", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775955989, "uuid": "956c1bb5-8d07-481d-93d2-a504323873b2", "value": "24576:pjRdm3+k61iCwKbLJcOtzN4JFhrNGVfGaEHFLyyFbiEuJIDDbfpZ0l0HAC9B5Yi:pjKZsx54JFhBGVfGaExbJDfU+gC9BC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775955989, "uuid": "8cdeb7f1-944c-4f0f-a1de-acf3c89fe55b", "value": 1699840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775955989, "uuid": "52061a66-e865-4f2e-8de0-6899f4a3dea4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775955989, "uuid": "73858696-4fa1-43af-8f58-bcc57f15d8e7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c60853c-368d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776011619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776011619, "uuid": "198ce82f-284f-496a-b920-c9f4ec1c1c7e", "comment": "Malware payload", "value": "eb2107a82e95c9a608ecd1006bd49c59", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776011619, "uuid": "1145b724-dbfa-40bf-b5ff-2f28a25ad531", "comment": "Malware payload", "value": "8469339f92097554bfcf50ece7511fc9add444b95e2675a8c090cc80aa35d02e", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776011619, "uuid": "2b94181e-6c84-49c6-a7d0-b00fdf17f0c4", "comment": "Malware payload", "value": "d858dc5c97a2cbe905b2cfeeebb5bfdc8e62cf19", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776011619, "uuid": "6602236a-d33f-48ac-9604-325046a8e176", "comment": "Malware payload", "value": "453fd4a1be3d5e9769cb4fa13ec1e40cff3501f35f7cbec9af1d203dc9e01bb161beaa5ed871a1a77a4c5159308a2b9c", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776011619, "uuid": "97ecb144-cf6b-4a39-97c9-cda743b3190f", "value": "T114C58D076C9105F6C4AAA732CCB75292BB75F8090B3223D72EA07A742F767D05E79718", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776011619, "uuid": "758585e1-5029-46ba-9403-2c7241f0245a", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776011619, "uuid": "e9368766-c37b-4697-97d6-7319dad0882b", "value": "49152:GWvx/wpYsyKmRz5ddk5mNAYeGRIfw9AfAwisyR:GW5l93Imr91", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776011619, "uuid": "199df30a-acf9-4a9f-9f79-97786cf62a23", "value": 2700944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776011619, "uuid": "df7a0bf6-7640-4530-8ba5-067cbee20f7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776011619, "uuid": "3b920163-08a2-450d-9fc5-22afa65ee450", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fc311f8-3686-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776008618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776008618, "uuid": "eda41b46-8f3f-40ac-a686-d5008785f627", "comment": "Malware payload", "value": "0953d11c3695ab3df26b795396bd3c82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776008618, "uuid": "bc04c55f-8a4c-460e-a6d2-09d6ac11a27c", "comment": "Malware payload", "value": "84c2f3b13f5251cf87d1a2c95ac7ca111238f61d56358b2c4228c84ef9ed1ae7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776008618, "uuid": "c928b55f-a9aa-4ab9-b52a-72180ef658f4", "comment": "Malware payload", "value": "8f36b6d17594fc2227d62cf5a1c976a67ae42923", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776008618, "uuid": "a0f67e07-7338-4dba-b05a-7ad2f35de68e", "comment": "Malware payload", "value": "1dbba0235cea1048d71abc32a5d13bda962e7a73229992d29374ae8818893c3988f2c4eccad5d2689eef42ef7cce4460", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776008618, "uuid": "a482c61c-302f-4e5a-a616-9a31a2f34999", "value": "T1037423857F5AA0A7F02610BCE9F91026AD26C4446E619CEFCB94687F53A3D5F0E0E126", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776008618, "uuid": "84e21a71-5843-4170-aa14-ffbb274a9169", "value": "9b760feffec4fca9c313889f9a05ee36", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776008618, "uuid": "96491752-8343-491b-a12b-347d08f99ece", "value": "6144:VcfoBX7AVGPkPPdFa1Bv+TkpvvAFCrvK73yglPeGp2lXHOFOxHnWgVA5k:eoBmPRkcCrS739RpnQPKk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776008618, "uuid": "024c4e39-6c95-4d3b-b134-a9ac8db55221", "value": 359424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776008618, "uuid": "15f5f477-bd39-4fe0-882c-0a5e38a29a6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776008618, "uuid": "ab6dbe94-d060-4079-93b6-8196408f1669", "value": "84c2f3b13f5251cf87d1a2c95ac7ca111238f61d56358b2c4228c84ef9ed1ae7.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "381cd173-3680-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776005975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776005975, "uuid": "d5d75885-1db4-4f72-ad83-7d31a7e7a3be", "comment": "Malware payload", "value": "42e150279bbbe6bd586dd0a3f07e88bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776005975, "uuid": "c227445f-1d11-45cf-9b1d-c417816a4724", "comment": "Malware payload", "value": "86b5759ae419ebc332bd106d5fe4710585c1049a399022e680d0a4484b79af8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776005975, "uuid": "6596c81a-5a3a-4c50-9213-2c3ce93a6096", "comment": "Malware payload", "value": "25295da4173d5339ff2fa2ba4a2896326160b75c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776005975, "uuid": "b80b9072-af40-4221-b130-cadc25b88471", "comment": "Malware payload", "value": "ae937fd9ef42f616e69ad4c6a058c3c51d7474b92cf79d593c3045efb2cacdea41928cdd84ee18738a00e91aebdb70d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776005975, "uuid": "a5c2ef8c-35c0-4549-a840-db06a927cdb9", "value": "T1BED57C17FC9118F6C4AEA232897695953B71BC111F6263C72E60B7682F73BE0AD39704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776005975, "uuid": "d065684b-770e-4eae-a0a9-4af54f50eec1", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776005975, "uuid": "2ee75448-1f8c-4dfe-a0c0-5d0ff8e9d35e", "value": "24576:h/JvhltcKRV7q8HFmz4ulvoLl6U/kZSfXsh8jOABxbss6CR3uMcBqliLYQpZI4P3:h/9BXV7qSFmUuhwl6zgv3US", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776005975, "uuid": "7774ba90-0515-405c-b073-0cce21c91fdc", "value": 2962944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776005975, "uuid": "48565c36-049a-4e44-973c-5374e0d118e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776005975, "uuid": "476bf665-c993-48ec-8e6f-6c852d3274df", "value": "kirko.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8613f56c-3661-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775992791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775992791, "uuid": "3e30cfb5-334b-4e08-b6ee-3876241cd48e", "comment": "Malware payload (Mirai)", "value": "ba8c16b5d17819d3802f5e192ca2190a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775992791, "uuid": "d810e068-e845-48db-b5a0-3f749803b337", "comment": "Malware payload (Mirai)", "value": "888d0d596539f54d6efc3f50793fe0abfd2d555211135e8080ff13d444321c55", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775992791, "uuid": "057b35bf-dd30-499a-a4a9-bef192e210c4", "comment": "Malware payload (Mirai)", "value": "b3b49dd130b65303e4ba8f9cf89a5c110536fe28", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775992791, "uuid": "1679c145-6623-481f-b287-87c5747cb0a2", "comment": "Malware payload (Mirai)", "value": "e2692ea77f9c2df477a1123050bc0ec82da892e3e0c198f7078ee1e4f9a5e0cc19221421c71df8de9f61b4ef31f06126", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775992791, "uuid": "1fd95880-723b-4c4c-aebb-84a89f47c93b", "value": "T130C3D70F6E62DF7DF32C82344BB78B36A65923D633A0C585E26CE9415D6024D186FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775992791, "uuid": "c5ef1f32-4ff3-475b-94ee-07ee594e8fe7", "value": "1536:QWOm2LkBOayOaAja9NxUZnHxZgYKH8F3cK73XR7IcQmnL8+Rt:QWMLNUBD7FME3BQmnLJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775992791, "uuid": "dc7a3212-6864-4baa-a466-4d7eef9541fc", "value": 124832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775992791, "uuid": "6d0c17ae-2852-4a09-a15c-7e6e881e4551", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775992791, "uuid": "9153399d-ade3-41a7-ab0e-95f3e250bdd3", "value": "splmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ecc36b5-3682-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776006872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776006872, "uuid": "47915fb7-872b-4f99-b57a-3796d08badac", "comment": "Malware payload", "value": "dc473f643a3c5d30f4e036d2eda7f669", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776006872, "uuid": "0a22d11b-944e-403f-85dd-148cd8acbad5", "comment": "Malware payload", "value": "8b28c0568baa7da10200a012a70ff735ccec557678a40d1b3fb16f5c0a31f6b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776006872, "uuid": "d0773f0e-5247-445e-b2af-b5cd0609c73c", "comment": "Malware payload", "value": "44f39d0a6f1c675a83f929902129a9bd9bd371bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776006872, "uuid": "52527466-2b51-42a4-9280-50520652c3b7", "comment": "Malware payload", "value": "795aa010b10bb8f7a319fef82d4970268936eb97af2b611139644b8df744b0f62008d943e5da2f63c35a2c923ea8cc5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776006872, "uuid": "9ff39884-7520-4e2a-8c90-c29e96f93023", "value": "T1E9E42365F5264FEDC22CE73DE48A0D17F716A611F874274E5BAAB1413E1FB18A0BE600", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776006872, "uuid": "3a84a4f6-848f-414f-a4ad-7a0674158fc6", "value": "9b760feffec4fca9c313889f9a05ee36", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776006872, "uuid": "2bc2b95b-e06a-4d7d-a821-410c6e81f86a", "value": "12288:I83yNxxLAfRP4OmKBi1gBTABqH2oGRxwupyfxxLAfRF4W22BiniBvAjMd2oGRxU:t3sMflmKBi1gFdaxwuKMf122BinixPwS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776006872, "uuid": "5c2ee32c-e996-486c-8503-fc1ede773e80", "value": 702464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776006872, "uuid": "9ed2ee5d-0322-470c-8cab-60f60e6b3572", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776006872, "uuid": "5c714ea5-f65b-4613-8a64-a3c02aae4e73", "value": "8b28c0568baa7da10200a012a70ff735ccec557678a40d1b3fb16f5c0a31f6b7.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc564b9d-36c8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776037174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037174, "uuid": "93a10779-c0b7-4548-b9e8-e99012398bd9", "comment": "Malware payload (Mirai)", "value": "011bcdf1669ea61db86167338dab5bd1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037174, "uuid": "69be0355-4d46-4f04-b69d-9e76948144e0", "comment": "Malware payload (Mirai)", "value": "8b4fd9a632ca5451bf637d638cfbebf10472c0050b6141017c5a40c994c3a45e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037174, "uuid": "14307eaa-bdcb-4b27-93a5-e69fd95b8f3b", "comment": "Malware payload (Mirai)", "value": "e19c3b356526ec78579c655f14c2eba8cc1d823a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037174, "uuid": "c5453c75-bc98-49a1-9b2f-be34d34c2cb3", "comment": "Malware payload (Mirai)", "value": "84fce94917a2fe894a0fd39c0fd4a7e45bef4a12e3a781a92e8d25900d5cf671afc9c1639085dc62087311266f0d9f7d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776037174, "uuid": "14ddf7e6-e824-4940-b2c0-1f66a27be8f5", "value": "T19EC3BF97F68724A1C86206F407C77F9D3E6362819E6BE4E76C1E357B187A0DB1902BC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776037174, "uuid": "64440f89-057c-4eea-8345-e91fcc3c51e8", "value": "1536:O8wnqzG7gzIzTAW6f5/kgVba/eSxqc/wAcj5TyZuAxZJaKgqT/LWu:O8wnq0aOc/xVby9bwAcxyZulKgqTq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776037174, "uuid": "8779d950-e63b-4a64-a796-385311d8f6f6", "value": 124356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776037174, "uuid": "7023fa66-99a1-4730-b06d-12ac0d271727", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776037174, "uuid": "d853c320-c6eb-4c72-a8f8-8bc5e252e048", "value": "Hammz.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddee6aaa-36c8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776037176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037176, "uuid": "9163d052-f927-4222-b64f-2e8623072511", "comment": "Malware payload (Mirai)", "value": "fe4cc9f5014ca91281600effc7afd85e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037176, "uuid": "ecd1d534-4b72-48bf-86e3-c1f2d7a78866", "comment": "Malware payload (Mirai)", "value": "8bbce22cb9cd66ae98907548549ad9ce754443441dc97f727852cfbfb17b3a17", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037176, "uuid": "5445f8cf-6f60-4521-8b4d-35b11be0987c", "comment": "Malware payload (Mirai)", "value": "710d05197e26b27bcfb4d36a4f9370870b72e17a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037176, "uuid": "6c6f1fa3-b7f5-4e44-9fb6-4f8b23e041c3", "comment": "Malware payload (Mirai)", "value": "18a8904bd707ca11d479743b90254898fd6bb732ad055d46d0780a870300a7cd5c50fa0e7357794ec240c6d0fe01fbcd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776037176, "uuid": "3e61c291-2d5a-4745-a46c-bc36cc1b299b", "value": "T116A329CAF401CD7DF81FDAB74463590AB931A3A156931B26735BFAA3AC720E05816F81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776037176, "uuid": "62ecb114-02a4-4275-b8d1-d604ec4b342a", "value": "3072:MNDglBXHcOEvo4rcruwZkOcUmqQtIbMjxh/:gglBshvFShctqLMjxh/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776037176, "uuid": "31e45a56-8800-4bc9-bd80-d592fd79af52", "value": 100236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776037176, "uuid": "4d2a44fc-753a-4851-a6d6-2c619f72d430", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776037176, "uuid": "cc3042c8-b331-450b-8e6c-6ae4bd016dd8", "value": "Hammz.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98b7babf-365c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775990675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775990675, "uuid": "2fa1cdd1-59e2-4141-88a6-52762bb7b63b", "comment": "Malware payload (Mirai)", "value": "4610aa7a4d82c76aaab60128d9f5c38c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775990675, "uuid": "e7aa8fe4-88da-4488-8f00-82fb25379813", "comment": "Malware payload (Mirai)", "value": "8bd883fe570c0cf9a79da086c6f6507209fa06c0331f1335cb45c75ed3061462", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775990675, "uuid": "ebb4a04d-ddde-4737-b437-4e361be6ee2c", "comment": "Malware payload (Mirai)", "value": "8cc6c35fef85e0f351b70efd632c9fefa598681c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775990675, "uuid": "2ce28282-0747-4c3f-96b5-6dfd60a39b5a", "comment": "Malware payload (Mirai)", "value": "fccdb72c745c5546e05f61e923c96f15e8c48a3c093a1d3302e22a252717b9bfe71e3b14bd09887c57184084e06bcb31", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775990675, "uuid": "c797a356-79ff-4d65-80c6-01a1d2225563", "value": "T142530A0337180F07D5932AF0253F0AE083BAFD621AF5B585655FEEA54635EB61082FAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775990675, "uuid": "3faa8750-f9b6-44a3-a994-24e266ad2abd", "value": "1536:4t1JILhthQ+1r4aYGKCjBTIdWtGqEd42+oM:4ufh/FDIdOGfrM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775990675, "uuid": "d8e84258-22de-45f7-bf8b-eecc9ac3a51c", "value": 61968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775990675, "uuid": "838e668d-1576-4363-9783-5193b4d43887", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775990675, "uuid": "35b78047-42e7-42f1-bebf-111b32670f49", "value": "jew.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "481fd4bb-360c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775956180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775956180, "uuid": "f7eb9dde-a9b6-4d2c-837c-076dcc481fd0", "comment": "Malware payload", "value": "1545c05696a91791e44f8544a39a12c9", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775956180, "uuid": "70d29c3b-4310-485f-b174-6b552ec0c26f", "comment": "Malware payload", "value": "8c7dd2c173732d3c528c8a2df0dc9503ad992ebd7d4b681585dbddd87ebe0005", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775956180, "uuid": "80bcb87e-9423-4f19-9d76-2715ecc7dac3", "comment": "Malware payload", "value": "2a55eb04ccb615133ad60da79f74802a1c118ca5", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775956180, "uuid": "ef6f7f57-c78f-442e-8f90-f00445d6b6e7", "comment": "Malware payload", "value": "6de65749e92eacb10e0db43f2195291187ce6c9a4f32ae61f64558ba1e2ef32671ccec5df8bce5f06fc95cb5b1d68808", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775956180, "uuid": "62a96d74-70bc-4d45-a0eb-6cac28bcb368", "value": "T1A7B012090C1185962C788E4842463391F009002C840404036C027564409FCD57026449", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775956180, "uuid": "aed09c1f-3efe-4f56-9389-63e4bf4226eb", "value": "3:mKDDLqOREXjYEXCREz2jizazaXMoOYdLFJRCn:hSOiXfSRECjiOloOeLxCn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775956180, "uuid": "82bce593-c717-4656-aa4b-f9de81da91c4", "value": 98, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775956180, "uuid": "39c87877-674b-4ee0-8cf3-fc0efc410c65", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775956180, "uuid": "698eee58-5f53-4fe5-acb0-ef648ed5b4ba", "value": "test.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7e266f5-3687-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776009169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776009169, "uuid": "c6813e5b-c7cc-4ee5-95e4-ee4a3984d32f", "comment": "Malware payload", "value": "8314b687c722980b08a286a2344cfa75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776009169, "uuid": "49498e8b-a2c9-4d24-899e-318964144bb4", "comment": "Malware payload", "value": "8c812fa14a4c5ac63dd1dce47232b45bea95f93dcc5cac40bb12fa6f1961e1bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776009169, "uuid": "7effb57f-4b3c-4e79-8506-197e7b5b7029", "comment": "Malware payload", "value": "19153749bdb5adc27439a7f628f385c18b36e948", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776009169, "uuid": "0e581c01-8942-41c2-b31b-e46810693c16", "comment": "Malware payload", "value": "842d6dd316f552db7d12b0b11f3b70b85b4405cb58597e07ff356dcd9f474387a65b54954e9ab8d60b7fceff19ae831c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776009169, "uuid": "e30027a3-b679-4246-975f-ed23a082fe70", "value": "T1E574231297229293C7F3073694361BBAF600F217CBEF3756F1D795A102943E66CBA941", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776009169, "uuid": "02b876e9-709e-49d6-a9d5-3514edf6cd95", "value": "9b760feffec4fca9c313889f9a05ee36", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776009169, "uuid": "89bb3b95-cb56-4f0b-843a-96ae6f8ce90b", "value": "6144:R5ZmAsSloVcXOeKuhuGBBklG9aFNjleGb7GvzNgXdQLWbt/R8eToIK1aTXG0t:R51so+eueEFNZv4ZgXdQVUoN1aTXG0t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776009169, "uuid": "a52afd7a-5cd7-4d8e-ac37-5179280ce2d2", "value": 346624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776009169, "uuid": "3949b0bb-553a-425b-a62b-f37cf15a8a58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776009169, "uuid": "96374a92-0d6a-4b81-ace9-eebf01671251", "value": "8c812fa14a4c5ac63dd1dce47232b45bea95f93dcc5cac40bb12fa6f1961e1bc.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68b8e577-3630-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775971696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775971696, "uuid": "a9915d9e-35bc-4788-bee6-ee54b3e0d338", "comment": "Malware payload (Mirai)", "value": "f11d3446171876fbb6c3c86035286097", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775971696, "uuid": "b902fef6-225e-46ba-a317-ac63fbbd5fac", "comment": "Malware payload (Mirai)", "value": "8cc676bfac21aa0a60e62f7818dce2727345cde399eec17d4c1212d91ef5cac8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775971696, "uuid": "46452946-82a4-4ec5-aad1-558305401006", "comment": "Malware payload (Mirai)", "value": "f1ae0e435ff5d90aae7342a70ad07d96bf507d33", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775971696, "uuid": "03408336-1cd3-47b6-abe1-e13c0e66acbc", "comment": "Malware payload (Mirai)", "value": "5439b2e455624da22f6b206d1bf32391c8b310295c0cea6d6d05a192454166675423e356e40393bc2b27a2484e5dbd18", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775971696, "uuid": "f48160bf-f6b9-4ed3-b509-b6096ca5f7ae", "value": "T199B57C47B708B9BEF246773684574A0E34047F12C0815F33A2B5F4AD5E7A1A91F3A6CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775971696, "uuid": "2360bb74-24dd-445b-b754-4ba5a4a9e646", "value": "49152:mcXN2ODaXKVz5/lzaJKH0wtjqvvZbhrBke+R:mcXN2uJRaSYvvbBkBR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775971696, "uuid": "140c6f6c-5962-42dc-aa49-fba9e4b862c7", "value": 2322204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775971696, "uuid": "acb37785-6a52-4bb7-9163-a03005e12317", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775971696, "uuid": "e5b439a4-ed27-44b7-85cb-001b7a45206b", "value": "ciubuc_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb5f4184-3691-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776013523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776013523, "uuid": "11840039-1e31-4fea-974f-217b0afd0bcc", "comment": "Malware payload", "value": "c16f58fe3162c589f617623805b03135", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "s", "colour": "#C623EA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "soft", "colour": "#7A0DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776013523, "uuid": "4447348b-b494-40d9-8aa1-7f6618639445", "comment": "Malware payload", "value": "8ee6713a6d3cdfb547e2e2b1979ce6ddbc9c62968cc00eaa6e445d9b0200bf59", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "s", "colour": "#C623EA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "soft", "colour": "#7A0DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776013523, "uuid": "5367ce9b-ef41-4d9e-ad01-49b12e510050", "comment": "Malware payload", "value": "a2c6a86cf3098a0119eff5135dd3c0447035e5a9", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "s", "colour": "#C623EA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "soft", "colour": "#7A0DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776013523, "uuid": "f7714e65-17be-47f1-ab0e-a37e495b95c1", "comment": "Malware payload", "value": "91491832cd26a43ef718d19a37297977a070091f46d8b38e60a599cb19170dfe71f488c0344fa1660be0d5d7102a100a", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "s", "colour": "#C623EA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "soft", "colour": "#7A0DF1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776013523, "uuid": "c9a4be59-81c9-41cb-bd8f-6eb53df049d1", "value": "T107E533913FD6D431F4B71B7585B067225AB1E7A10B247297C7E006226DF87EA833D2CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776013523, "uuid": "f569e2ca-cb18-4382-a03a-2e7970f5746a", "value": "f6baa5eaa8231d4fe8e922a2e6d240ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776013523, "uuid": "384f6000-3834-4991-b1e2-f764154c7247", "value": "98304:Sc5KVOIWkLGKpMurKA3DI7nooZSFAUL7j8hZdnIPp7/tT1DXdGm:ScQVOIWkLGKpDr3NosFHr8hXnIhQm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776013523, "uuid": "3e457b78-0f93-4d74-a6bf-e7c0614b1093", "value": 3238568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776013523, "uuid": "cd3e874b-14e9-4a3e-a823-0622bc1a4540", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776013523, "uuid": "896d5762-e5f8-4a87-94fa-d3a2e5268f4d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e22b90d-367a-11f1-a769-42010a9c0008", "comment": "Malware payload (Chaos)", "timestamp": 1776003488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776003488, "uuid": "08c105a8-8734-4560-bc2f-60389a5dffb2", "comment": "Malware payload (Chaos)", "value": "f4f15a5a4a22ccc454c9801691b62769", "object_relation": "md5", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776003488, "uuid": "bd77f557-a155-4b05-a981-2e9942cfd6ab", "comment": "Malware payload (Chaos)", "value": "90fa246c2a502a93fa6b9d9a474659c495257228140fbfe1751decc16917d81f", "object_relation": "sha256", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776003488, "uuid": "4c64659a-f81c-4e1c-b7ca-4888b5b233c9", "comment": "Malware payload (Chaos)", "value": "67125d5537256f92cd7dc61a349dd0bfe5f19ea5", "object_relation": "sha1", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776003488, "uuid": "8de01e98-20c9-43a2-bfd4-5c6a5b6a14c6", "comment": "Malware payload (Chaos)", "value": "490151e5aff19ae96bf4d76ecd48f430a31d5a9fc483e851368ff8c7d44b2336badd149d65195128c61a5c96f87e8560", "object_relation": "sha3-384", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776003488, "uuid": "88c3d578-d4e4-4422-99e7-799b9d6f5708", "value": "T1A0844A343DEA6029B2B3AF699FE875DACE5FB6732B03544E105203878713982DD9163D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776003488, "uuid": "08c95c95-94ae-4814-a6fd-74061039488c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776003488, "uuid": "ebdd7fe8-6503-4f5a-bde0-6f27bb050cb4", "value": "6144:JWr9SJpHjesvchUxim8OOlZqmNB4i4vh+Ro/sjagO:XpjeswCimjyZqmN6i4vOo/2agO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776003488, "uuid": "7b3b8f7a-1e2d-4400-afbe-531e80fe727d", "value": 382464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776003488, "uuid": "ccb19a16-09e5-42a2-8df6-e132ed877367", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776003488, "uuid": "b4be32cc-e568-46b3-8b2a-7549cb0db754", "value": "Convolutter.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7d92765-3658-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775989063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775989063, "uuid": "955746dc-74ff-44ef-bac4-6925506c48d3", "comment": "Malware payload", "value": "29d253ebadfe81ddbee636d74ea145ba", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775989063, "uuid": "411f9415-1af8-4dfd-b9f2-512cde77165e", "comment": "Malware payload", "value": "917af50bdb0b0d2f17c4875e72aa8bbf096defab7957ae041966eb192dfa60db", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775989063, "uuid": "b1e42880-9fc8-4d6f-a88c-4c33dc2a6be6", "comment": "Malware payload", "value": "6e457fe1855a5beca43af9f59e814083338e9dec", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775989063, "uuid": "a8f7481f-e641-4220-889e-49faa48465a8", "comment": "Malware payload", "value": "7d8beff7bc0ba2777cad1112cf658dbca05e386ca2e234723e3d9b7e66212ef0168ee11714b37f8b94c36124c4156876", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775989063, "uuid": "0469ed22-3a86-490a-b06c-53529c0c52d4", "value": "T148137D6966857C24AE99883B1C7E2F0CB9A983E1310451EDBFCB3CF58C49B9CD21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775989063, "uuid": "d7337d29-f62b-490b-a038-2bdbd1e7b9d8", "value": "768:bB+39GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:bB+Acy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775989063, "uuid": "c403d860-e40e-4249-812b-d861a92739de", "value": 45511, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775989063, "uuid": "cad1f475-8d2d-4fdf-919b-b073d4750b7c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775989063, "uuid": "eae92b84-b38c-4366-a045-6fe42e58a265", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7fff838-36be-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776032845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776032845, "uuid": "418f64f7-ea7c-4707-8545-40988d373c96", "comment": "Malware payload", "value": "8a352195a7b63099f81277f1f58890e4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776032845, "uuid": "3dc0e548-cdf6-4fb5-b40b-29f7c5a9ce79", "comment": "Malware payload", "value": "92feb9866e92374017a30844e56269abae234d7f66518f95e26200f71a05fef9", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776032845, "uuid": "d08dd7c5-78a2-4b0b-a3fd-6258e8d6b77e", "comment": "Malware payload", "value": "21cabecb1184895bcb241a32ec85f168b97b95f5", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776032845, "uuid": "468ce509-c936-4f24-ad35-2aeea627f8c0", "comment": "Malware payload", "value": "e399552e1d5b311e3779e4d60d06d997cd43c0ff3e74add6fa520ee9ed3b843c2a584e4a47e4995f25153515232682cd", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776032845, "uuid": "59786173-16d4-4741-8b45-135fa963c25b", "value": "T160136D6566853C28AE9998371D7E1F0CBDAA83E2310491DDBFCB3CF18C59A9CD21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776032845, "uuid": "f7250ff7-c5c1-4cc7-b54b-e0c28b1c9b8b", "value": "768:bHXRWNGxVd9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:bBlx4cy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776032845, "uuid": "3ac9f3b6-4fdc-4db1-9762-eae8f1d50df2", "value": 45503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776032845, "uuid": "ef770811-50c9-4898-a621-2a18bd2546ec", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776032845, "uuid": "10d8617b-eaf0-4e16-b6f4-9c2c045a7ecf", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "746740b5-3629-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775968709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775968709, "uuid": "ea6f4d51-9c96-4ba6-8ff3-d4810584b7c7", "comment": "Malware payload (Mirai)", "value": "95d9a9f5004b575ad75f2c8a57f5f3e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775968709, "uuid": "8c8c8e14-4569-42c1-8c22-c25833f29c67", "comment": "Malware payload (Mirai)", "value": "9558f1ee3bdc97792b2425715d1ff85d8eaba21ef49d8ce947a674202a9b5e80", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775968709, "uuid": "1e9a5ad5-ec6a-4c65-8e9f-5260b8f3ae82", "comment": "Malware payload (Mirai)", "value": "3fd9f57cd8461e70c2dfd7eca40bb9286af9c80e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775968709, "uuid": "05d413fa-c6ae-4c18-b06f-fa02779feba3", "comment": "Malware payload (Mirai)", "value": "02a7b07a21eb0c15fc83c055172ca1d435a113d2cf9aa69cd92a93c7e7b817df4f8fcdddc020c4988ee96f495a60a0d5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775968709, "uuid": "a2acce24-2289-4d55-a76d-bcd160876af8", "value": "T1D9B55B41FC51AA56C6E066BAFB7E828C33272BB9C3EE30174D04573477AA95A0E3F541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775968709, "uuid": "0e5af58c-506a-4c80-9792-274ff75b4499", "value": "24576:ERc2vgux8sQy1ml6W+B6OumnGFF1SMD7A89CwY4t+SGpcxSaRdAMFJo+pWvPlev6:ERgyFWy6sdMwE+tpcd++pWvPlen", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775968709, "uuid": "de95b82c-81d3-4f38-8e80-e585aaec0582", "value": 2486940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775968709, "uuid": "538fe503-5fe5-4f95-a468-a11db7c67d5b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775968709, "uuid": "c124a4e7-77b5-4302-b833-6b339d5cc1ee", "value": "ciubuc_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15344226-3641-11f1-a769-42010a9c0008", "comment": "Malware payload (Joker)", "timestamp": 1775978858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775978858, "uuid": "87b32f26-cda1-4486-8c9e-daba2de63334", "comment": "Malware payload (Joker)", "value": "65bde3819e05d21cad1807353ac1e576", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775978858, "uuid": "ae091f01-349b-411b-8fd1-0599f4734e7e", "comment": "Malware payload (Joker)", "value": "95b312923bddff4d97c6de53203b3d1b768731af3f52c0268d4e47d4ce497038", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775978858, "uuid": "5dc908f7-2626-436d-ac2f-d8cfd794476a", "comment": "Malware payload (Joker)", "value": "b415d9c4484a82a5392e1edcd3d58a4db2e45c4b", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775978858, "uuid": "117e31a1-13bb-4562-be8b-3c36f769564b", "comment": "Malware payload (Joker)", "value": "e30c3d2f9d64be0eb26505562d9b3727a4f0629d81aa2467dbf2ec763d6b80e3eb3442e0d0ab427714ec1ab8061b13fe", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775978858, "uuid": "dacf21ac-d4b3-4a7a-9bc3-69fbb9bad435", "value": "T1C447F14AFA0CE827DDFAB0BCCE8E06A3B52679550610C1D73821860DFDA37D49B55BE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775978858, "uuid": "5822cb10-ffd3-4f01-a1db-fa58febf5bbd", "value": "393216:wHAEGdSunoqZqIgvJaaRLpHg/AMArQxCuKrW701QCFn:cA9dSxQkhaaFqIMAcFv4n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775978858, "uuid": "ce4717ae-b9cb-48ee-a859-4720913c5005", "value": 26175952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775978858, "uuid": "263fdef7-d2d0-4326-b54e-d62d88a75787", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775978858, "uuid": "b37e8eda-8211-4aef-b10b-a6fd7f62c1bd", "value": "Fast+SMS+Messages_1.1.4.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebcc34a4-3665-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775994680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775994680, "uuid": "cceb0490-1f5d-4259-a9c7-720206f1f975", "comment": "Malware payload (Mirai)", "value": "167a121ddb4e1eb9589c017c4e9e2c67", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775994680, "uuid": "7a942482-aad9-48f1-967a-dc020da0630f", "comment": "Malware payload (Mirai)", "value": "964912fadde04186fd622930f3c56dfba8a0074e7160a35aada73324b20eac48", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775994680, "uuid": "b1ed1c28-ab9f-4663-8f40-0d6e462e51e7", "comment": "Malware payload (Mirai)", "value": "5795a9bd0a115eaa312f5df9cf746ac1c02d71be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775994680, "uuid": "772d9707-95b6-405a-a92d-7608e7df0f62", "comment": "Malware payload (Mirai)", "value": "80797d03bfd3657997cf55d13978f84098262948db26f2f74a24d8c23fb7ed735685dd196f9714e22726bf86b310bdc2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775994680, "uuid": "786d9012-53ca-4e9b-8f32-80b7db88a31d", "value": "T115C51844EAC780F5FE470E718157F33F8B306B05C420DEAADF94AE16EA3BB165119269", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775994680, "uuid": "b664612c-062b-4264-94aa-1d9367c0aec3", "value": "49152:8Sz2v/Gx2zOU8v0kowC0v230Us2MhVH8lw5JNfKQQtpqkV1P:8Sz2v/G8zOiZ3DMNJNfKQcpqk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775994680, "uuid": "e1abcf26-2c30-49cf-b379-2a2d46c6978a", "value": 2553624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775994680, "uuid": "3373adda-14f0-44e1-b3eb-f3d71b024acf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775994680, "uuid": "500c6ef8-83be-4539-a20d-253074b56d25", "value": "ciubuc_i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6454c091-361f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775964388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775964388, "uuid": "861a626a-d543-4a3f-bba9-2de6e1a4b945", "comment": "Malware payload", "value": "2bf4ea33c2916fa91f2f3f73ed77036c", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775964388, "uuid": "15849406-f44c-479d-9517-5f5bdf2a8e5b", "comment": "Malware payload", "value": "9854587e5e51a2af8a4039c243fe5cef1eedd11961270f88c354f13542a3d2e7", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775964388, "uuid": "911f29c8-e2c0-42ed-b727-b29b4ba99a9a", "comment": "Malware payload", "value": "ef185380ee47ef65599e9df4efde4f6326d68894", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775964388, "uuid": "79bfb60b-3ed7-49f5-b4da-c4dce0a4550e", "comment": "Malware payload", "value": "f6ffa677703f4ebd10d76d842ccf9941cb385ca22ac653cf0135e2c613fcc360bce82afe94260223824ac51f1ac17096", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775964388, "uuid": "e1efaf33-a2a0-4174-ac87-71eb1fd89f71", "value": "T18D2623AA4922F091C460092FB8985D20C343E5B46145BF74545B57B73FF8BEA2FFA60E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775964388, "uuid": "ea4c17b2-2a2f-4f8b-8a22-45f82fab9a26", "value": "9aebf3da4677af9275c461261e5abde3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775964388, "uuid": "68e315f8-4910-4cbd-8f75-96ceefc47573", "value": "98304:u9mc+9vuwU/Wych7aarD6n6LT5FeYiHk4iZN32m5:pc1F74TrD66LTa64aNme", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775964388, "uuid": "4ba5c884-30ae-480a-a1c1-fcf6ec7c6ddd", "value": 4499968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775964388, "uuid": "9f802cab-cc05-4dfe-83c1-95ca39072748", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775964388, "uuid": "d733f93f-1d45-458a-8b06-0b443b0a5ae3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed68ed30-3665-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775994682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775994682, "uuid": "af19bd33-a192-422a-a352-bd01c361a795", "comment": "Malware payload (Mirai)", "value": "fc2bc42543d60c26dae15afc70433cd9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775994682, "uuid": "a43745d1-839a-4e4c-8288-916138441bb0", "comment": "Malware payload (Mirai)", "value": "98c262e5edc45b95367b201bd540f2d3fcc878cd7e58ee58d8b166616a7c92e0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775994682, "uuid": "fd1df9aa-a3cf-41c9-a60e-1ed7447c7832", "comment": "Malware payload (Mirai)", "value": "fd1a91c8005c719558fa69ece6c27011ce3c29b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775994682, "uuid": "636bc9e1-4dbd-4291-954f-d7c429b7425b", "comment": "Malware payload (Mirai)", "value": "bc9e29b6bcef6a0258e60d289ae10b716e47161393decdf70b7dba931b36b595f85c40fc4ccd7e37befeb4c0dfd716fc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775994682, "uuid": "50cd7ed3-2997-4308-a2ea-24903cc4e998", "value": "T192A32B8ABC85C602C5E1A1F6FB1F51CD372643B8E3EA7147CD18AF29674B86B0A37151", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775994682, "uuid": "dd0b9745-445e-44d2-a7b4-20fb440cef99", "value": "1536:JCroZnbaqB8Pz184PXCIPQt/6SkGCvazU8BOVcCgBvLn4b+R:JCro5VGPvvCIPQt/6gVY+cghLn4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775994682, "uuid": "a8dfe9f7-2d3f-47e2-a1ee-7630b0c6ccc7", "value": 103820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775994682, "uuid": "ddd92b84-f379-4b6b-9abb-d063ce1a3544", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775994682, "uuid": "1cd9f722-baad-40ad-99eb-5aa45f78e77c", "value": "splarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d77c65ed-3668-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775995934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775995934, "uuid": "b8547149-367e-4754-97a3-209e53c57889", "comment": "Malware payload", "value": "42f97fe71229199084ebb17729cb297b", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775995934, "uuid": "a76cbd5e-8595-4428-84cd-6fbb35406f81", "comment": "Malware payload", "value": "9afe0440d8fa798d088206802818351522e30d6a2e6050b25e04ebd64c68009d", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775995934, "uuid": "b92396ac-af60-4c4b-949f-b5bcc3492eed", "comment": "Malware payload", "value": "451702153aca9f0a501c76edf6d0cfd4d9ad8ed5", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775995934, "uuid": "1141debe-ed74-4e02-ae57-f08dad80feda", "comment": "Malware payload", "value": "09390c84f540eb0d6b2a44a35530454d6d34f26e1e5614c2fea1d7a02010aa3a4bc2e86d1ec7e15f1156dca5ce7549d8", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775995934, "uuid": "8c15e0a3-e8e2-4287-9ef8-6c591ec752c9", "value": "T1FEA522208FEBDC58D1BC167C87736D06B971FA623EBBAE1AA4471A394F205CC3517606", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775995934, "uuid": "9089c3b8-63ea-4ee7-9145-31d37c8c36a5", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775995934, "uuid": "a788b4d0-c986-49e5-99bd-5c07f0d62871", "value": "49152:PjTro7ZDEzCT3SNld404btz4mB5ocz0nlA3O3qT5pVSWFzwEK:3yCQpocz0WOaPF4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775995934, "uuid": "42a4cac0-1a38-41a5-893c-461328126688", "value": 2183168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775995934, "uuid": "1554e3f3-4b2d-45eb-b00f-793bbba6b9fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775995934, "uuid": "eb2f2cef-86c8-4a52-876e-66722be53204", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f300dc1c-36af-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776026474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776026474, "uuid": "e998f9c6-8ed9-46ae-b4b3-8a13b326a32e", "comment": "Malware payload (Mirai)", "value": "95e33165add940166a413f827eef5230", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776026474, "uuid": "c7d0ffe6-3c13-45dd-a810-b9eed2e8b60a", "comment": "Malware payload (Mirai)", "value": "9c32b8529ab67c9ad44f5ab9ce06010df7e33e303fda008922347b33490b5a0c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776026474, "uuid": "4a0f66a2-1854-4bbc-b060-ee6a69d23c94", "comment": "Malware payload (Mirai)", "value": "e52c6c21591c10766f38391c8008fdbb34a3aa21", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776026474, "uuid": "8f365168-273b-4ed4-b59f-637c8f343d66", "comment": "Malware payload (Mirai)", "value": "643d9ec9f240e661b3d9f326c5f768a8c84829ff9f26859cc17ea2a5f624e065a4075855d63869a9ac7738b5ad832769", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776026474, "uuid": "6be38293-afdd-462e-83c5-735b014a21bb", "value": "T13BC51744EAC780F5FE470E718157F33F8B306B05C520CEAADF94AE16EA3BB165119269", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776026474, "uuid": "8c26b7fa-fd19-4e87-9b6c-93e1c464ce2e", "value": "49152:C/1KwLmeLzZyPQUJt8w7Bv6BgsSge5VX8lJOXB/aPDPpVkVHMm:C/1KwLmSzZxBBne5XB/aPTpVt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776026474, "uuid": "aff23d4d-43ae-4865-927b-6bf80ba01cc5", "value": 2553912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776026474, "uuid": "7a6a9903-6e2f-41a5-a65b-9bc1e13bad83", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776026474, "uuid": "da41e117-1a11-434d-8193-79fc3164730d", "value": "ciubuc_i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba063922-366d-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1775998032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998032, "uuid": "d0e892e3-1194-4540-9d73-190e72ea139c", "comment": "Malware payload (Gafgyt)", "value": "a4436613e19a0102b29748d89936692d", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998032, "uuid": "7640d35b-535d-49b7-ada1-cee9a14ff987", "comment": "Malware payload (Gafgyt)", "value": "9f698390240c204cc9610120802001a2d206731ede7a84d68d118790ab3a3d74", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998032, "uuid": "bb2b4a8b-c77c-410a-b3ce-07a356043ab5", "comment": "Malware payload (Gafgyt)", "value": "f5c213e53b38097f092c1b329859925b2e98bead", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998032, "uuid": "95ed956a-46bd-483d-8e7a-8087d1411bd3", "comment": "Malware payload (Gafgyt)", "value": "76e76c85dbbdf5f98b8503fc67bdaa1a70c54091ce7bd944933ff321c41b17d5b69c7855c5f6fec578d43f8439157e29", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998032, "uuid": "9c5d049a-ed21-4abc-b4a4-6fe19f32be81", "value": "T11DD312109CA32A81F1C4E57AB00DBE35AD875650F2E63347A261EFEE6D582F3720E446", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998032, "uuid": "ac4c7481-70cf-46b7-a9ae-ac92ac3ffd64", "value": "3072:eQbV8uwMAs6gL0WLLOBTVEWqReefdqr3STmm283q68m:bbV8bgtOBTVMR1fU/v86m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775998032, "uuid": "128d171d-d109-4c90-99c6-c17a2559b5a0", "value": 138044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775998032, "uuid": "0f9fd844-1e20-4920-9a43-2d710359e2de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998032, "uuid": "87c333da-5ca0-4460-a13f-835538fa9df2", "value": "redis-runcd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f510c8d4-36bc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776032061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776032061, "uuid": "9b1dfe28-7461-4a10-b2c0-40882abdd6e9", "comment": "Malware payload", "value": "8676b08bed48091b652e2b36e92d6fa8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776032061, "uuid": "52cc9a4d-b4d2-46d0-9190-94a42f979010", "comment": "Malware payload", "value": "9fd74c0e4f2bb5a078162e33a6c8c665f0afbdedd09a9c9f14437696da495f71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776032061, "uuid": "f2f20fec-3cc3-4ac0-8dba-01955b8c78f3", "comment": "Malware payload", "value": "d7fd2ecdf97116b2adc9dc0e68c8e4114c6f2a1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776032061, "uuid": "24a3cb64-e4a0-45ad-9edf-a722418706d9", "comment": "Malware payload", "value": "fce9b6b43750d0d65fd11fd5a8a2ca1d6815f448ede53964a003776a27c4b3f0c1eecd807fdf021e0a0b7b4a946ac92f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776032061, "uuid": "bc6cab1a-28fb-46ef-a77d-30f251c85658", "value": "T1581733C903054639F74969B68938CDC7B170CAAB76F0939FE01C3BAE518C9FA4796E14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776032061, "uuid": "70400de0-53f7-4afb-ac3c-4b507ce3904f", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776032061, "uuid": "1dbdde07-8cdf-411f-b3e7-5e4e98b6ef71", "value": "393216:ct3x+QHsDEHrTkwEp7SO6HDvVGPA7bgq2/t6yVm13u9hy:ct3MQHsQv9Epvo4gy8Fc4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776032061, "uuid": "1cf41986-8139-4633-aca6-009e8beb7304", "value": 19116216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776032061, "uuid": "01ef4060-6131-4aa1-b245-6ddb69a4e84c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776032061, "uuid": "119277c8-c946-4007-9bdb-11b38ada105a", "value": "cloudinstctrl_c5d9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a59dc4b1-3660-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775992414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775992414, "uuid": "772f77fc-147c-404b-8d5d-3db1ab928240", "comment": "Malware payload (Mirai)", "value": "655ee508c4d8530524a536913505c5aa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775992414, "uuid": "a0d09d76-cf71-4baa-b03a-0def8f6b33d7", "comment": "Malware payload (Mirai)", "value": "a001e98ac4e732916a1f80dd8344dae7cd8da91bfa40cfdb580c15f87f109a9e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775992414, "uuid": "2d9030bc-5f69-4746-b2c8-7ddfab4d3c37", "comment": "Malware payload (Mirai)", "value": "8739ba260aaaf819281ca712120c208b60e21eef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775992414, "uuid": "7735a1e0-ea76-4afc-adee-3f3c2d2de024", "comment": "Malware payload (Mirai)", "value": "56a01c75ccc25c388c41c2234189225b53eb96fc020289b0e0bf84fbd92de85bebe4a89cf7ce3bd19db222e53afedfbc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775992414, "uuid": "e13d5fb3-2082-45d6-aadd-3dd2a3569957", "value": "T16453E64178828A17C5E422FBFAAE018D372577F8D1EB3206DC216FA477858AF1C67752", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775992414, "uuid": "ee38c22a-158c-4f0c-9906-a87cc4d11564", "value": "1536:7jxTLcgSTvoqWGpsvK+6V3whlG9Wk5stJ+yd42+oTW:7jNkavygXG9z5QJ+GbW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775992414, "uuid": "560606ca-cb19-44db-869e-491741f61976", "value": 66364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775992414, "uuid": "94f1688f-c211-4464-be13-ca18072dab62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775992414, "uuid": "f50a65ae-b37d-42f2-9224-f5b9867f02dd", "value": "jew.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63be42ee-3607-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1775954079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775954079, "uuid": "97a2a4fb-8f61-4591-a5c2-bc0fc69885e7", "comment": "Malware payload (RustyStealer)", "value": "2bdf53e435d2e057718e56b34c300427", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775954079, "uuid": "0b0c136a-8267-467c-b107-47304984bd7f", "comment": "Malware payload (RustyStealer)", "value": "a0c4716fe403769ce0df491e2a3436139cedad97fe08caaebdddb402785d5ef5", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775954079, "uuid": "2c09555c-d8e8-43e1-a374-bc5a02df9d3c", "comment": "Malware payload (RustyStealer)", "value": "83305cf1a79e1fb683ccd89260a4dc8b81f9339a", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775954079, "uuid": "d8c75cf4-ede0-4567-83c3-c8a3dd3ffffb", "comment": "Malware payload (RustyStealer)", "value": "e8f74b4b1f289088b8ea303b8dc813998e48fa2347c7bb9295f37231b356b9fc943bd843c5ae845a78c927af1a1bf068", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775954079, "uuid": "ab5cee0e-05fa-4398-a2b2-915d3f04ed12", "value": "T1AE0502267B4484AED01AC07883854F62A63278D71B2366FF029145753E9DAF71F3DB1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775954079, "uuid": "57c0d1bd-4f84-4546-a08f-5644283a0100", "value": "da6c4f764019f1c107d953c95fe0dc5f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775954079, "uuid": "b367da1c-b5ce-4cf2-8d1a-7f3fb718b485", "value": "24576:YWTs1pAFPecv0h8uNJJirObthBUgdKR+/+XJ:Y+gAFPecbuNJJiyb2gkD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775954079, "uuid": "17622312-452b-4227-8a35-96e8eb7f7729", "value": 815104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775954079, "uuid": "79e6f253-a34a-415c-90f7-af2117e05ace", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775954079, "uuid": "bc985eb0-6dd2-4c15-bf4a-a469474bdc14", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dc2ff93-365f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775991811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775991811, "uuid": "741e2ca3-275f-4d86-ba95-d50691e19a11", "comment": "Malware payload (Mirai)", "value": "91c44be53c4625034586a413f73ea6e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775991811, "uuid": "ded3dfdd-da73-4a62-b2d2-9acc11baa002", "comment": "Malware payload (Mirai)", "value": "a145336a75c5cb9e02ecc513f2b8efca88a8a21e1ba7f7c258379ebe888c6d8e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775991811, "uuid": "47cf608f-4ba4-4c63-aea7-878671512507", "comment": "Malware payload (Mirai)", "value": "3d3d936a916c806045b5cf97243ea66ad5f4f65e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775991811, "uuid": "bfa0af3e-79d2-4920-8db6-5722f8a1cfc8", "comment": "Malware payload (Mirai)", "value": "fe4993ce53c07ee1ace55652ff67c36e29c658e0d0afb98fc11bff58e882b77156a1da6daa4e4840e6436a7bb9f849e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775991811, "uuid": "c63f812f-91fb-479c-a8ec-b87daa16a383", "value": "T1234319C5EE03DEFAD84625B121B3EF324A71F83B1429EA87E36CB952AD416C1D00725D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775991811, "uuid": "1ca196dc-32f1-4e63-814a-99911a60efe9", "value": "1536:X13kynNjv6czSEZeLmI37KNCgoTrtoQzWxS2RAfah5cQ:FUyntv6cuEZ437KAgoPtoeiSi1D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775991811, "uuid": "44e39e80-fe26-4464-97b2-2a7caaece871", "value": 56784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775991811, "uuid": "748b2d97-99c6-478a-87d8-bbb1d99ed95b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775991811, "uuid": "040758d3-db24-4595-a499-59dd53b9ce1e", "value": "jew.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "631c729f-363d-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1775977270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775977270, "uuid": "f3b9fe38-fde1-4f2c-8b0a-8c82bcf536b4", "comment": "Malware payload (Vidar)", "value": "edb270b2e2589a2b6a2e3ed3bd6220c8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775977270, "uuid": "73f78855-829f-4bb5-bca1-8eb95a35e59d", "comment": "Malware payload (Vidar)", "value": "a165117575496e39d26d381f77ffa3c543073734d8bddd945630746835103ca0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775977270, "uuid": "e76cdc5f-2bbc-4e8f-86cf-90a00f4f6671", "comment": "Malware payload (Vidar)", "value": "36ea2eb94baff7f1460d5e04c3f7918f8e04efc7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775977270, "uuid": "2530b2f3-6cfd-4ba6-b0e7-a0cb5234aa30", "comment": "Malware payload (Vidar)", "value": "2b5a96f72bfc4b9602acf8fd907e3852e71f1cc2b3dac40917a2f2b73a8fcace516a93d6da6b05bdc5bfc8a5a2b41275", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775977270, "uuid": "3b253ed0-c5bc-45a9-b0d1-13bc2d7ab1d3", "value": "T10AE58D03AD9188BAC45AA3359CB712917B75F888073223D32E677A382FF73D05979794", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775977270, "uuid": "d64570f9-8444-4cf9-a52d-adae13cd9782", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775977270, "uuid": "30069b21-7699-43be-b2bc-10609a27feec", "value": "49152:dQZeRAURW1pIck2CWZSSyAJHHVOgum4W5sa:domEUHvWZUA9mW5sa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775977270, "uuid": "07ace8e6-b517-4a44-a5af-0256a84f1380", "value": 3091648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775977270, "uuid": "2a59cc58-cee3-4751-a1ec-809eaf86690d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775977270, "uuid": "a03e4031-94f1-4c04-9376-d75a0d1545cb", "value": "a165117575496e39d26d381f77ffa3c543073734d8bddd945630746835103ca0.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d6639d9-363d-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1775977261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775977261, "uuid": "3a39ffe6-ba67-4b6b-ad31-88f5e99ac6d9", "comment": "Malware payload (Vidar)", "value": "0b83fe97b76bc100188a146e41587a27", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775977261, "uuid": "1e077153-ea96-48f4-8283-d45a277fbcde", "comment": "Malware payload (Vidar)", "value": "a19bf9f86adb20e9c6855863558b5f65f1559cef58e7cc734b3dba184598440e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775977261, "uuid": "29067738-4d52-455f-a416-33ba7b49f17f", "comment": "Malware payload (Vidar)", "value": "eb770816e615d666a208204afa9b3c908a0fb7f1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775977261, "uuid": "d84f8ff6-9bbe-4c4c-891a-cd3a50751af7", "comment": "Malware payload (Vidar)", "value": "2659ad01a42ae2c38e0d96e5fb8d62b8538fbdf47c2a2d3c388f8558e0ceb6c9e68be98ffd96032ce0869b9c5c69aef0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775977261, "uuid": "9b37eed2-668f-4df4-bac4-9a5c2ae7a2de", "value": "T177D57C07AD9188BAC45AA3318CB70291B775F848073A23D72E63AA792FF77D0593D744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775977261, "uuid": "9ae0cb89-f468-435f-a70a-22764b8d983d", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775977261, "uuid": "131c3e9a-c3b2-4310-837c-b880b4cf2481", "value": "24576:mSGTmR3HXkfk+AHS2/V1i5sTnRPrShw3vQaaazTBMmOvFhheleh29mp7n1ZLxcOV:mIR3kfAHSce+TnROkt7OYurjso", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775977261, "uuid": "63357fdc-130e-4d64-aea1-e6e66ba54d51", "value": 2951896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775977261, "uuid": "337124dc-7967-40a4-9630-51c8d4ceb44a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775977261, "uuid": "5e9b2795-fb8a-4295-801e-e6922a75208d", "value": "a19bf9f86adb20e9c6855863558b5f65f1559cef58e7cc734b3dba184598440e.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "668ffdbf-368d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776011636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776011636, "uuid": "809c3f4a-a7a9-4bc0-ac0c-50da28b7d1ab", "comment": "Malware payload", "value": "e833f0291012ffae7aff8c875a94024c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776011636, "uuid": "959c5430-dc71-4418-b513-19539d51d619", "comment": "Malware payload", "value": "a1ac7046e99181fe46edd62c00ca53602e7cd4430365307d0b3a47ddd1e9e670", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776011636, "uuid": "e812c60c-a660-48e5-b5d8-866cc5a647b3", "comment": "Malware payload", "value": "115d4b6cf285d8ca111ed3df59b0e3ccee49746e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776011636, "uuid": "9586eaef-290b-44e8-9ad4-f1b0470ae101", "comment": "Malware payload", "value": "3300538fa7beb00e8839106557e6132d0ae942097dd93f52abe166ed7cf7b3162f69f1eee191f91f4c7aa5f4fe8e6026", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776011636, "uuid": "7fdba93b-d6bb-446e-8213-cd84390897b5", "value": "T1C4D45C51B2F503E8D07AA778CC0B920BCAB2F2815971DF2915E505A50E8FBF673AE345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776011636, "uuid": "84faf616-5a19-42de-adc1-d8843a733a8e", "value": "d386edacb5bc531cae23e0abe0d5b57a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776011636, "uuid": "56177780-00c3-489e-82c2-72c5edf26d44", "value": "12288:svlJLjmlTApf2DtLWIGUcud7nOox7QodFZD8zfFJSVXEF+a:sTLjm9cvIG4ZOo5Qe8RIVXM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776011636, "uuid": "d2fdd319-b162-4170-aa6c-db45df1a0448", "value": 622080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776011636, "uuid": "2ea299f0-dea0-4eb3-9c72-d532f2e2c2f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776011636, "uuid": "91d59590-1450-47fb-bf50-a75527346300", "value": "a1ac7046e99181fe46edd62c00ca53602e7cd4430365307d0b3a47ddd1e9e670.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "929c0b5b-36af-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776026313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776026313, "uuid": "96c85903-7c15-4a6c-a573-33c7c5d07789", "comment": "Malware payload (Mirai)", "value": "423dd4c028663eb4ca65e291f931a19b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776026313, "uuid": "1113e073-0ecc-447c-af4d-ed5c47b69dbc", "comment": "Malware payload (Mirai)", "value": "a1b79ed553f26dd956317c05e703dcb6f039aa70c896221b35d5b0452806bd16", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776026313, "uuid": "85a59d4d-93ad-4014-a5aa-f65ec52af59b", "comment": "Malware payload (Mirai)", "value": "5debcc2ce92d5a95e6eefe73172b105689c95dbe", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776026313, "uuid": "9087ebd3-6109-4817-9f8c-879242fe3364", "comment": "Malware payload (Mirai)", "value": "b1acf2e0eabbf0c21f628346fe5d01aa3b0b9fa7bd955022abda574d45717c580bc9d8da543b692b9d606136eb66e277", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776026313, "uuid": "bd3130a2-d46b-4599-b2d8-0504cc9d97d2", "value": "T1EA81A186A161CC771DF18F0233935B70A4C0CE932CA7DF68D9DD18AE69A4914368F997", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776026313, "uuid": "c28b4983-cc2d-46ec-80a0-51da8f754395", "value": "48:RSC+N9iGyv92z9JY96p9Lq9/2919Wx99A9U9V9T7O9YQbMdMg9e9TTAskU9fNd9L:RF7mMTWVTAski/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776026313, "uuid": "6ad2226a-a561-48ce-af38-baac1a4db5dd", "value": 4017, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776026313, "uuid": "da3341d8-ed31-4c2e-b2cd-88eb53bf5483", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776026313, "uuid": "1470ef44-81fd-4b18-bd74-c6ddacba5368", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b330d1b-3625-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775966869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775966869, "uuid": "0d1c309a-e7fd-4bc2-b003-3e42269f2891", "comment": "Malware payload", "value": "0c6c2e3d0c0720f5798ce8c451c55ad5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775966869, "uuid": "b85a0a1c-3dfd-4bea-ab7a-97688aa7cdf2", "comment": "Malware payload", "value": "a27df06c7167eced1ddaeb8adccaa5f60500f52bc7030389eed2a0903cdf8286", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775966869, "uuid": "11df10fb-acc6-4dc8-9428-a9c66e9b67ab", "comment": "Malware payload", "value": "508fd6110427cc9ee8e1f442ffeebab3a52180ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775966869, "uuid": "b47525e4-34e3-4eac-9d90-a54399681d31", "comment": "Malware payload", "value": "5af9a9dc539423035ab55d0f59bd8428b0a32527dfe2723c31027a076a7d693f0c2b101b7e0c65f91701a65bb04acad3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775966869, "uuid": "8c33f101-6f1a-40fa-8157-d12a5253fdfa", "value": "T136A50B65423FC874EABEA6368E5F399F0D6B495D003AB1F83A534D909D273168BF0D21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775966869, "uuid": "39058485-e163-4f16-9fc4-5ba01d9f32af", "value": "76ef47c106370a232be021dc2e46cdf7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775966869, "uuid": "e023a984-7f79-4a6e-b635-fe0ccbb084be", "value": "24576:via/5y2ZXAdQ0YtjvM2GdXVJKMbcBBp6Rb2qHs96eHNuL:vZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775966869, "uuid": "1e882ed7-957a-41bb-9408-ccf14fff8bd3", "value": 2179584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775966869, "uuid": "0bcf0b6a-befd-4d1e-a70f-992d3fd08b4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775966869, "uuid": "26288ef5-f956-4b9a-902a-b482753f5fb5", "value": "CRYPTBASE.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d334719e-3686-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776008812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776008812, "uuid": "624b5177-56e5-4338-ac5b-4d193b33ce73", "comment": "Malware payload", "value": "553f3b346dc67cb1e6366a5a9deacf54", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776008812, "uuid": "55c47c1b-f8a1-4917-8048-c8f4f7b682de", "comment": "Malware payload", "value": "a2d703265d61b78837e86527aa2e31994a934c72b6c073db0c4d9c0c59a4e401", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776008812, "uuid": "3f942c7c-14a4-454e-a529-51889be2a1f6", "comment": "Malware payload", "value": "54c4f7d2996dfbc75555bb085046d508ab24c7f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776008812, "uuid": "d44a0cd3-f8e8-4a7a-8ce8-5ac7682b7810", "comment": "Malware payload", "value": "92345c056f453458be409afbdc301f60937bd9799023c357cd7fb3280f341f495e38cad4bbcafed8c1689d4f7c2281a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776008812, "uuid": "ecab2ecb-8c7a-4061-9d38-d0e9c37223e6", "value": "T10AE423D220EC7A3DCC6B4435B15BAAE3E26AE61D19633F39758F421D405213E31B6E36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776008812, "uuid": "3934baca-5f3d-4358-b334-c1e1cd92db22", "value": "9b760feffec4fca9c313889f9a05ee36", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776008812, "uuid": "b1f76cbd-f8e2-4193-9f60-c140339da4c9", "value": "12288:V6BneRrT0QphU3B6zJJXUuMQIZ6n8RXF0QpzURB6RZxfKu:opelT0Q/w0HhBIZW8VF0QBScj3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776008812, "uuid": "6df7ee4e-e9d5-4c96-b0de-2dd5463db956", "value": 713728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776008812, "uuid": "4048f63d-7bca-47bd-9033-838789cb07e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776008812, "uuid": "625a2883-0b68-4dbc-afd1-b6ffef53b610", "value": "a2d703265d61b78837e86527aa2e31994a934c72b6c073db0c4d9c0c59a4e401.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71cde4ed-365b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775990180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775990180, "uuid": "112940f5-a679-48ea-8aaf-8489954be279", "comment": "Malware payload (Mirai)", "value": "03cd28bdeffe587b6f77d1f40e3ddb9d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775990180, "uuid": "822ce337-cbff-4834-902d-f98b1c021f5f", "comment": "Malware payload (Mirai)", "value": "a4172970113918ec7065c7528a4df3e419f777bbbe09a9478f020ffa74282acf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775990180, "uuid": "c3bf0545-3c73-44ae-8e9c-71ff5e16090b", "comment": "Malware payload (Mirai)", "value": "2a3fe078c7e71f1e68e307ffc6e3e35c20872abb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775990180, "uuid": "45c63128-436c-4f1c-9fb5-865a37784213", "comment": "Malware payload (Mirai)", "value": "ce1f8f8fead11c7b92733916b332a150fdd55db2efe1783626503c5bfd10195824dd1d498ccfad716f5c83a5cf5b5da5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775990180, "uuid": "8bfb0942-fe17-4feb-af0c-2009d6aa0b12", "value": "T1E5B55B41FC51AA56C6E066BAFB7E828C33272BB9C3EE30174D044B74779A95A0E3F541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775990180, "uuid": "2eae9998-54f2-431d-8b7f-27b7cdf5aadb", "value": "24576:8cC+m+4zTbTl7NCd7o9dIShLbDG2GLEnPBDihI2CbHgp8M+frcRN+Bmp6loupWvW:8cCl4oHIuLdfPByx8LfobupWvPle", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775990180, "uuid": "40c6857f-7706-459b-9ca4-f4a7c79cb620", "value": 2491548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775990180, "uuid": "a81cb24a-489a-404a-93e5-631571e6721c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775990180, "uuid": "6a7ead61-0af3-45fe-9cbb-7b0bf9981f8e", "value": "ciubuc_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ae6ca4e-3679-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776002973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776002973, "uuid": "ec60ac5b-a1d4-4b0b-84e0-b9d1909980f2", "comment": "Malware payload", "value": "9abcc1e14a62e304c0fc76e720dcad01", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776002973, "uuid": "ab4fa441-f94c-436c-9df1-80848f10cec3", "comment": "Malware payload", "value": "a484c5f4766f049c6777970e3a4cf87ec7460472dc174e98268d1a3cd5bb920c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776002973, "uuid": "c9300e48-271b-4798-a867-c3226e7a3bb5", "comment": "Malware payload", "value": "1f1f7d3556371f9bbd4937b1a63fb6f34bb1fca8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776002973, "uuid": "4f046385-ef31-4839-964d-959477d3e0ae", "comment": "Malware payload", "value": "7dcccad849311b2a6e3fd6e082f0b85c17a1ed1bfed2694535d006f19242edc1ad753d16d167c885a497c1913a58aafc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776002973, "uuid": "804db446-ead5-4c4a-8b16-2206ee66c3fe", "value": "T1B98633FAF76FCD7F76A293794B1559D124A21263BBF83E02168553E88D12B5C2C30932", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776002973, "uuid": "e0123e7f-7942-45dc-9e76-c26626408fc9", "value": "196608:EKtpT2esobuLtC263UZf1g68bkBwVXepNAl:7tE+6tr6c1gLbkxNAl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776002973, "uuid": "de6ddafd-4fab-4a3e-9bb7-182f16aea690", "value": 8411223, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776002973, "uuid": "840715fe-a073-4fbd-9b5f-9b25a04a5ea5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776002973, "uuid": "33b2eaab-1a76-4e31-bf42-c76a4dbd5278", "value": "kkkzzz.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06955f7b-3691-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776013193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776013193, "uuid": "c68e5d9f-24cf-4a2b-a7c3-27ab195e7cae", "comment": "Malware payload", "value": "7bc8137c8f8abe3afc9f449c97003b4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776013193, "uuid": "87e09a2a-2fcf-4b7b-9aaa-b5c2726732fb", "comment": "Malware payload", "value": "a57683ae49dd24256dab0dd21ca83c4a08892fda92e83206447380a2b6c80221", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776013193, "uuid": "035be8a7-f237-460a-af1e-727480bc2236", "comment": "Malware payload", "value": "ba452088e4418af1679cdcefdbfd25692c781a77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776013193, "uuid": "a1bb69c7-560d-41f0-9e5e-5f6b4b183137", "comment": "Malware payload", "value": "1b32f637109bb879583ff2f433d7c05c6d52ce2b8b5dfad8bddfc43d8bbbb8b6ef810a810439450690863bf8ddf1b34c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776013193, "uuid": "c62b28bb-5aea-42d3-be5c-b561fa2dd816", "value": "T178D47D5676E443D9D23E6EF9C827470BC2B0F00147F1EE2A15E645891F87A7A722F34A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776013193, "uuid": "8409a717-8f8c-478c-b015-f251d76215a2", "value": "e316e08fcdf7bc1838bc40772f99c8dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776013193, "uuid": "d29b0ea1-2e79-4af8-9684-63c5cf88b441", "value": "12288:3SZT+YO4G3fXlsFqlYW+RRHoR0JzD8/OeLqnSXZL:3Sc7e8ShzHoS8/tI4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776013193, "uuid": "9c7b7ab7-5cdc-4d77-9dbf-0d0b14e7db81", "value": 634368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776013193, "uuid": "cacc5aff-5610-4004-8683-329ce2be1271", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776013193, "uuid": "37f26871-e3a8-4fe3-9281-ecf1d3bd046d", "value": "a57683ae49dd24256dab0dd21ca83c4a08892fda92e83206447380a2b6c80221.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "245dcb0e-3649-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775982319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775982319, "uuid": "993aea64-ca0b-4790-951b-0899273599fe", "comment": "Malware payload", "value": "960bc26ee9d04bfc77dba56975da45b0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775982319, "uuid": "7fba2410-9d2f-4851-a17e-854c030964d3", "comment": "Malware payload", "value": "a609cfe92a32f1dec24416c2e866f6ce69acaf2a64de42bf1f901e68608bc791", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775982319, "uuid": "718717f4-2c8d-4469-88b8-773aaedefe5d", "comment": "Malware payload", "value": "019f7863251db31c26814dbf60fe802b72d17d6c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775982319, "uuid": "d4ee3b51-0bce-43c2-86c3-e9909ebe9e7e", "comment": "Malware payload", "value": "3e154d9b6d22fb1456298688116e614200e0f375c783e996436d0d67d77302cb80a0475c6f0ef83aa0853623a49267b0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775982319, "uuid": "604a8581-0f89-4c8b-b8cc-174854ade9fe", "value": "T149D0973B608682DB29BC28F540982CAF9676280400864A8D3A6803F8A624204782CCE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775982319, "uuid": "ef2e7039-6f2b-4e09-9575-ddefc5f0b34d", "value": "6:iay2AOzckHHy7nh9V0gMQZVyNM39+fLNmeH03n:iQFk9VKQCNMN+41", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775982319, "uuid": "2187c352-2dec-4971-95b8-8a5d90e43418", "value": 241, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775982319, "uuid": "2612b907-c0b0-4695-bc39-5749d2113d04", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775982319, "uuid": "f65066b1-b2f0-442e-8bf3-e0f7e2cf7544", "value": "cve2024_4577_php_dropper.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d3d0c14-365a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775989662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775989662, "uuid": "c8aa3fc4-e15b-4a48-97ec-42b41bcd573b", "comment": "Malware payload (Mirai)", "value": "650fbed4380212398f7b77aeb0e7aeee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775989662, "uuid": "85e89a98-7a9b-4d30-9ba9-b69bb213ffc1", "comment": "Malware payload (Mirai)", "value": "a6c9da2cdb69b12da6df6b0997f48d089935a08410015e601cfa08880f401907", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775989662, "uuid": "415315c5-62cc-4c31-828a-e4eb18b0f31f", "comment": "Malware payload (Mirai)", "value": "70670a5f51679739c7be3c92056fcd861475f438", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775989662, "uuid": "b12f7108-e4ac-43d5-b98b-209fddf997bc", "comment": "Malware payload (Mirai)", "value": "d1d94f11d1c3cdb07b663dcf2b613bd501fa6a185fdf281989c2ec2a6ee9b4bb7f651919895cca5a3dbd0f4828bad8d3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775989662, "uuid": "f75cfe9c-e7a0-42db-b8e9-6a16ded76f58", "value": "T1D8E5E81B5A319F6CF7B487344FF34B34E76A22D617A1D980E1ECD1085E6424E681FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775989662, "uuid": "84abc3ef-c413-49d0-b1ce-74719ef58649", "value": "24576:rPG+N2SAoriyPr1qXOmn5honYVKXupHm5Lz/ga6o/qTsu7n+XI7Xeq/6G5H3UQZW:K+NP+hbk/5Lz/PqTsmsIUcPvPSU8v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775989662, "uuid": "1e066374-aa72-4897-9017-cd57293a8137", "value": 3168500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775989662, "uuid": "d5c23e39-0c67-4a45-b229-e0c57fc182fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775989662, "uuid": "be52191c-9c55-4eb4-9947-c6dc3991391e", "value": "ciubuc_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31132f04-3676-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776001668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776001668, "uuid": "92a56479-4b3a-4b30-adfd-73bcb6ccea68", "comment": "Malware payload", "value": "971555400752b0969f2f3e1bb1c0a946", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776001668, "uuid": "46f419bb-7a8e-438a-83e9-1cde547927e1", "comment": "Malware payload", "value": "a6f8bb0048f11415c1aee2b4d00e8c94d9dd71f4ee3033ad2571482bb44c0209", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776001668, "uuid": "c508e58c-a66d-4bca-8e5b-48408759927a", "comment": "Malware payload", "value": "a1b180560c9f736597403ef4045bcd6051d5d47d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776001668, "uuid": "e382ddc8-8013-4116-aafd-101dc31b33d9", "comment": "Malware payload", "value": "b7bb8d47a219992cd68b3030c47fa47f8854a935ba244a128898dd1f806febc1986e0f69be63a76b3a65933ff64a40b5", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776001668, "uuid": "65b74af2-6d99-40f9-bff9-6ff7576fe2d9", "value": "T184A13294FDFCF532FC7D5635B69890887BFA6B6E85332C047E62539B620C548310A936", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776001668, "uuid": "55573908-38b6-429f-8c68-e7357540944c", "value": "96:Oww1TCTSUq9djaRtdLRWBC6b6CrSJ5YRa/jahJBhsvUTLfhtGWqYrWy:KwSUq9d4ErrSPylHBOhYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776001668, "uuid": "8545fe46-14e9-4c1e-aa24-72831b81a574", "value": 4767, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776001668, "uuid": "47bc49ae-2bb1-4f64-b2e0-0f721fa81ca2", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776001668, "uuid": "7c816597-1a83-4abf-aa08-f0f63a96e72e", "value": "b.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58166dc3-367f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776005599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776005599, "uuid": "357413ff-be78-40a5-b5c9-b2532da876d8", "comment": "Malware payload", "value": "0e600da7f397254ae4e45f38d797a2d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776005599, "uuid": "884dcedc-24e6-49dd-9363-1c798345b139", "comment": "Malware payload", "value": "a73fa97e4e3f9d1f71c1ddfed542a1038178d9f8f85206cc5fcad5c22a180136", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776005599, "uuid": "6ae1127b-db49-41fc-b69c-0ab05e12fd05", "comment": "Malware payload", "value": "5eeeb3088674debfccb1b3fd6e415f29f47cedd5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776005599, "uuid": "d9abf9bf-da9c-4b53-b2b7-b40511f33b63", "comment": "Malware payload", "value": "bf87a78f566e518feb1f9ca5a065a3ad87fc5775f904c2be2b64da551d16b51f1aec94a6a08c4dc1ff5b999f9e8160ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776005599, "uuid": "b9204cd6-33d5-46cb-a4e0-cee474c3e4da", "value": "T1BF543B1FC9128D31EF672234AA04DFA5ADFE78202BB4DCD34FE4B94343529C5963A166", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776005599, "uuid": "9eaf80f0-6653-4e1d-ba16-d1d817e483a3", "value": "734806ff2400fabfc9c8e90d504b7bee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776005599, "uuid": "9afca00f-0de0-4c21-8771-9ec875cd8b1b", "value": "6144:JJAYNg5OMSLcGJ+1ukcipgAojfleeVg053CzDm:wYNgcMscQqcSVofG0ZCzD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776005599, "uuid": "cddd2ba4-edda-4658-8e09-da3dd5bb5d82", "value": 281600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776005599, "uuid": "ef7f5b21-8184-4d1c-bfc1-6aa9fe6eaa57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776005599, "uuid": "e61fa3d0-eb8e-4ce6-b70e-8c97f6c38205", "value": "0e600da7f397254ae4e45f38d797a2d1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9901552-366e-11f1-a769-42010a9c0008", "comment": "Malware payload (Neshta)", "timestamp": 1775998434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998434, "uuid": "7693d629-08ae-45ba-9e3e-ef76c89d0079", "comment": "Malware payload (Neshta)", "value": "87f7662f38cbc01716d7b1a852b60843", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998434, "uuid": "86ff7abe-735f-4966-88fb-8575109823cc", "comment": "Malware payload (Neshta)", "value": "a7bcd1b334c7c0475bf40c45e389caebcfb3b34f3eb59f676e3f63b32c89da1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998434, "uuid": "e049d0e7-4793-4819-bc96-c1f91714b531", "comment": "Malware payload (Neshta)", "value": "ed4f7575e675ad1c67c1c0528482ccc233137074", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998434, "uuid": "b12d9fbd-ddb1-4476-a70f-26e0a823aa93", "comment": "Malware payload (Neshta)", "value": "6e2a7ebeb4c2b9703b41c1147fbc6beed3b88ed8e5c5010d15124f6c68a40d577b80d064758a42431d4984e74794edb8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998434, "uuid": "2850097e-50ed-45fb-9212-c28254eee52b", "value": "T12477332C13258679FD1D0B32AB1044E26277F63CE3EA68532BB506DFE339F1869494E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998434, "uuid": "aa4bbbe5-47d7-43a0-a1c4-cb2e43584456", "value": "a9c887a4f18a3fede2cc29ceea138ed3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998434, "uuid": "b0f89144-3c1f-4cf8-9fea-f7fe6b2a9843", "value": "786432:Pt3rf4rsndSAMsB5u+5CrDYmNw4N6ax+HFS2pa2SkE/ow:xr3isXyDgNg2RE/o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775998434, "uuid": "89f97082-ece4-45ba-b7ec-0c8e383327c3", "value": 33597440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775998434, "uuid": "0e4e1115-5b3d-424e-be0b-9fbe7d02ecac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998434, "uuid": "cffd7286-d188-4994-a2c6-1f71f725ccd0", "value": "RainLoader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0891e7d8-36c2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776034242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776034242, "uuid": "2720b4d5-4c8c-4296-bb1e-87d963e072fd", "comment": "Malware payload", "value": "3ebf6e5773e041718a6116f9c43b8ed1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776034242, "uuid": "b6fd8893-c40d-4dac-b285-148f8c10d8fb", "comment": "Malware payload", "value": "a8b2ba8d93319a60f3f581021d48e0412c7aea3f6ed7124daf5993dfb17ce264", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776034242, "uuid": "f08496e9-4102-44b3-befc-a58e20386b42", "comment": "Malware payload", "value": "740bebe9e866c77a5b11b399cc2ed0ac33f0fa4b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776034242, "uuid": "06729629-b237-4d6e-a1f8-b351be969506", "comment": "Malware payload", "value": "fca5f528d61b52c13eb36c3690d2faacc7cc6935cfc73155d5bfedfccdae9ecabc447948669b0badb8e11f2a6246d285", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776034242, "uuid": "bee84a10-cd29-48b4-beb3-ecd10667ec81", "value": "T1C7C143D4FDFCF9327C6DB334B2C8918ABAEA7B6E853338087562569E146D448310A935", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776034242, "uuid": "18117c52-d5da-4ba2-bd0d-6ca0e4f89c1d", "value": "96:xowMCySUq9djioY0MpY0RAkoBGKRtdLRQ56b6CrWJ5YBDjagJBhsvCPLfhtI6sHr:ySUq9dWoY0MpY0RAkoBGs5rWPmqABOC8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776034242, "uuid": "e001ec41-d057-44e7-98a9-5281465f2b45", "value": 5727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776034242, "uuid": "7d04087b-80c3-48df-9110-ebe3faea7b67", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776034242, "uuid": "dc99406c-fe01-4005-baea-53bd12092fcc", "value": "b.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a631cfa-3645-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1775980558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775980558, "uuid": "56b8e57b-4457-4a3c-8f2e-af2e74195eb1", "comment": "Malware payload (SalatStealer)", "value": "8eb0a777b661c9010f0570804dfc7e39", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775980558, "uuid": "76a4be0c-61ea-4bd8-a4c3-b0d6431ab19c", "comment": "Malware payload (SalatStealer)", "value": "a9bb3b6e628faa9a93bbe5c61038b504dd7467f2faccdba9e405349928e1cb59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775980558, "uuid": "69cf294b-269f-4c5f-967f-4daeef525307", "comment": "Malware payload (SalatStealer)", "value": "376ad002f6df97bed302459f2810fa5e612f7661", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775980558, "uuid": "4cb0279a-ce2c-4cff-9984-446f22d29e6d", "comment": "Malware payload (SalatStealer)", "value": "7f33bd3c82f491d27f7ef509643d6b5c0a071c4163e114478f7c508d7bcbd3f05828abcf76a6f2d3d43f0c0a489aae68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775980558, "uuid": "77eeeff7-2558-474c-9f76-d66aa3bdc88e", "value": "T161863348FEC315F8D6AA583519EF77BE93312E05480ADDBBDBDCAE94FD223111829106", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775980558, "uuid": "963d403b-3ec7-44b2-81d3-634160305d4d", "value": "27d5f1d56bc887b912462112a1a9bc4c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775980558, "uuid": "d6bfcd3c-1423-44ed-be47-f2a821f00bad", "value": "196608:PCOXVlkFhH2NwBABUfEuuLshqXsia8ERDoCWGSGYFNdFN:P/X2vBCTuuLsh5iaxDgGSdDnN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775980558, "uuid": "1a2ab9ee-81f1-464d-a458-7b4e1817ccde", "value": 8500128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775980558, "uuid": "9051b687-a74f-4a8f-b213-5266dc59b2eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775980558, "uuid": "ff356190-5df3-4af2-bc64-566719d95ccb", "value": "winwsdriver.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c790a135-3682-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776007074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776007074, "uuid": "0bd982b4-2ea0-4e5d-a6e8-9ace85a9a7c0", "comment": "Malware payload", "value": "e5914abc71dc8a4e9d2892e7db17dfe6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776007074, "uuid": "52e412e5-cb96-44ec-80df-a73c9b5d2545", "comment": "Malware payload", "value": "aab1f1bdba7083a25d7c841cd2dc3588cc0f3e28e29260bea5c2fd5b033697fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776007074, "uuid": "682ea3d0-9327-4f63-8dae-fcd235ce8555", "comment": "Malware payload", "value": "1a20c6dac05a6c7677d33abfa46002ed7bcdacb5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776007074, "uuid": "0b41d68c-d1af-4afe-8079-9722822fd6f9", "comment": "Malware payload", "value": "11904d1af7402ea805f9219b953fb5a1869a80442228e0ffc3aefd374593ad5076cc726178b9694569cad8dc76fd8e08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776007074, "uuid": "dee8ab3f-9884-4a7e-8f9c-836277a441b8", "value": "T11774233C53211776DAB159790049EC8F59C62F9222CF9EA7E9E00F5EEA3FE95021D063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776007074, "uuid": "00ff463d-4441-424e-96b3-7f75d029e3bc", "value": "9b760feffec4fca9c313889f9a05ee36", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776007074, "uuid": "0da78cf9-f8cf-4816-9920-7a565409bcf1", "value": "6144:JVOsAEDARgvMPqq/suj0IXMOe+u+dxRZDayC6w0aOyg/OI5NAHEMNxgJa2GmxKDs:H+EDAcMiqUu4Ij1LLw07/nwPgJawis", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776007074, "uuid": "a6e1bef0-a85a-41d5-b7f0-a7df0868c9ba", "value": 349184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776007074, "uuid": "529f3f2b-3c5e-483f-a27a-7f5ca878d92c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776007074, "uuid": "aa49e3a1-799b-42fe-a28b-be032b485c54", "value": "aab1f1bdba7083a25d7c841cd2dc3588cc0f3e28e29260bea5c2fd5b033697fb.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54ab44b1-362e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775970804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775970804, "uuid": "ee48a637-13c0-46d7-a293-f58d8759bf10", "comment": "Malware payload", "value": "dcb89aabc62f8d37415a364ad669a1fb", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775970804, "uuid": "d6a834c9-b666-4a15-95fc-720a73fccae1", "comment": "Malware payload", "value": "aaed0c4d31ed2299ac2cb42f637e613004f25835e5a1efe1807a1f771bc8b0fd", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775970804, "uuid": "07233ee7-0e5d-4bb1-9713-7342d7b52097", "comment": "Malware payload", "value": "8cc6c2cbfd3858c086c93092dac09dc1bb337e2f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775970804, "uuid": "b8939632-6f23-4220-9a28-9e80171ade0c", "comment": "Malware payload", "value": "4673a4fc4657f35897ad02efd4b298a0116aab33c2ff295af0437af3316b8f3af675ff059ac374d366bf35985fa976d6", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775970804, "uuid": "67c50c45-8b3a-4b8d-b005-33837ccff07f", "value": "T1CE137D6566813C28AE9998371D7E1F0CBDAA83E2310491DDBFCB3CF18C59A9CD21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775970804, "uuid": "a0cd30d0-7245-472d-94b3-188644b5ffb9", "value": "768:baXRWNGxV49GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:bmlxrcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775970804, "uuid": "297bdec6-af2d-43eb-aaf1-1066c84d13e7", "value": 45515, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775970804, "uuid": "1e7fb409-f444-4e48-8926-b12d7316201d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775970804, "uuid": "9f4fbdd0-1a2d-4730-ac11-c1e0c2d45f50", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd1b3ad4-365d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775991273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775991273, "uuid": "4d5f1ab1-0ec3-4681-9d74-836f8b55ca01", "comment": "Malware payload (Mirai)", "value": "352dd53ef2a3bc7f4b0aae75224b08c7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775991273, "uuid": "58136245-d470-4ba2-806d-0ef293ac2d26", "comment": "Malware payload (Mirai)", "value": "ab02befc1a358b5dea125988bf4a9280cccde9d9826548fda5e1558171debb9e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775991273, "uuid": "0cecdcb5-7ea2-4769-a0d9-5e0220fab909", "comment": "Malware payload (Mirai)", "value": "779145e7c823cbfd1428ab27201c6831b7a68901", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775991273, "uuid": "351d3069-91ab-4f92-bebe-6e6ae3d8eb56", "comment": "Malware payload (Mirai)", "value": "f98a1e4ef39a4910871c96ba507cb3ba690cfdc165c63be7b43fed07cf5d11b1f38164e0948afa4e9f04d71105348db3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775991273, "uuid": "7491e32c-6bb1-4ef3-b65f-e62807bf1ea2", "value": "T172C59D629968BFEFC526D171A538CEF60B53680052260FF63996E3B44943AC2F3067F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775991273, "uuid": "3482ee3d-9018-47e1-9a88-5bc50a21432d", "value": "49152:CuFv82BeAuzN/GVdxRlfi+N/m8Kx+ZAhAlg+0RwIu1jpVpmvPse:CjCd/mZulpmse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775991273, "uuid": "26be867a-2418-4978-8557-afc24d9071b7", "value": 2694952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775991273, "uuid": "2b0e8f39-2ae9-411e-b3e7-8eb9b685d3e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775991273, "uuid": "752c7421-4cde-404c-af70-1020f19bab7e", "value": "ciubuc_sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "702a8730-368f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776012511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776012511, "uuid": "09623adb-83e6-4516-9f46-f2753958b808", "comment": "Malware payload", "value": "0d9b59275e1f6a51ed9dd4b677d23cb3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776012511, "uuid": "5513eaa6-5b34-4d01-80e7-2bdfda984e4b", "comment": "Malware payload", "value": "abd003ab1172cda83731dbe76d20a43c35a452d683d628a4e59eac8aadc68ffa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776012511, "uuid": "4f76bc13-143d-4fa0-9827-c4b608731783", "comment": "Malware payload", "value": "a5859c79b7dd7a33ab09918e70f6a74a50345212", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776012511, "uuid": "7db10ca3-03b2-461c-a8e6-46a27b4f880a", "comment": "Malware payload", "value": "6c642bd7f77a6807be7e0469c8deffa03d9c2b8f784465eaec8f8c5215036917e0b68eaa95adc5d87fe75b4640c7997d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776012511, "uuid": "36e164cf-1a08-40ec-badd-f0e47db144aa", "value": "T173C47C5663D443DDD23E9BB8C826470BC1B0F00107B1EE2B15EE45892F4BAB6766F35A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776012511, "uuid": "acc84dd3-ffef-43e7-a8b6-71e2f313da11", "value": "d386edacb5bc531cae23e0abe0d5b57a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776012511, "uuid": "0b65d9c7-d67f-4fe3-872a-15de5a7da3d7", "value": "12288:aSZjuQfhCPIfH3YJmRBQcUQzWAyByMnD1NyK+Durj63iuLnZQJ4p7:aSA4JRBdUQeyGD1qDLZQy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776012511, "uuid": "4f424533-f2f4-4897-a7a6-00c872d7f992", "value": 595456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776012511, "uuid": "f7863c7c-ca24-44cb-80dd-2d8ba77232a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776012511, "uuid": "19ed5ebe-16cc-4c8e-91ae-aa5059f42586", "value": "abd003ab1172cda83731dbe76d20a43c35a452d683d628a4e59eac8aadc68ffa.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d7adc18-3683-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776007433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776007433, "uuid": "c6586cdc-0b63-40f4-a2af-6429ec2e0793", "comment": "Malware payload", "value": "bae491e185e91acd5a174c83d1488a78", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776007433, "uuid": "9458edb7-cebb-4d9a-8efe-9e875ee496e9", "comment": "Malware payload", "value": "ac97a49e17bf2a315205a30cf39a68c264b1dc4395b88e3997ec506c778159b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776007433, "uuid": "d3960572-226c-4fbf-a4e2-4159ff58c3d3", "comment": "Malware payload", "value": "ee07373d88a65f8760313253e587e282bcbb234b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776007433, "uuid": "4cb4dcc8-9a48-4c06-8165-fde95f0d3906", "comment": "Malware payload", "value": "1fe4676836aaf3371b14de235a4b3122dc026793ec1f4dfb2388e85258f70583de916b56ff92a17ed1d5769ec631d964", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776007433, "uuid": "d40967d7-8fa2-4c85-bb12-128e1cde68db", "value": "T1DB7423A78FFA71D0CAEC117F9D8F521DDF759B205A9D7A9D13CC296C6701168E310A04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776007433, "uuid": "5d96fdd0-03ed-4e04-a0fb-aef60994e1cd", "value": "9b760feffec4fca9c313889f9a05ee36", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776007433, "uuid": "dbe41fc6-538d-4cca-8b29-e4312a60b229", "value": "6144:TXpSHEwpxm3v+VIcRlozsYG3SVyxZe86nglzCDumycG:T5VwGy36sYG3ayje86n2zCDumK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776007433, "uuid": "40706fc4-fa68-4ead-9f4b-04cedd938f2c", "value": 354304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776007433, "uuid": "d1d771d5-daf1-419a-a195-408f4af9cada", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776007433, "uuid": "f50136e3-b01a-4704-b48d-ece7fe6df00b", "value": "ac97a49e17bf2a315205a30cf39a68c264b1dc4395b88e3997ec506c778159b0.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5923d2b9-362e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775970811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775970811, "uuid": "3c213730-6293-4bf3-a056-13d68bc970cb", "comment": "Malware payload (Mirai)", "value": "3743a87705688e779a7d507a4c37742a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775970811, "uuid": "43947ed7-fde9-4c45-af25-0fc67107f422", "comment": "Malware payload (Mirai)", "value": "ad07ff183d72a8fea510ac3e67d59e189e678a3b99926334b36e39a6f7844e2c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775970811, "uuid": "ba1bf052-2e14-4e0a-9d4b-bdab8c1c3949", "comment": "Malware payload (Mirai)", "value": "51dde5701981ff8f6d7b6f9cabf124d4dff35b79", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775970811, "uuid": "3ea66cdf-c49b-4bbc-af7e-5c56a882b00d", "comment": "Malware payload (Mirai)", "value": "2c677b7c3bd095f807c1517e582413a2e8b4c73240a9443070601a1e3392e72ed42713b170001d84506ab8381ab47062", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775970811, "uuid": "af0baad0-50dd-47f3-9a7e-5e66429e21f0", "value": "T183C51744EAC780F5FE470E318167F33F4B346B05C420CEAADF94AE56EA3BB165119269", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775970811, "uuid": "0e95043b-6b74-408f-80d5-9b98041d2e9f", "value": "49152:I2HTP1xMnxX9cwOx6B7zse0tEGRcpdTVS8lJMgPneAlGKpgkVmKw:I2HTP1xMxXJCEPdigPneAl9pg6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775970811, "uuid": "8ec9d61b-dd40-4cf9-bebb-5d0e67f8b5d4", "value": 2553528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775970811, "uuid": "5f4b92f1-5c8e-4840-bb17-119cffd2cbc9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775970811, "uuid": "dd556d64-cfe9-466d-9aa1-a3c535dc81e4", "value": "ciubuc_i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb61cb6d-366d-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1775998034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998034, "uuid": "96b4c39f-0a17-42dd-9d4d-7672d76378da", "comment": "Malware payload (Gafgyt)", "value": "952a3d22dce784f1dd70397ebe28e320", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998034, "uuid": "bb9d5a4a-d2fe-43ed-aae1-1e5307ec1ad0", "comment": "Malware payload (Gafgyt)", "value": "ad36df976a30be5d8f45838ea615e1cc00f8d5f42fa0869dcbee1c4319b83d97", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998034, "uuid": "6623ee22-77ab-4542-94e2-2d97246f750d", "comment": "Malware payload (Gafgyt)", "value": "9ebb936aaca8579179e9c1c888a84da25a61d665", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998034, "uuid": "09f88bf7-8283-4bf2-bbd6-042f9e238ebf", "comment": "Malware payload (Gafgyt)", "value": "3b0ffe14b3171deab9cc07a76f47b431c94df2a863478ec44d5db0140dd5c6c2ffea04348fab642b6e6a36e3410be131", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998034, "uuid": "3c154195-fff0-4e42-8a18-7988e8571858", "value": "T1BCE30A16F5D088BDD0D8DA318BDFC0276670F4896332752F3E855B212D9AF249B6EB12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998034, "uuid": "ff7eeec1-9c18-4df2-a454-101a6be96174", "value": "1536:q9H6cCPtR/GQI4HmjjALtLVpAgX1NU/r1MJwuyHGIn7AH5iIhpCrNwy3q4L6/5Nj:qwk4HmfOABrayHP7Ecwgu5NbT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775998034, "uuid": "46286396-d30c-4c03-b6c8-c66af1f07eda", "value": 154032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775998034, "uuid": "d1b24d79-a36f-45ea-a767-e6d18e7fafe0", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998034, "uuid": "04bb91df-62cc-4a15-a52d-d3e79346daad", "value": "redis-daemon", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "466e5111-36a1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776020172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020172, "uuid": "197a788f-d099-4652-b417-b3ed2ed43b45", "comment": "Malware payload", "value": "0dcd3ca3042d1331a1e8c7760ba69721", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020172, "uuid": "1974062f-c14c-4dc5-9f52-4c76c20da7c5", "comment": "Malware payload", "value": "ad49daecf36c736fc7db65a547e2fd0756c69847778638edb6b1f7bd16a5310e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020172, "uuid": "4ff20c7b-87f7-4be0-9a8b-286c5716f399", "comment": "Malware payload", "value": "809bc2f1efc4b0832b9876de149d288083b51a1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020172, "uuid": "000ec7cc-f916-4a09-b481-e0511dca387c", "comment": "Malware payload", "value": "f08339a8a0a873356407ff16ffd65a167f0c59f6503c3d440d01b22267d0a03ea8897b617a20f92093b76d8dc74597d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776020172, "uuid": "ffc00c9b-4184-4116-a566-e8525b0d27ec", "value": "T103F41269BB59C812DCD6133449B1E3710775ADCDEA01C30A8FFCFEEB7879A552818292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776020172, "uuid": "77f1fe51-2311-478e-a256-21588903c3a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776020172, "uuid": "2add4689-702b-460a-a43e-7c454ce0c51e", "value": "12288:ZYYD3t8+DbFdr9/ONwUGeTM1R1GHUyh0ZOI2AXzlqP6nu3Q0/919SFfnBCXT:ZYYD3t8+v9qwoODdlOI2AXgP6Uh/9197", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776020172, "uuid": "2819ee79-d2fa-4f5f-aef4-1685360dc4f2", "value": 781824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776020172, "uuid": "ddf0ef36-ae56-4a8e-9a42-68dc654d9851", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776020172, "uuid": "e5e338e4-ef51-4394-acaf-a493be364b44", "value": "proforma invoice-24782.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f458ee15-368b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776011015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776011015, "uuid": "7db76b6a-6d26-4f3e-aef2-e07ce640a8a5", "comment": "Malware payload", "value": "3f6c4d56f6fd319c6d2dc33299aaa1de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776011015, "uuid": "ec541d37-b6b5-489f-ac11-e346422e2e93", "comment": "Malware payload", "value": "ae3c56608eaec87e9fe1b31d410243b444b82d68902b1abd4cd41da6d0583619", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776011015, "uuid": "3717d75c-c3b0-4738-8a09-d8c621632274", "comment": "Malware payload", "value": "b9a573b308a6dfb940e87f5f247a501a4d4aef54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776011015, "uuid": "e0417efe-9a2e-4c2d-be08-585effa1bdcf", "comment": "Malware payload", "value": "2c7a2059af116a24ccde6cfc2f93c89585655a0e1a11043562666946498fbe038da1c12facc60e6d95ecc24d57978c27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776011015, "uuid": "5f976a28-5921-4413-92a9-699cceabac76", "value": "T1D93633CA79E0D2A6D15247F70A694E464ABDD48C7B8623BD218BF80C4EB1F34D73C466", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776011015, "uuid": "ffe0f406-b3f6-4a99-9266-b37a294415d2", "value": "636c9d5982666595cd584b52e3756328", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776011015, "uuid": "ee08cec1-a9b0-4eee-89a8-354c6773242d", "value": "98304:OUUu8/cEgjmD3X/2b0FB/Goy64xwQYvLkcXHV2UW0a1y08qBx:/Uu8/cEgjmLNB/GoSxnIkaVaZx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776011015, "uuid": "b41a9d91-a5d4-4a75-97b7-37aa8669340b", "value": 4966912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776011015, "uuid": "1c1a5ebf-d454-4db4-83c3-29459f29fc83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776011015, "uuid": "b324eade-9ea2-42a4-a251-7a4898b40fb7", "value": "SecuriteInfo.com.FileRepMalware.81481492", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09bbe615-3663-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775993441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775993441, "uuid": "ae0b8ed5-9950-486a-a180-55d83b48b1a5", "comment": "Malware payload (Mirai)", "value": "de082d4c20eb814819e49bcb4cd0d846", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775993441, "uuid": "bf350d8b-a139-4be1-8ea0-77f4709a40ba", "comment": "Malware payload (Mirai)", "value": "af3117c86a635d825c826206296722a99e0e4641c9e7f2a6f91dc63c992f0fab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775993441, "uuid": "2445631a-4177-47ad-8204-cbaeedc77deb", "comment": "Malware payload (Mirai)", "value": "a7c97513c139d4ca6ad84e78f7c31bf85aa0fd7a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775993441, "uuid": "82890d73-a9d0-456c-8e91-925510367de0", "comment": "Malware payload (Mirai)", "value": "285c13b74d2155446c31fe00b341b37c34eb8428df9b7136c4badc89c8d98ed159e6ce7a31b8b3ee737a0acdac0b32b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775993441, "uuid": "def0b3ee-6d01-4157-b564-422e02afca2c", "value": "T1CEB57C03E683C4F1DA560BF4125BFB7B893699164121C963DB98F929BD72312E70A33D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775993441, "uuid": "2a6758d7-d5d5-4468-8f1f-c925dd167df6", "value": "24576:ZRiYaDTszqGAXXPG1m2GLoDmvDzA+l4stLRDyBb+ejlZZY1MXspNHRD7MaJ1pX0P:4K3oDoEDzAmKrjljve3X4cMzxppkVo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775993441, "uuid": "346f6e94-a9f4-4da3-b602-45fe2255bc48", "value": 2411416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775993441, "uuid": "dc8d4e23-7193-497e-a949-94af6abd9de4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775993441, "uuid": "f843d651-0291-4718-b9ae-e377008d938b", "value": "ciubuc_i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ca9adea-3682-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776006975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776006975, "uuid": "55d329b1-1e8f-42cd-b78a-bfbfc78d697e", "comment": "Malware payload", "value": "ec184c99b00579b92223ed27a967d3e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776006975, "uuid": "647d0911-0791-4efb-b236-e35aedbd54cf", "comment": "Malware payload", "value": "af7a76820a42c4cadfc7ff5fd372c99e9c5fd96ee9d14e07bde0902fec1881ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776006975, "uuid": "c49a5c00-00af-4f74-af7e-f9b842c137dd", "comment": "Malware payload", "value": "b9df2d8135d839f96d760c86568e72c8becfa1be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776006975, "uuid": "e908815b-a71f-4c05-b42b-efb512d6aef6", "comment": "Malware payload", "value": "ddbbc413bce8ed950ac3d76f677ef86bdfeec0470fb899013f89b0fd5d584052d39214c65bfea69f122beb8052c6c1e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776006975, "uuid": "f3ef59ce-6afe-4e7a-a887-d24f92ff217d", "value": "T1E3E4238BAA7B2D62ED4D82B557402CFAD604FF03E32E5AF4C59DB124F21E7340A85572", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776006975, "uuid": "d01f09eb-e6a2-43cb-b1db-164c703bbefb", "value": "9b760feffec4fca9c313889f9a05ee36", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776006975, "uuid": "5950a3b4-3782-473d-b063-67afceb9d8ce", "value": "12288:S2RQUee9hvfr1yBZU8eDWjpoXr6W5HdQUeYNhvRfbkB5UUeVWRzCnT6W3:S2RQUee9h3zIoXrpJdQUeYNh5nMCnTp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776006975, "uuid": "3d58b2f2-d62f-4350-a4b4-9ce5e643755b", "value": 693248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776006975, "uuid": "c389d494-dc49-413a-8836-27fd1462ecb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776006975, "uuid": "df1f88c4-dd2e-497d-9720-b5a7eb42568a", "value": "af7a76820a42c4cadfc7ff5fd372c99e9c5fd96ee9d14e07bde0902fec1881ab.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c57f5a3-36c7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776036422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776036422, "uuid": "6ca42615-a671-437d-bba7-73f049f5b194", "comment": "Malware payload (Mirai)", "value": "ec3f859888acffe830d74f7c03f1bba6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776036422, "uuid": "2bc75100-1426-4679-b3a6-8bd1cd54f581", "comment": "Malware payload (Mirai)", "value": "b032484b9bd0de776bd6e2a5fe4a5eae1b5a9be2da4981a6067bfbd84cdc8ca7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776036422, "uuid": "0cc1b960-01c4-446d-b70b-9d10b3ffda3b", "comment": "Malware payload (Mirai)", "value": "cd0aabd073c1bc2d06880d76aaa5f961bdafe473", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776036422, "uuid": "0a7b4fde-f5d2-49cf-bd12-b3956dba6752", "comment": "Malware payload (Mirai)", "value": "f12d45cd5ccef558851c7929b9785e0340aeb797ea0cfa91f0ee7d1bfd784c88644137e9fe023b4a9ce617127ee534e4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776036422, "uuid": "5c8b54dc-6823-44b7-ab78-02255afcc0f7", "value": "T1C3F4D063E2319DD6C0394AF824FDE3384B49A2A317877594F7BE81402C6B566FD8D7A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776036422, "uuid": "a7dddbc7-7bab-48d0-9fd4-a0f87be38bc4", "value": "12288:XomjnYsOsP5YpXBF3s/1r4x7Ktw6U0+T6CGMnmHTtaQpbtQLxbcjcaV:j7CsP5WK/GTTiV4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776036422, "uuid": "55d12da7-b277-47a6-b74b-2c990e25a686", "value": 725716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776036422, "uuid": "78e850a2-b33d-48f8-aa0f-1aaafd548ff6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776036422, "uuid": "20dee58b-5c03-40d2-a175-abebbad64257", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dec1a088-36c8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776037178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037178, "uuid": "8538bcd2-a225-46d7-b580-6855fdd16ea8", "comment": "Malware payload", "value": "23e9d58a0a2be72e11d01feeef7981fb", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037178, "uuid": "9655eac5-949e-4874-b3d4-3c8bf0241b50", "comment": "Malware payload", "value": "b16c04e3123160e0e4caab941c64fb1e7991281da38b2ae0365145b3b281009f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037178, "uuid": "7943aba4-4c6d-4b9e-99ae-15486deda6f6", "comment": "Malware payload", "value": "2c015f9cbf9f2c9d8ba6e9c17b4bff5cac03627b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037178, "uuid": "22baffd4-97ff-49d8-8a25-7a215eb4699f", "comment": "Malware payload", "value": "eb09df9830ca52d836d7e6a77a25ef18fdf737a31dcd0164131c3ccb316cde154b4ee5a49b27fade74989cf36aff1dbc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776037178, "uuid": "31a2a5ed-d184-4de4-b0d6-fd2687546dd1", "value": "T1CA5172B910B187B12DD5DA2772A9840C30A864FF74DBDE5D9CE978E448CDE4CE741B82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776037178, "uuid": "4b3a40a9-21a1-4736-bba2-7d5f5068fb35", "value": "24:ItdGusdzRzshgdcL3dViqjd202MZEnsdvxd5O5rJdoLoOXd3FLdXOXNIIksdxVdw:iiZO3OocdMZEsPfmVOzLUJRaUoQ9o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776037178, "uuid": "851500f5-c71f-4144-ae67-cba5ff8d911d", "value": 3044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776037178, "uuid": "9e3b4cd0-b0d1-49d1-954e-3165e8ea3234", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776037178, "uuid": "9a469221-74c2-4a09-865d-cac2d54c7b12", "value": "Hammz.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cafb162-36a1-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1776020156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020156, "uuid": "33453405-ae60-492d-8602-8c2cad11a3ff", "comment": "Malware payload (GuLoader)", "value": "d46598b29f6a30d14e0ae8c63ae42a0a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020156, "uuid": "8d80324d-e8f7-431d-9bd8-0454f72e0ef9", "comment": "Malware payload (GuLoader)", "value": "b2ab40725615e87cdfd4f28453d647c26d21399aa950b76362db65019cdaba84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020156, "uuid": "957c4219-0154-4f30-abc9-6ad1f76b5027", "comment": "Malware payload (GuLoader)", "value": "a3306df4ffb7404e9c553894f2b000ced0d701ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020156, "uuid": "0163b92b-55bc-49ff-9a25-284d7b30978d", "comment": "Malware payload (GuLoader)", "value": "6fbbc24ddcefca0cb05378700cdc252f25ba2c6284e8897c6e38c765d4a35f7bef8596682b0ef59f072cd6b822429761", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776020156, "uuid": "c9de151f-8e98-4293-b0a0-3f3ad953d063", "value": "T1C255BF90F165FCA6E51788B28D7A8170148AAF68CCB8521E3496771A15F339320FFE5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776020156, "uuid": "97d9a57c-d983-4485-9f32-d8718a3c52fa", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776020156, "uuid": "18cf5e36-fbae-4d02-a624-794f8c24ac74", "value": "24576:84MTo7AMKA3e4HYw2ezVvPs/C9FhR/7kpKL+vgh6k/iS6e:RMTokCe4HDJzVHs2FhR/74Kkgh6kH6e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776020156, "uuid": "3b5606c2-258f-4db1-b6c0-586411c59b5d", "value": 1378200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776020156, "uuid": "c5de350b-e80d-4e41-8040-ec435132bca3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776020156, "uuid": "10392301-fbf6-4816-93c5-09f247e3d670", "value": "doc19541020260402084858[1].exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06dcc1d4-36c9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776037245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037245, "uuid": "ea114859-7d6f-4f77-85c5-0e2437611c10", "comment": "Malware payload (Mirai)", "value": "c39cccce6d507236b98f1c9b258aac98", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037245, "uuid": "f799df9b-5a53-47a2-922f-0b67ba3cb488", "comment": "Malware payload (Mirai)", "value": "b3395f32e9bf076631539f747545440efb8090d7c8f1da60ffeace5a103d1c88", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037245, "uuid": "e390c31d-de9f-428b-9c46-5eab23f1ce64", "comment": "Malware payload (Mirai)", "value": "eabdc41e4ea6d8134c8b39bd9add38d65b88ecbb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037245, "uuid": "0e446340-0983-4997-9d3f-52c5f53d4b90", "comment": "Malware payload (Mirai)", "value": "9ca6d691683980389805e5a6bd83e172a6cfc8d9f9d88c0f1581ea2e219666cdb5a54c6d37457ffee9c146c3dc17c016", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776037245, "uuid": "beb0bda3-cca9-4c5f-a023-98efe66e728a", "value": "T1A4C3D719BFA10FF7E8AFCC370AED270128CD595722A93B367570D418B64A28B15E3D64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776037245, "uuid": "dec7d72f-279d-4aaf-bb30-490bffdde347", "value": "1536:yH5DHxbC2JldqnnKi1xo8sdmN9SfsBiLCGnPB5r5AHZqST3qGSAhI4jS3v41B+Ge:yL3ldqnnKi1xo8s5BR5AH4sSeBIwB+T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776037245, "uuid": "3e8fc2ec-4b22-4e6f-a6d9-77c425522b83", "value": 126192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776037245, "uuid": "3e5916f2-63aa-4ea2-b669-0e676d1a3e9e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776037245, "uuid": "8c6c7ac4-5c44-4e1a-b463-c27daf67ccb8", "value": "Hammz.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "882ffd6e-3661-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775992794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775992794, "uuid": "84a27eca-dee4-4d32-867c-fe8b972f16af", "comment": "Malware payload (Mirai)", "value": "3c579b0421fd046e90e785dc0a595881", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775992794, "uuid": "856a0177-651c-4b4f-b586-e59f113758a5", "comment": "Malware payload (Mirai)", "value": "b344344f7fdcb4a83aa25629d887589c889c115855f3212e342ac22980833047", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775992794, "uuid": "428e4d1e-7c94-43ff-a07e-99b34869979f", "comment": "Malware payload (Mirai)", "value": "3bc5a4ebedacd6977915451de71718037fcc138a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775992794, "uuid": "8c937135-f577-47e5-a0ab-9a845a032427", "comment": "Malware payload (Mirai)", "value": "fd1eced1b92a2e50d582922e6a15b9a865c7ea5180d4040fb96350d144e948fd0e4a4eee88372fec584dfe2d8b5f59a7", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775992794, "uuid": "45a38109-3546-4507-aeb7-cd80b8127d0e", "value": "T1AC41325E06997D84C08CD43A3293850DB5B44FC814AB0B97FDE509BE54BCCCE313AE6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775992794, "uuid": "ba9bac2b-875b-4127-a385-98b84d8a3371", "value": "48:mPj7P8H7Pv7Pa7P97PK7P97Pu7Py7Pt7P3GPjGP8HGPvGPaGP9GPKGP9GPuGPyGg:mr7U7H7S7V7S7F7G7a7l7PGrGUGHGSGY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775992794, "uuid": "2fa4d03a-ac27-4660-a6a5-385032462fd8", "value": 2106, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775992794, "uuid": "55914db9-827d-463d-ae84-f79068853bbb", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775992794, "uuid": "7a3a1bf4-e01c-49c7-a509-61b7099eee49", "value": "f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "996d76d8-3686-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776008715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776008715, "uuid": "8e71cb13-a32f-4730-b378-31be0a2b708d", "comment": "Malware payload", "value": "b77666810115f4222d2e248734d896f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776008715, "uuid": "3c9c1ee6-84dc-49a0-b123-0959e2387377", "comment": "Malware payload", "value": "b3f21d0843fa7106b466c590c97b1b8b201a79ae82ed46b46d2422dd252d7836", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776008715, "uuid": "dee0cfe2-b311-4904-b876-07fd97226932", "comment": "Malware payload", "value": "d88926bf29cde0cd3c56aa7ee6e78f188e191213", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776008715, "uuid": "85d837af-d07c-4c48-b78a-b3a7147fb676", "comment": "Malware payload", "value": "1db21bb38d5516720ed99116b7448e9e484ca458db4aead615c1a54491f21bab913379b0d200726450740e8cdf8e4335", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776008715, "uuid": "cf7869a6-30b0-4a3c-be52-b370969275f8", "value": "T1CDE423AE8EA14C83E6EBA47583D35D546DCA725E0D9E46CF11CE1E9033A2D1E15FA0F0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776008715, "uuid": "0ae75126-67ca-4260-b718-0e2946503d22", "value": "9b760feffec4fca9c313889f9a05ee36", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776008715, "uuid": "7fe77c7b-9cd0-4de8-981b-2e961c7a68e2", "value": "12288:sIcrAekf57Cc5zdh1W/nNyNP/oDhIczIkgJX7Ae5/dhVW/VNyN9l4:sIgun1W1yJADhImYDVWbyLu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776008715, "uuid": "a7f33b35-19e6-4ef6-bb23-0d7e00390fc6", "value": 703488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776008715, "uuid": "d0367e5f-4518-4203-aa1d-cbee18b0165b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776008715, "uuid": "8bce11b3-650f-4e9e-9bec-30747917c355", "value": "b3f21d0843fa7106b466c590c97b1b8b201a79ae82ed46b46d2422dd252d7836.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da7d6558-36c8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776037171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037171, "uuid": "62a6fc64-2521-4e22-a676-79e4f8b9916f", "comment": "Malware payload (Mirai)", "value": "a41c1b62e6400dfbc12c171c5d9822b5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037171, "uuid": "7ac85cc7-7003-4ded-ad0e-03b6cd237e71", "comment": "Malware payload (Mirai)", "value": "b47c4748e8e05fa3c5f893c437452c50b4a85afe3ac23a55cfca34eebe2c3de2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037171, "uuid": "086dd272-ddea-41ee-9c52-64ca9360fb12", "comment": "Malware payload (Mirai)", "value": "d9b92cf85c0d3718ca1f35b34e2c4708074377e9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037171, "uuid": "250b4816-7ed0-4beb-ac35-643347f7d343", "comment": "Malware payload (Mirai)", "value": "b08d0c945ae8843c459fe82588d94262d6b44e64383da75f560ae9b1a627ba3d36c1ef1a070db74d51fb6001096a7a7c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776037171, "uuid": "63b2fc9f-070f-462d-8b3e-2ce76293bbd4", "value": "T19213F16213601E67C6362437D1A6298D045F0ABDE0F978A2B351CBA07CEA1D39FFD716", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776037171, "uuid": "7ea85020-0c39-437a-b49a-07ad242f0983", "value": "768:kISktiRgeBq011uUp0Aa4fjnKYvz5aXjQuv9Hia4CiVa6E9q3UELmj:THKgeBqoaUO4uv9CaCVbtLk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776037171, "uuid": "400be30e-a511-4676-987e-e2eb721db64a", "value": 45200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776037171, "uuid": "41b8b78a-355a-4b19-89d3-8bc98d69508e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776037171, "uuid": "15594173-89d9-454d-931a-0ccbe5049ac0", "value": "Hammz.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f0af2d8-368e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776012133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776012133, "uuid": "b6412023-021e-4a6e-a20a-b126b74f3024", "comment": "Malware payload", "value": "248adc657147080193ea31d9bf4910e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776012133, "uuid": "2efbd802-0439-43f9-823e-6174c83a2bb2", "comment": "Malware payload", "value": "b59ac3088a58ebafdcdf00a5597c0de156de667d498bb8eccdaad5c8ba380e99", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776012133, "uuid": "7ef41eeb-9faf-4bc9-9d87-a43e2215782a", "comment": "Malware payload", "value": "b8e229725f7c1f387493f57de5b7e2ad45a2ff26", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776012133, "uuid": "08bbee31-ea28-40e1-a3af-f1a5793cd4ff", "comment": "Malware payload", "value": "931316ea7f275a015a0ad543075250aa2bf814fff64da926909d194ac83e580b80e24ef6eb5b057b0ab3563671da0769", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776012133, "uuid": "d8d28a20-ab7d-4bb2-a6aa-67ed746ff90e", "value": "T1F8D45C51B2F503E8D07A6738CC0B920BCAB2F2815971DF2A15E505A50E8FBF677AE345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776012133, "uuid": "107aa64b-6e10-429e-85b5-c04e0cf21469", "value": "d386edacb5bc531cae23e0abe0d5b57a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776012133, "uuid": "cffc654f-7eae-459c-bad7-019cb99aca43", "value": "12288:svlJLjmlTApf2DtLWIGUcud7nOox7QodFaD8zfFJSVXE1+a:sTLjm9cvIG4ZOo5QR8RIVXQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776012133, "uuid": "1717cb61-f0e4-443a-b22d-0142540e2f59", "value": 622080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776012133, "uuid": "234e5b42-64e3-4168-9874-0d620ee7b296", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776012133, "uuid": "90f2c4f3-d667-41d3-b249-9a21133e2a49", "value": "b59ac3088a58ebafdcdf00a5597c0de156de667d498bb8eccdaad5c8ba380e99.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86d29bf3-3652-11f1-a769-42010a9c0008", "comment": "Malware payload (Ligolo)", "timestamp": 1775986350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775986350, "uuid": "aca336b4-e677-4944-8541-9f0848d254fe", "comment": "Malware payload (Ligolo)", "value": "338b2d1801166e7ad159f15e1ec6a3e1", "object_relation": "md5", "Tag": [ { "name": "Ligolo", "colour": "#349880", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775986350, "uuid": "e08e1838-4b5d-46d0-ad22-7bd84f716812", "comment": "Malware payload (Ligolo)", "value": "b601d17b3a0f8d870965dd825145a2c90d85b8f4ff6a713f2fc0ea28d093660a", "object_relation": "sha256", "Tag": [ { "name": "Ligolo", "colour": "#349880", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775986350, "uuid": "9a0e2df7-bcea-4977-b47b-8b3ae3733744", "comment": "Malware payload (Ligolo)", "value": "db37e327a173db4401ff6c281edd99ec08f44cb9", "object_relation": "sha1", "Tag": [ { "name": "Ligolo", "colour": "#349880", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775986350, "uuid": "f5a6d4be-fdad-4b47-98f2-04b74c7e6a31", "comment": "Malware payload (Ligolo)", "value": "a4313ac6590230d1fac91522879796ffdb707ad2b0bff5554d548317e18cb20c085cd41d8fb13ce84a7cd0ff8e9556d0", "object_relation": "sha3-384", "Tag": [ { "name": "Ligolo", "colour": "#349880", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775986350, "uuid": "a42b53c1-cb6f-4c33-8c45-62d420d20833", "value": "T14EB67C03FC5619E9C1AD963189B396137B717C480B2223E76B90F2387E76BD06EB9750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775986350, "uuid": "7b64b3fd-c288-4323-aab7-fbec25753d17", "value": "ed8b780a3ce7ca4aba78a21f6bc3d4e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775986350, "uuid": "e265d0c2-15c8-4df6-b00d-ae1558f49f50", "value": "98304:aL5HKGpkM3tq5jOjTlwle0vj37ZP2Kywx+WEpwTvhpEJQyc/+MQGRPnaXL4QyRaQ:ap9pky3mlpASTvMJXc/Jv/aXLiweT3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775986350, "uuid": "db4e43d9-5092-43f8-9496-4fc8da2f996c", "value": 10944000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775986350, "uuid": "eebbfd4a-faaa-48ec-b020-f787a1166d35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775986350, "uuid": "1f767b6c-995e-4685-bf32-8efac9756652", "value": "robot.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b15f81d-36c7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776036420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776036420, "uuid": "8094cbda-efa0-428c-afb1-e1c3452e7d63", "comment": "Malware payload (Mirai)", "value": "e6f35b9ff150dbec1e337c304cba141a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776036420, "uuid": "6b71e51a-179b-4f7f-9163-d8a45cfd0d04", "comment": "Malware payload (Mirai)", "value": "b6389a4d5fd56c5079d4a7fd6cec54ac5418ad792ff7b71810afbc90d6f5c4c2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776036420, "uuid": "aea6f89a-4859-4985-9ccc-5e1c4bbde25a", "comment": "Malware payload (Mirai)", "value": "56a011a632c747f1aa4747906e93af6f7df91e84", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776036420, "uuid": "477382e4-8072-42f0-aac2-34b0a1ad7011", "comment": "Malware payload (Mirai)", "value": "37dd5b95de27fa15813c708b4954552f98e2824655dff21f1ce92b77a14db05a61f53dda6ca71e1d0ec50a6db7faf3b5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776036420, "uuid": "59b06201-72ec-46c2-8b1b-961f66564c72", "value": "T1E5354B46FB1D4562C9470EF1293F53D5F7257A4341F8A22A370E9B272622E3ADAC3349", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776036420, "uuid": "76871866-3c1b-4bc1-b048-f5dafee850cc", "value": "24576:+MKFRw29OucZ1MY/NZh47wXXYIBcsXWscgbdsI3LG6czj:+RFRwhucZqa3h4GoI6sXWszCIbGH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776036420, "uuid": "15da4b12-187a-457e-8263-9b48636726ed", "value": 1139876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776036420, "uuid": "f952d1e9-eb12-4f3c-a798-1729d80619b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776036420, "uuid": "f0b6af1b-8eb4-4c39-a3f1-6bf94adcfdd3", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70aec51e-3681-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776006499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776006499, "uuid": "60810b71-6174-46a5-a24d-30e112a24f04", "comment": "Malware payload", "value": "53087cc5091d238cf3df860294666468", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776006499, "uuid": "e5bd7e98-599a-4e29-8c1a-b1cd47659cf8", "comment": "Malware payload", "value": "b7d64d6a9c641855f400949c8c000e1b53b9355fbe3663e41f01e4b80f8eab60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776006499, "uuid": "bc336b18-2e20-4029-bac2-48ed01c5e0bd", "comment": "Malware payload", "value": "ebc0513ff30837e3e3d2caecabbb8d4f84dd4dea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776006499, "uuid": "9ad5664a-e9bb-4fb0-b0bf-da00c28f688d", "comment": "Malware payload", "value": "12231c757cbe212c2ad473dd3fa70887dc07089568a376ca809ff9203ecf20cd0c81693a6c29087d59d436bbdd3439f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776006499, "uuid": "5e4fb37d-8f60-41ca-8e56-1c3e0642564e", "value": "T1FB74230AB5B9A6E1DE35D637C548D87AB1663CBF3748BB7C98D060769424C2C2CEC523", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776006499, "uuid": "29eb73f6-f903-4f5f-a14c-b2a8246ab759", "value": "9b760feffec4fca9c313889f9a05ee36", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776006499, "uuid": "5a349dd8-a4bd-447b-aff9-87b3bef00b83", "value": "6144:v23nQNNFxHkNmplCe5HpJyeypfG4YDUqAtkwqzLnjRr11K4GFE0UaGK+vXfDK:v23ny2NmTTHKpbkXTtrLK4G609GK2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776006499, "uuid": "16537c60-a096-47af-951f-c5b9af698541", "value": 351232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776006499, "uuid": "b126b739-d9d3-428b-ac13-de2f34711326", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776006499, "uuid": "0a27048c-91ea-445c-aa9a-04abdd9109ff", "value": "b7d64d6a9c641855f400949c8c000e1b53b9355fbe3663e41f01e4b80f8eab60.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8124e526-3695-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776015116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776015116, "uuid": "1f612010-24e2-4e68-807d-e44a89fb82a1", "comment": "Malware payload", "value": "c59d9acdd2161f4fb7a7ee70c9891b2a", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776015116, "uuid": "c7099993-1c59-4f7a-85fa-d409ed2bf055", "comment": "Malware payload", "value": "ba4523e699d017cff49e9f725b6a5c279654dd8d91a55e68a4786f5d46ea771e", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776015116, "uuid": "ee627a2f-634c-472b-b64d-6c1cf5556316", "comment": "Malware payload", "value": "28d242a9d474339b300ea970c0afb6138533f6eb", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776015116, "uuid": "639e2451-3998-4ede-8fd1-cd9c57228661", "comment": "Malware payload", "value": "0d0e4ee3308c32a163b2d3e77542aad56c64d63a5d32f11b60c1db0b0a6abfe26dcefd5e7dd2794c094c30440ffdbd37", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776015116, "uuid": "29c26a23-0025-4170-80fd-7ecc8bcb2212", "value": "T1AB75F181A78AA927DDB3C83647F50B6B9655CC194607E31706A4B22C4EFFAC05F85FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776015116, "uuid": "9ddb55cc-de99-43f8-b416-5683ca4149bb", "value": "24576:9fcv3joNDnjOFf7Cig7n21PcgjWFmWObraUTelNg2u4GfeW9O:9fs3j8jOJL821VWUWOf/ilNg2unO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776015116, "uuid": "990c2c52-677b-4e31-81ba-1d0c3063289c", "value": 1571020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776015116, "uuid": "638a6e9b-17f1-49c4-8a2e-e164c1ca3d87", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776015116, "uuid": "d0b188ca-df40-419b-9bba-60599e87d3bc", "value": "null.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c88b8bd-36c9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776037255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037255, "uuid": "ee70de59-07c9-438f-ab1e-9f02b8126f23", "comment": "Malware payload (Mirai)", "value": "6a03efb0e91aae5c6760f8143c22ec62", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037255, "uuid": "ef0b34f9-df61-40b0-988e-87376cbd3979", "comment": "Malware payload (Mirai)", "value": "baac5654d094d197eb106a331f683b5891244f1787688fbe8f457c417a90f000", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037255, "uuid": "0f906b19-6d42-473e-b54e-0a14e71bf35d", "comment": "Malware payload (Mirai)", "value": "1a1c47c6c6e48a1cfee855502a17d88233ae05b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037255, "uuid": "333ce980-8040-4d15-ba4b-31cdb4e3696d", "comment": "Malware payload (Mirai)", "value": "64ca221d1623ce831f91cd82a2607536c7300ac650b0a595944be5057e8721f411aeca03f97bc33ddbd47c1eec843961", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776037255, "uuid": "765241cd-2fc6-494f-a703-fb5fd9e4b183", "value": "T139932B17B58180FEC45AC03447BFB936E832B0EE1379725B23D4AE267D4AEE01B19B55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776037255, "uuid": "19cf61d6-6273-4398-ad14-77fae31f8d42", "value": "1536:d3SjM/6ZHIj6u1mZeRAldKCbCdRUAoU0Y1AeKT+W7+Gc9:MM/QI2+mZeRCdKCGRUAP1AeKTB+Gc9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776037255, "uuid": "8e874322-e883-470e-ae68-3226e285f789", "value": 89264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776037255, "uuid": "643d5471-8472-4ff2-b24f-d0cf83e63e17", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776037255, "uuid": "25d0e43b-246f-4fcd-9691-e0207c7a9893", "value": "Hammz.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cbec226-367b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776003835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776003835, "uuid": "21e0cd93-9d65-4f3b-a87d-232917bc68f0", "comment": "Malware payload", "value": "8ab71e924f669ec9746a5d6281d4c311", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776003835, "uuid": "b9333541-8ba9-4919-b4e6-36bdd2918271", "comment": "Malware payload", "value": "bb38ad858ce73b2e0fa6e01ff540d40b28fa90d31d3fe3053a571110b4d427b1", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776003835, "uuid": "68b8d77c-f57b-4496-bafb-7fe9390226b3", "comment": "Malware payload", "value": "76be4eb08c0714d5b6f4efb6aae54705f2f3442b", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776003835, "uuid": "c38be852-e9d8-4a4c-818c-49d2fed02470", "comment": "Malware payload", "value": "230f2342a02c8dd1d98a8ebcb449b75fa5f7deafba3956fefefd8f564312cfb97552f72801e32978e241a9c9c34807d8", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776003835, "uuid": "2083d175-5c1c-4496-bf8c-3a124896cd54", "value": "T139F3DDCA8D9E88EC870F6029055F9C57CB4FA117069ED591BBEEBD853F22D2470E98D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776003835, "uuid": "4fa43bcc-660d-4688-8bed-79212a41d4f4", "value": "768:CL+Xvdgk2FyhW6if3D7ShcMNJAUEjtQ+5kwCO//wZIZRYA8AXitfeRjNEozQZTBY:CLWdg/f3XuHAjfVU7g6VSi23l47FCcYl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776003835, "uuid": "65ef6853-8382-4f13-bdf8-3cbe6092c735", "value": 170936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776003835, "uuid": "ba949a30-b12b-4348-8f93-879268c8da76", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776003835, "uuid": "80eadcc4-6095-4f16-8791-276144e7bc06", "value": "Marketing_Images_Updated_1549.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9553a565-3692-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1776013862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776013862, "uuid": "29287f3e-ef40-4e96-a093-cfbb5f5af6c0", "comment": "Malware payload (SalatStealer)", "value": "7ae9126af95fae5ebe396a1186471d9e", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776013862, "uuid": "9dac3aa3-3b8c-4fef-8c49-dcb044567acd", "comment": "Malware payload (SalatStealer)", "value": "bc0caae0ac07a4d7cc1804e950cbd2e991782a098e06ad564dbddd9c3e6b6526", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776013862, "uuid": "5eed67af-a6fa-49c4-b58c-4d6105aa745d", "comment": "Malware payload (SalatStealer)", "value": "fda9c4894737c1ade167144bfe4a4df459385bb8", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776013862, "uuid": "41e23e0c-d400-4f8b-9c69-f8668b415f60", "comment": "Malware payload (SalatStealer)", "value": "581d91efab78c2dc137791d2aa5590752bc9cfa64dc06c68d985bed4d6c8b359682cccaa6dd0abbbcf5beecebb298bf3", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776013862, "uuid": "2a03d417-786b-45e0-8b5e-fd3867dd1222", "value": "T1BA863345FB8335B4C96B06F814EFB37AD3322F064419ECA7DB99A9A4FE3B7414811606", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776013862, "uuid": "31afeabe-6919-453b-95cb-d5a2b5200852", "value": "a672cc96769ac6e4c82cc5feb80a0242", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776013862, "uuid": "840df29a-d236-4a26-a168-1498e0d6bb6e", "value": "196608:xqclPnVJEYKQiy/y5obeqIqAeRXH+gVn3:5e7LG9XD13", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776013862, "uuid": "3a5cb74c-af1e-4d26-b23d-0120eb207c4a", "value": 8462848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776013862, "uuid": "ac1fe235-324a-4266-b307-9e25863529ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776013862, "uuid": "2910615a-c826-4292-a41f-9aa36cfcd1ab", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6faeb5ae-365b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775990176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775990176, "uuid": "5aaae77f-7fee-410b-938a-a56347e12978", "comment": "Malware payload (Mirai)", "value": "b053c944b3a95b28e8396d661a5b52c4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775990176, "uuid": "99f2177f-95f1-45ff-b28f-f3cde82f51f0", "comment": "Malware payload (Mirai)", "value": "bc82e931cb21b4c06c99794008fa99d754899cb972fff0184a4db4883afbff65", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775990176, "uuid": "9d6886e1-ba7b-424a-9059-3df1b203587f", "comment": "Malware payload (Mirai)", "value": "bb50d4a200481a154ae08898b34358c4a2cc6c14", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775990176, "uuid": "c0240c7c-3342-40bb-9d5d-0ae4907381fa", "comment": "Malware payload (Mirai)", "value": "4af3622aa09fa280392c88b4efa569d21fc6a263879d0ddfe24b8de2dcaadee2d460cb4eb800511c9a90af3355c6c829", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775990176, "uuid": "e5cf1b86-7bb7-403b-a11b-fbd46fb1e251", "value": "T11C43D552B8819A6BC1E422FBEA6E518D3371B3FCD1DA3217CC111B64778951F0EA7B81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775990176, "uuid": "761947a5-84b3-4371-a455-6cf024714b8b", "value": "1536:+wTfZXVCsxW3o5wPt5dMMQFrATuclG9WEVJo6d42+BX:NfZUHj+MQFCugG9PV98X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775990176, "uuid": "9194bbc8-7206-4e86-bc7f-efa942a65170", "value": 56084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775990176, "uuid": "a76f7962-b8a1-4b6b-9ed4-6b209766f0e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775990176, "uuid": "e72d4ae7-07ab-40f2-b01a-ce7e29c77531", "value": "jew.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33d29a76-368f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776012410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776012410, "uuid": "8484a815-72d4-42f3-a77b-3a1788a1bd0d", "comment": "Malware payload (Mirai)", "value": "5b839db0d7500b0e2681d80ddfd195ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776012410, "uuid": "156bedbd-887f-4716-bbd8-5253a4d47fc3", "comment": "Malware payload (Mirai)", "value": "beb6ca5fae7df364f21c74ee2f1169e0b12748fa7c7b5056e136680bd9c422a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776012410, "uuid": "d6a46900-8c63-4868-99d7-c7386e84fe8b", "comment": "Malware payload (Mirai)", "value": "532bb080474177635ae2c0eb3dee4f05db7b9145", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776012410, "uuid": "487d3718-c072-4f90-9e69-0c8cd1d5f1ba", "comment": "Malware payload (Mirai)", "value": "88c5df2e78256f3a6428e868d189304b62ce8e8f3ae56c5bbc3eaf25ab10b5a1ef1e21d5cc81355e6e8e8556e5498e83", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776012410, "uuid": "2d831983-7faa-4461-bc33-7869e317ed70", "value": "T12A432A96FC9245AAC7D117B5771A978A336263A9C2DF7313CC080B503AC964F4E67F42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776012410, "uuid": "26541cb6-0e16-43cf-8326-57356260ba24", "value": "768:D+uoWIpsMjTXqsYsFew8dV8ff7QyZMoPr9BC9lH4jMNx2FT0nQz2TW:DodpsMj+XVnT87QSdPr9BC9lo4y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776012410, "uuid": "437fcb7c-c2cf-408c-bfba-aaecf136a0e6", "value": 55304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776012410, "uuid": "5686cd0e-c15a-498e-9424-39e60670a777", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776012410, "uuid": "b9495710-42b0-4b26-89d1-49800a70ccf7", "value": "titanjr.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a522daf1-366f-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1775998856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998856, "uuid": "73a39ebf-a12f-4989-b036-5cb12ef84c46", "comment": "Malware payload (Gafgyt)", "value": "9b8ef054448f4e45f5daec1c9a52c995", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998856, "uuid": "db398114-5fe9-4443-98ff-2f248c85de4b", "comment": "Malware payload (Gafgyt)", "value": "c0891f0e4b324bcfbea13a9f2ede84cd20e5806fd4f04eda2d074bc5f4ec78fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998856, "uuid": "9a5d59bc-1039-482b-bb42-579ea148ce83", "comment": "Malware payload (Gafgyt)", "value": "6498533adf8c473db79e218ee784f14099c16b68", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998856, "uuid": "fb41c717-ea57-46ba-94e4-e5de68fb1d7c", "comment": "Malware payload (Gafgyt)", "value": "cc7283bf8f9c17072654fa8f813afafe38e002c2d8ce4bdd0f52ed84e11f759a918b6fac9d23b2b2e3f4fa929717bb69", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998856, "uuid": "591cffea-f17f-4bf1-926e-ddbc29764558", "value": "T172D312F0D8D3D443E4EAC6B7CE5A43E9DA1E4623E5A47202517269749ECFF0D3A02AD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998856, "uuid": "d2bb7baa-d018-472e-9da6-6b52f55995e2", "value": "3072:Nq6SxcqGyEEGdslRvayfjlXrJrSZWGiRSfnMOysXwjXn66eGf1y:NOxcuE7slRiyJXrJmuRSfn5yZjXnCGfw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775998856, "uuid": "6add83a0-da4e-4074-a8e3-322caa995dc0", "value": 136352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775998856, "uuid": "b454fe30-5cc7-49f9-9f9c-9ee0d72374b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998856, "uuid": "ceebb9d3-267f-42aa-81e7-dd9f59fcbffb", "value": "redis-buildxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5aa1124-363d-11f1-a769-42010a9c0008", "comment": "Malware payload (Joker)", "timestamp": 1775977463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775977463, "uuid": "fe68ee1c-772c-410b-bc6d-797f6bab492c", "comment": "Malware payload (Joker)", "value": "7d0ce0be5db1d726cc3afa961e190795", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775977463, "uuid": "a78ec4e3-3501-49a4-8e36-3ea2211eea04", "comment": "Malware payload (Joker)", "value": "c141bd8108279738c0330fd6b805bc9018d08f52870f6dd03af7455fdab9bdea", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775977463, "uuid": "b4e2ce8d-3a81-40d6-beb9-eec7a1e2b180", "comment": "Malware payload (Joker)", "value": "f6774e07f4a25663a53b2defdc80ac1591cb5b06", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775977463, "uuid": "e0a3d10a-72e3-4ac5-a909-727c050adb42", "comment": "Malware payload (Joker)", "value": "1505d9f4d1e3239e5e6a4a5e8e3fa6c9f9d847cd01bfa92137e3280d3fe1aad3be319f9dc274b40272d9d8a947680b47", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775977463, "uuid": "3f928597-4f73-4d4b-8227-a9caefb9345a", "value": "T1C047220BB31CEC1FD8B3B4798D8A1231A8566C25E7009BE36915B66C7EB39E45F093D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775977463, "uuid": "fd492e38-6ae9-479b-b7ed-a6c659acb41e", "value": "393216:WHoQq+VTooJYH6majz2iuuk4OHNv06XCubGLhUud:mof+looJ5maDCH86X6Oud", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775977463, "uuid": "b44edd68-87d8-4086-96c8-3b459335868f", "value": 26671014, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775977463, "uuid": "49c5a16e-ef5e-4c7b-9fda-67d9d574ed2c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775977463, "uuid": "728b74a0-f533-4dcd-b100-481b6b07df5b", "value": "com.largefile.pro.cleaner_1.7.1.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad899893-3679-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1776003165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776003165, "uuid": "8a35a44e-e073-4d40-ad7c-a9fb2fdb1a30", "comment": "Malware payload (StrelaStealer)", "value": "5cfe4b19d67bc716b9bbbaa6d7ab417d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776003165, "uuid": "cc0a7cbb-5514-4d8e-a602-183bb2d01863", "comment": "Malware payload (StrelaStealer)", "value": "c33e9e737990c92cf89ea2aa4744ddeeae3651d062913b11d987704c9ced83ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776003165, "uuid": "83fcc5c9-98ac-4df8-9dd4-835527ed1719", "comment": "Malware payload (StrelaStealer)", "value": "e1b7bb59ba8a1b746440a69912f8119edc5c5479", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776003165, "uuid": "7e319d09-b546-4971-a4e8-ea977b2e3f12", "comment": "Malware payload (StrelaStealer)", "value": "56f3f29352e7c016c2087d1bd90cdbddff267dc777c88200ff4c0abf2a0b171d6240fe08f485c7bf9a66ab7e5b6d3f08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776003165, "uuid": "8537c48f-a8ed-43da-a308-013eef9139be", "value": "T19BC6339727A3448AE0974335A2238557EB14B94B4BDC73DF4298CF1B4EA37E0AC74A74", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776003165, "uuid": "b8b13581-b00c-437b-8ff7-eaba1d18207c", "value": "7c7c70e220ab53ef06636dcf83e0835b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776003165, "uuid": "b6a67751-b55d-4a48-88d7-17702d1b1db0", "value": "196608:OjkjviEtUvQw9BDJuyx6sK3ji5Stzvdf3c0c5r5jERuIbxsbFSdPMG:OjkjPah9hJ6sK3jXtLdEVMuIbxSm7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776003165, "uuid": "4b717764-45c0-4bb7-9a3e-ef33a19de16c", "value": 11607552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776003165, "uuid": "04698109-39f0-4e58-8183-4e007f8d40d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776003165, "uuid": "c0159128-fa02-4012-89e9-ea89739df178", "value": "setup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9c9ad74-36c7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776036713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776036713, "uuid": "28df74a2-babb-49dc-ac00-b5fc28000478", "comment": "Malware payload", "value": "9cc1b4d0be8ba6595d067fec212a8d59", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776036713, "uuid": "af04db67-0747-4edc-9e45-d31867664288", "comment": "Malware payload", "value": "c39c110a99a370d96dc726eed2f9a98a3b57c68874f7ed098ca5631b5f9c8a0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776036713, "uuid": "a07d1606-8ff9-413c-a8ab-26b3c80fd348", "comment": "Malware payload", "value": "0d9f7d0c7759d5121016adfc71808015381778f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776036713, "uuid": "6e45af29-9272-4d93-861f-0c8cbfbd89e0", "comment": "Malware payload", "value": "8e08776f6288ae950d668b76cb141aab3115a1e35ca0285bf9841652d0d519107f4f3d69c623ef0f6326745c1768f5ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776036713, "uuid": "a5786e66-b148-4a40-a5fa-80d45a4c7fea", "value": "T187F4F185B7409B77C22543354FD787A16339EC20AB929B2B7292F35E2FB23515A473C8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776036713, "uuid": "2785faa6-c9fa-4bdd-85af-67532922cec8", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776036713, "uuid": "ff5f38b6-19b3-4187-8a9d-37aaee465679", "value": "12288:aXyWmdPEZJ7SyplVh6GIpCgEgpoNqTIqBPHg7Ibwix8:aXrmdPud3VhDIsgToNCnRHUix8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776036713, "uuid": "ac61d9bc-96d2-4057-9e8c-c4a5aa0a08e7", "value": 765248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776036713, "uuid": "0c147b13-2951-4fda-9549-320e29e8e9e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776036713, "uuid": "7afe13ea-3ec8-4db6-9532-d45908c7e3b6", "value": "scan.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5f5e931-3688-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776009595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776009595, "uuid": "b87a0f9b-8981-4d35-9bb8-cbad089fd5e2", "comment": "Malware payload", "value": "6548893fd422f8e2de119315021d1452", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776009595, "uuid": "355c2332-717b-4724-8f91-1e5b226d31e9", "comment": "Malware payload", "value": "c4a5223bcf57b32e036c33c4d0e41aa44ff3eb4632c2fb4ed9c9bd593a04c3ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776009595, "uuid": "dc14caf2-2fac-494c-9dc9-d0a1c46b5f87", "comment": "Malware payload", "value": "46aa3f8005b237942e51837bb523854e632753a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776009595, "uuid": "e0404a90-c8e6-4289-b324-6398f6d896b1", "comment": "Malware payload", "value": "c299089ac3e8f665690193c2c042f4cb8ba92215e8302d3e3b215b630e11370131ccda0ff21a9883bd69c36845709d76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776009595, "uuid": "fca15814-9461-49c8-8f22-339fddf01762", "value": "T1338423CCEB385352DFE659FB8056C480453B7D268E705E70F89819BC07FAA79196F420", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776009595, "uuid": "7ad79ebc-ee0b-4416-a230-7851b043beb4", "value": "9b760feffec4fca9c313889f9a05ee36", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776009595, "uuid": "69204cdd-d0bd-4a01-887c-e22eb2034570", "value": "6144:UNbn5S5n2d21gz5U2wMTkB0gBWt093yHcH0S1ybxP56X+d:8b5K2d21i22HTWBWtW3yHcUaG6X+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776009595, "uuid": "14304062-76ca-4de7-8b2a-8d23f5c31079", "value": 372224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776009595, "uuid": "a8163282-1d06-4d71-8baa-338f55306970", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776009595, "uuid": "e0cd2328-f201-4c14-8233-3bbb2141dc7d", "value": "c4a5223bcf57b32e036c33c4d0e41aa44ff3eb4632c2fb4ed9c9bd593a04c3ee.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7c8af8f-3660-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775992418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775992418, "uuid": "b9ef29b6-0166-4453-8b01-efd18f857a4d", "comment": "Malware payload (Mirai)", "value": "314d2324db1b11cfb5e7d8f0f71733ea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775992418, "uuid": "43365bee-4396-443d-8ed4-902d03e65303", "comment": "Malware payload (Mirai)", "value": "c4e360abf77a95b710f50cee2b04a8e22f62a90bed7098d3b75e7707cc95e4de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775992418, "uuid": "57df07dd-9ee5-4275-94fa-18175801a130", "comment": "Malware payload (Mirai)", "value": "7389474a6d212554ee81e5b26c7e149925f6e1a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775992418, "uuid": "56e1fb2a-4ee4-479b-8b97-416162dc4c3f", "comment": "Malware payload (Mirai)", "value": "f2c17a65ec09911c7625e0ba3da5d8c3018267dc18a51d926334314e7fbdd6265affcdb277fed56c2cb5e4d416c81d8f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775992418, "uuid": "e57bdb77-eb40-41e8-a8f1-36bdfe6729fa", "value": "T11BA32AA6B400DC7EF85BE6B380670B15B520B7A04F516F17B627FD63EE290645C2AD43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775992418, "uuid": "49a9805c-81ee-4c20-aadf-9091cfff33d9", "value": "3072:dksfLMyNcJ+m9BBBeuBopotgASERCkVBkvAGl2qz:pfLMyNcH9tgASERZVBGf2U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775992418, "uuid": "55046c2e-d3f0-4513-992e-c366917e6e86", "value": 101536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775992418, "uuid": "deb0fe23-d195-414d-a2c8-1b4b69545b5a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775992418, "uuid": "ce8be327-ccd7-4eac-840b-39fed928ddaa", "value": "splm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8feb1485-36a2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776020725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020725, "uuid": "22c71ccb-d683-4101-8878-77dfe7a764c6", "comment": "Malware payload", "value": "2f999a777ce7cf61508970650f018593", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020725, "uuid": "e27b9e44-bc5b-44c3-8ee8-74214fed4aff", "comment": "Malware payload", "value": "c4e5283640139cab74059d0f55adc860b35a28cfca33906a955172b142853a9a", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020725, "uuid": "a0ca6de1-0981-4463-8f68-cbdd3566ac06", "comment": "Malware payload", "value": "a6bc0d37103e38397a6183503a9f9ba408177263", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020725, "uuid": "77e8bcc2-70aa-4e8d-bc70-b63b30defdd0", "comment": "Malware payload", "value": "9887ca278dc15ff4b53983c327a1df84747a35ab7988ca13a34c7a3f86a08f542f3db32586ce830632965f1f47a7a906", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776020725, "uuid": "ae04d774-4ab8-4aa8-ab41-22158d78ce81", "value": "T12767339595E88ED3E0F654735B68DB449A66FD661FC3443B6EAA390208F37E0F2F1408", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776020725, "uuid": "92dc278d-bcb7-4b53-9994-89cea72ebd8c", "value": "786432:LCX8E+mbsxPQr8R51+GrGbKwq8yZTlHwG4ozaFv1ObXeF:LCsE+mbsxIirGtzSeG4ZFa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776020725, "uuid": "b040810b-76ba-4ac8-930f-7511ff1fa2af", "value": 30285824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776020725, "uuid": "7e43f104-362d-4c68-95db-e65e84a5f1ab", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776020725, "uuid": "3e45a5f7-cdff-457a-a4cb-12be47fa1b74", "value": "Game.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5efb04d5-3629-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775968674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775968674, "uuid": "86b266bf-c9cb-43b5-af4a-64e01d448798", "comment": "Malware payload (Mirai)", "value": "492967a517b790b9a0129ed418a6b556", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775968674, "uuid": "77506d99-b6d9-45a5-a0b2-112b09d805e2", "comment": "Malware payload (Mirai)", "value": "c57d088a890f914a4849ddb8c4dfe19b5555c0faf9dcbd95476793b3ca25fbcb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775968674, "uuid": "b9dae403-6d05-4b1f-805c-e895b38a2008", "comment": "Malware payload (Mirai)", "value": "e2be3a29936563ce22a0017fa57ad65e71784a12", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775968674, "uuid": "8e523b71-f1b7-4395-a722-c8abecadd232", "comment": "Malware payload (Mirai)", "value": "f37a8e8f7bcb0379283378824b764ae60d6bc0a65a769c999663dd0168ce43bc407588d88162d202fd4ae8138b064112", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775968674, "uuid": "0a1d7898-12b6-4668-8a93-0f7edf39aaf4", "value": "T1F4E55D626BC7DCAFF7A9037516F389B4B3E8A05231758DA1C36F760A1F251A4490DACC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775968674, "uuid": "94cc244e-8d43-4a23-9141-9a70f0ed8556", "value": "49152:kcT7cJJqfEYn9AgQwXt+uPS4HpQIPPE+rF:kS9AgQwXt+uPS4JQIk+rF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775968674, "uuid": "6904d404-c6ea-44be-b7a6-0e36545042b9", "value": 3081864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775968674, "uuid": "0e1ae6d4-b1a2-4ed1-bece-0bcb3c4b3c4f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775968674, "uuid": "99db40e6-4fe9-44b3-9a52-5fe2d1363976", "value": "ciubuc_mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22a37d8d-36a3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776020971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020971, "uuid": "19ffd6f8-5152-42ac-ae23-03e005df3791", "comment": "Malware payload (Mirai)", "value": "40ba35f3bc428dc479ad5aee21a62ab2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020971, "uuid": "3ef7f36b-d396-4fe5-badd-da615560173b", "comment": "Malware payload (Mirai)", "value": "c6977c38a937833a56a6e9dee743c43b7e1a1abf72d84b4cf4c6a1dc604a0f14", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020971, "uuid": "54bc1d31-8587-4bfc-86f6-14b21fc89043", "comment": "Malware payload (Mirai)", "value": "1164e238639d5e61cd4f82746c1e02ec8af092e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020971, "uuid": "bdcff90d-1c11-490c-a5a4-2c7203b7eb9f", "comment": "Malware payload (Mirai)", "value": "34a195db857f586c3570696357f64bb9d5f54d3420f49ad6dd4e99aa7c97b72d05a651bba0f17467696935e7b3ed594a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776020971, "uuid": "bc83c54c-40fd-4940-9cc8-6be140e18249", "value": "T1DD054A06EF445FEBC46FCD70492EC31B11EDE8D756D1A62A71FC4A8CBA5D24A0AD3488", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776020971, "uuid": "c2514e6a-9e5b-464e-a6c1-4b32ba82baef", "value": "12288:c4f5BkR2ZGYbv9ZfJsnynysclHY/9hU1aFExVBODVPsHLv/N4QXtYLkSAaPdKIWU:cUr7NWiw4yaDoCxJyEPnp/ND", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776020971, "uuid": "54cb6b84-4362-4c24-8a08-109683fd9c7c", "value": 809020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776020971, "uuid": "1f27f88c-c57b-4687-b022-50e1ffdc5a47", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776020971, "uuid": "3da23c5d-c276-4d50-927f-f56e7bab763a", "value": "bot_mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1893971-36af-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776026472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776026472, "uuid": "564321f4-3e0f-4ecd-ab9a-f5dc30a23c76", "comment": "Malware payload (Mirai)", "value": "346cda84b317bc571e8334070d1d4c8a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776026472, "uuid": "2b04f564-c35b-4329-927d-2abe35640209", "comment": "Malware payload (Mirai)", "value": "c8d99bfd2e5cf62351a9664c8d56357682d21b45cdb64ce9cd24c874976087e9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776026472, "uuid": "5494718b-039a-49ba-a68f-4d9d24d88dd9", "comment": "Malware payload (Mirai)", "value": "36a177be45a15c39a1215949783136e810ab90ec", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776026472, "uuid": "2e0a92e4-731a-4309-b5a5-38593179f215", "comment": "Malware payload (Mirai)", "value": "dfd07136752672afc7e845a58e1b17c18e9e4e74a9ec1423a36c2e5589394c73f2bebe62c6f2765aa35de5621ea3b07f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776026472, "uuid": "d81bc2b6-5950-44b0-8973-982b5b93283f", "value": "T1CAE56E626BC7DCAFF7A903B506F389B4B3E8A15231758DA1C36F76061F251A4490DACC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776026472, "uuid": "bcb4faac-2981-47df-a9d0-a81ab620e233", "value": "49152:JwGWDxpei7ioBvoQGvbTo39trCIOO5otgQPP1jJ4:S7ioBvorvbTo39trCIOO5IgQVjJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776026472, "uuid": "2fc37d68-85c3-4f2c-8f33-67de90a7b52c", "value": 3081864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776026472, "uuid": "2899eb67-21ec-42be-be35-11c2159cb292", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776026472, "uuid": "f71d9ce9-0bd7-4e07-aef8-81bdf623fee0", "value": "ciubuc_mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21123a5b-3683-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776007224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776007224, "uuid": "357b99db-9b1f-4618-9ab9-ccd317310b62", "comment": "Malware payload", "value": "becee1110ad23b3ec6b9db3c29c16d28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776007224, "uuid": "1e1912cb-cbc3-4de1-a4c8-0d79af1be0fd", "comment": "Malware payload", "value": "ca3bd6f8f4c8170c60896493b0bbfc4629bf94a3d0c5bd3f32397e869e98fb3d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776007224, "uuid": "5fedfba9-173c-42ea-9310-cb9d10f98121", "comment": "Malware payload", "value": "9068ca9a7adfe5a53db8efd159fc8f37ca4e250f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776007224, "uuid": "7cc5de46-f89d-48ce-85f1-30ab14be5b70", "comment": "Malware payload", "value": "177d42cc7eb7e8fe94f58b944327999b90f6b1ea87ae393c63f4ea71ffb0d4b1e7e2c69280c06659de0552630f210e10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776007224, "uuid": "915d54af-873a-4a07-a188-0f8daf7cb790", "value": "T1F015BF5663D443DDD23E9EB8C826470BC2B0F00107B1EE2B15EE54891F4BAB6766F35A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776007224, "uuid": "8470f099-ea27-4b7e-af37-081a3990a56a", "value": "9b760feffec4fca9c313889f9a05ee36", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776007224, "uuid": "c424dda7-ec11-47f1-8458-1c91cee37b88", "value": "24576:X36Bs4tL7wC3lMwSA4JRBdUQeyGD1qDLZQy:X3uPFlMw4JRBjeHq/ZQy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776007224, "uuid": "cc9b1d83-308b-46bb-bb8a-abac31063115", "value": 940544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776007224, "uuid": "ec328e0b-a79c-496d-a594-d37ce4c7cc09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776007224, "uuid": "40ec1ed6-7b28-4874-b166-d3a17ec01eb7", "value": "ca3bd6f8f4c8170c60896493b0bbfc4629bf94a3d0c5bd3f32397e869e98fb3d.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5af2805-36ca-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776037995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037995, "uuid": "f4662504-ab70-4e06-a554-98f43306ff0d", "comment": "Malware payload", "value": "d617b49053f795264a994d318f4b59e2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037995, "uuid": "9fae1df3-2a15-4dd2-9e40-b4a5d8f4cfc8", "comment": "Malware payload", "value": "ca6ae118f1b600aa55925e9d2eec6589bfa10bc8455af2c3b61d2682bcff4bc1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037995, "uuid": "276c184e-fd46-400d-81e1-d1dc651adc0b", "comment": "Malware payload", "value": "8978993b9d5668dbd70729f4019e78ba892cf85a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037995, "uuid": "ad41df70-0d8f-4cd5-a0d5-3a8df95188c1", "comment": "Malware payload", "value": "54fb0e77f92bd352c6ab9f1377d6a5e54b2eeb8999d572a18d1044f911c13f3919b44f24652d1441abfc32c511589992", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776037995, "uuid": "9ce08089-a332-42fd-89fb-3f15fbc50eaa", "value": "T1BCB633A5AD57E9A2EFC910B30E7728B8CB0F10DB721231B68725E517764B3C26344D9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776037995, "uuid": "4b199876-7525-43da-a6b4-025e43a90138", "value": "196608:THWYmz3nNFmwmCbiOCsEzzY9qwz0tX8v5Wk+CdUFvFQwmGdfXthsdoPboYJulQ:T2YinNFpmCbxCsgwzE8IMdUFvFQQZtoo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776037995, "uuid": "af33f207-f642-41b8-9288-e6b5c78c2c51", "value": 11332432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776037995, "uuid": "69c352b9-a668-47a4-a740-aa3e164e1be6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776037995, "uuid": "a47c9f83-3348-4a7f-ad8d-a48d5d51d7df", "value": "bot-x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecd0d67a-3634-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1775973636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775973636, "uuid": "8ef77d99-cdd8-4199-9da6-f643110f0cc9", "comment": "Malware payload (NanoCore)", "value": "2dd4f2791a80d2ab4ba5d7c4f553affc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775973636, "uuid": "a361da75-f04c-4e61-96a4-b7966373245e", "comment": "Malware payload (NanoCore)", "value": "ca746656e9752fb864b418e4f775c9e0d3c7ec80318d31e0a2a176312f6e919a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775973636, "uuid": "0913f17a-8f2d-4d1c-95a2-e9fbca70cb63", "comment": "Malware payload (NanoCore)", "value": "f54e0ff7cbaa2cab6fd49450a36e194353ffd2fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775973636, "uuid": "c86b79d9-2ec8-47eb-afff-71bed9bbd1e8", "comment": "Malware payload (NanoCore)", "value": "53bd032d6795d6ae377c0d79c03d030d3f24858dfbe3d294ea9f111c4c46c009d4ecc515b9829ef281236e66263c8d97", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775973636, "uuid": "7b6fbd99-18a8-4ebe-91d8-3e7422b4af9c", "value": "T16B14CF157BA94A2FE2CE89B9715201429378C2E798C3F3EF58D855B34F267E40A071E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775973636, "uuid": "105fa8b2-f629-4495-abe8-50bff6fe8551", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775973636, "uuid": "df6a88d1-8207-4d20-bcc2-48be973f68c2", "value": "3072:UzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HI+aUOm6VjqxQJJ/lYadHLQlyrU:ULV6Bta6dtJmakIM5etm6VdbCALQmDg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775973636, "uuid": "665c1366-a176-4a7d-bbf0-1d7884091850", "value": 208384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775973636, "uuid": "447027f7-d94a-407f-a149-3a574393c163", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775973636, "uuid": "7892ff10-6e58-40ae-888b-cfadfcfbdd1b", "value": "sysutil.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4799ff12-3616-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775960474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775960474, "uuid": "b58cfd4b-ea1f-4308-9871-30c1438f98a0", "comment": "Malware payload", "value": "435f90b18eb6babfe5de5cf1971fac13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775960474, "uuid": "c04dd74d-2b77-4ec7-a939-89ef3813addf", "comment": "Malware payload", "value": "cba50529216a7d7a1505bdbd72ffa6399751e8e9e62f89562d11aa824982b472", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775960474, "uuid": "9c5e4419-6e84-471f-b37f-32a9e457b1f5", "comment": "Malware payload", "value": "6933a7106143aee5f86516eed02558b7ea63ce37", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775960474, "uuid": "4f4a70ef-2753-4f66-b0b1-9ea9d46b8d16", "comment": "Malware payload", "value": "f27265471c8535cbdbb7b3696830321b386d888147b98d5078713d3e8e499e496eb1bc07c5e76a380ad17240ddfcdf63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775960474, "uuid": "3dc7d1ac-7f2e-4505-99b6-6c2bbb08b327", "value": "T16765D003F3FD81E8D02BA1389695A61FEA35380807604BDF23D545592BB77E05FBA792", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775960474, "uuid": "3fecb6bf-3675-42d8-8e65-2720050c428f", "value": "5efded3ba41be82d6bc77e3e4a5970cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775960474, "uuid": "2e962d61-b828-4507-8ef3-8b8aee30aea2", "value": "24576:XDiQOdgoMTSgRhJDMiolZUf+n7cTHj8kwgh0lhSMXlqi2juhJvgjIIaS4lfZUSnZ:TiQOd8L+NZUm7yHj8kUDnhjnp3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775960474, "uuid": "e320ddab-76dd-4bb7-bf73-c4780691cecf", "value": 1450864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775960474, "uuid": "04231919-00ce-4953-8ec2-f58ac1e6cb55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775960474, "uuid": "5aac46a1-034a-4319-b913-15c0b9420d16", "value": "external-base.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df56f48d-36af-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776026441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776026441, "uuid": "8d052db4-9f99-44da-9790-0405f40c4b5c", "comment": "Malware payload (Mirai)", "value": "3c7f7dd2f71a0d1122ce4666b7ae8e87", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776026441, "uuid": "7ba8b2a3-d5a0-44f4-ae4e-9274208f44e0", "comment": "Malware payload (Mirai)", "value": "ccf7a7b86d34aff9ec8b4655180d85a62c03d3db7979a00f2380255c7460446e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776026441, "uuid": "afe6c155-8b26-4d38-ad13-7ac9838a3108", "comment": "Malware payload (Mirai)", "value": "ed659e19581c5d11959f507b5ceec54e24e4bf76", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776026441, "uuid": "0d2bebf4-5dee-496d-987c-7c5312c424ed", "comment": "Malware payload (Mirai)", "value": "6a5edbc41fb2f4abfbbe4098c4f7d175b9b33ba3f7dc10424a6b666c8692a8701f6b1743b0a87690cc573970d9d53734", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776026441, "uuid": "34be7a9e-b835-466b-8c04-b472a71d51e5", "value": "T12FB55B41FD51AA56C6E0A6BAFB7EC28C33272BB9C3EE30174D044734779A95A0E3B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776026441, "uuid": "780bc7c4-0940-466b-a614-da4fb5ed282f", "value": "24576:beKzkV3OafbRGijqGKlX4KlgP6S9+rZ5K03DMnw7Dqd3vxJGtfWRXnMKmaxWKous:be5G1lIKiPYG03yZxstuozupWvPle4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776026441, "uuid": "9ccbcac3-c3a0-40cb-b7f2-404c533a081b", "value": 2494268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776026441, "uuid": "f0d19383-c58b-48b4-8746-2f01b10b2f30", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776026441, "uuid": "0377a553-7af3-4f6c-931f-638ac0809c3c", "value": "ciubuc_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45fd64a8-3677-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776002132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776002132, "uuid": "8f26f18a-0eb9-4840-906f-794be588dc33", "comment": "Malware payload", "value": "db87f9689588b5a67da0a34fecb52661", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776002132, "uuid": "d5604a4f-e976-4adf-ae9b-af3b55cf8dc2", "comment": "Malware payload", "value": "ce32b0b64af697a53b649fea344a99ff638c2283c387096ab84dd7c824425802", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776002132, "uuid": "70fb2ce6-2638-4608-a087-09e348615579", "comment": "Malware payload", "value": "d96db1196e005e33b60ed9efdaabce959a3ee62c", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776002132, "uuid": "f49a8c1f-e6e9-4576-8892-81da738c6ace", "comment": "Malware payload", "value": "e89d856099bffd88d1189432861a9ae914889e60ba76f9ace52b7f27e428546ff00696e4fb04e76e10a3c139c9153a34", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776002132, "uuid": "a6ef0317-62ae-4934-9baf-d6adeb3b9476", "value": "T138978C0773E50199E177D1388AAB9103EBB2B8161734D7DB32AC03652F67AE09D7BB50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776002132, "uuid": "d5a336db-4363-48b0-bceb-050f80e7efcd", "value": "174435db180feb9caa3b336186ee6a8f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776002132, "uuid": "b93ae473-84d9-4985-aeeb-e61b2defca0f", "value": "393216:/zBd4IcVUnN7qg+21j++sHV1KX6RSF32YhQSI8w5SvDazn1d5VR/6Lgc/icMOQMS:/aW1JhQlR7T9KxagPV1Tm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776002132, "uuid": "ce6768e8-6e67-476e-835a-20c2a13572ad", "value": 42790400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776002132, "uuid": "c0c84a7c-13b0-4114-b9ff-1819d697a7d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776002132, "uuid": "1464cee2-c5b9-4328-ae97-5a81fee6163b", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b9a9396-367c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776004236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776004236, "uuid": "28ab550a-fe07-4692-8944-a5874aa0dbbe", "comment": "Malware payload", "value": "de8d878f78c6b263f2d723d3fbd83984", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776004236, "uuid": "83e84a5e-c8f0-4cbf-a9b4-445095a80c9f", "comment": "Malware payload", "value": "cef0ade69f693d98dd4254278d75c5e115536db48185402aed328df10703bc85", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776004236, "uuid": "8ebc5785-2999-494c-96f7-8e0e00a61c54", "comment": "Malware payload", "value": "36c838955370a0d090f6807cbceb408dcd07cf18", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776004236, "uuid": "99783b7c-08b1-49a2-ac60-c1ea301495b3", "comment": "Malware payload", "value": "4422f165ee9a2bf2a8b5d0b2cc1a13d965395886e2fd629905d1e73ab524c589c0ed767fcb4e4aa8e2ca1a39d6c22b65", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776004236, "uuid": "58b62ef8-f6a0-467d-8504-bc61e1ac9078", "value": "T12F137D6966857C24AE9988371C7E2F0CB9A983E1310851EDBFCB3CF58C49B9CD21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776004236, "uuid": "71b7b5d7-f871-4489-ba00-206d8eca92c6", "value": "768:bw+t9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:bw+ucy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776004236, "uuid": "253d2def-ab46-469f-9b82-049f460b6365", "value": 45543, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776004236, "uuid": "c6cd2d4e-2b3d-48af-a7ca-8c7b349dc02c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776004236, "uuid": "d6dcf456-bac5-48d8-94b9-71b1d4c6dfd8", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d5ece91-3659-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775989394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775989394, "uuid": "150c21a6-68bd-4d2e-8899-f4064bf49732", "comment": "Malware payload (Mirai)", "value": "57134a499765ef008162a029aad53d2a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775989394, "uuid": "3e355c0b-b31b-41b7-b837-a248e26f00ae", "comment": "Malware payload (Mirai)", "value": "cf3ebf8de4ad8096dbadd35812d7ed2c777a5340e0273b9578cb9e51dd1729f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775989394, "uuid": "09bae7a6-0bdc-4284-ab8b-344a64d01bb2", "comment": "Malware payload (Mirai)", "value": "796f520007c2e747f18c001553be1ae0b9e226c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775989394, "uuid": "2d16d61f-6743-48d1-9f08-d528f9e8f60a", "comment": "Malware payload (Mirai)", "value": "3d50b9b02554002de8f6c90a9e06df93bd3e3ad2e7a8c4f84e3d2812075b93ca014267616e5978e3a54ffce795832fcc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775989394, "uuid": "fdbbb9d5-d906-4cd3-aaf6-b05bb04783ef", "value": "T1CE837BC1A243E8F1ED08227520BBF3336076D9BA0478FEE3F75656B254156A4B18E74E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775989394, "uuid": "5b9e2e77-f27b-4539-8213-1c57d6f3686a", "value": "1536:zuoAwcC1mj2GaR28a0Gf1ibu0Bv3nv8h2PM8mMW5m2CKjbSs0DFs8Ql3fQjjhkkN:Ulds/93nvMLr5YmbLn8E3fQjakvEs6MZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775989394, "uuid": "356ad4d7-2ce4-4ddf-872a-368068027d20", "value": 88496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775989394, "uuid": "3054be12-e7c5-4299-856b-9746690dcaaf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775989394, "uuid": "962115a4-c9e3-4494-afa9-9ffb3c3a3569", "value": "splx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "706bb60e-368c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776011223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776011223, "uuid": "d466fb31-f86f-4a4c-9664-9e903278d1d1", "comment": "Malware payload", "value": "39ccec65948043d2eb94b337de26f9d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776011223, "uuid": "bbf568aa-3ce8-4f85-8680-ad2043c399d0", "comment": "Malware payload", "value": "d122d6c2ccc69594bbfbca82315aa0803b3b93972a6ab83699797812b35d9679", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776011223, "uuid": "a14e2a63-4248-43e4-a94b-5979b17d1797", "comment": "Malware payload", "value": "2e25e10ec706029ab21b23758def3d0c8aa256f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776011223, "uuid": "ff69fd8a-ad1b-4506-9444-6e3be65b88d7", "comment": "Malware payload", "value": "9d9e8fb56847edf770de011af06fbaa54b26518d2a37aeb0570068cd5b2696712445443b7bcb9d2e1a8589d5f5b7b367", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776011223, "uuid": "ec29a9d8-eb6f-4197-8ed3-7ba9c0b1cbd6", "value": "T1F4C46B1166F503E9E07BA738C817530BCAF1F28119B1EB2A11E905950E8BBFA776F315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776011223, "uuid": "a4971daf-b031-4541-b7e7-f9c0699bc048", "value": "d386edacb5bc531cae23e0abe0d5b57a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776011223, "uuid": "7f86d900-ae55-409c-820c-9555e3aa3d88", "value": "12288:4mRTlZmX9xZVLcftzbJF8PLC4/RLD3py3kez/:4mhrtftkPLCqsn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776011223, "uuid": "b9beb73e-1533-4ab2-bc5b-2a1d19bbbe0a", "value": 588800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776011223, "uuid": "15f3e01f-5d8a-4c9a-9b9a-2ef8b9fdb1a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776011223, "uuid": "c40723d6-ef52-4010-9d48-57924259460f", "value": "d122d6c2ccc69594bbfbca82315aa0803b3b93972a6ab83699797812b35d9679.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa49319f-36af-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776026487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776026487, "uuid": "b28b3276-cd55-4d42-88c9-4f287d767910", "comment": "Malware payload (Mirai)", "value": "2561e12c17a148ccb0e586a8265a37c6", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776026487, "uuid": "933f0764-8662-4ea4-8f82-63fd66b07f06", "comment": "Malware payload (Mirai)", "value": "d125d2588b3037975c1a339f1576ac2285d28ef888c61e3d01f9d15205696c27", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776026487, "uuid": "e90e04e2-03a8-4517-9664-ab084daf92ff", "comment": "Malware payload (Mirai)", "value": "ed2e33268c0edd7008171518157b5d0a90b04c73", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776026487, "uuid": "200fe792-5aca-46f1-9ea4-e5220281e0a9", "comment": "Malware payload (Mirai)", "value": "c3376afda13b257df6321333e497458f5aba7a876c73f2aac8ce46da537098136885e368a022e1f553a3547b60ce3ead", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776026487, "uuid": "332c3406-eaf6-403c-8cde-26ae2c95c166", "value": "T163C59D62D968AFEFC526D571A538CEF20B53680052160FF639A6E3B44947AC2F3067F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776026487, "uuid": "c6193397-87f0-4829-9210-89f31e9a2cf5", "value": "49152:slsCl+cV/TeYJd3ml7wn6/JxMKvDbZg3uF+aGcXuv+VpmvPseWI:LC6/HFXBpmseW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776026487, "uuid": "0e4a954d-3a34-44e2-90cd-ad5a92a7c23e", "value": 2694952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776026487, "uuid": "949856b8-7551-4636-8258-b0cc5745c95d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776026487, "uuid": "cfc5dacf-b3dc-4a2e-b6a9-e4485cb055db", "value": "ciubuc_sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f545d05-366f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775998793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998793, "uuid": "745605f8-4a26-4e76-9d73-46d21e8268c9", "comment": "Malware payload", "value": "d9b14fd0344cb73513b46b7709eb2dc0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998793, "uuid": "376ea14e-b267-4359-852b-7fc85c8aa4de", "comment": "Malware payload", "value": "d1cac3f9cad8beb8ed01324c363dd4b8e406c13798ee16f80443b7078865d5fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998793, "uuid": "23b1d77b-242c-49fe-8d53-54aad1a9bbea", "comment": "Malware payload", "value": "74c32ffd864c6abc7e3b969663b56afb32cead1f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998793, "uuid": "2a0c096a-bf4c-4fb4-a3ab-8b69bbb0d7b6", "comment": "Malware payload", "value": "319e64f65d233fa6edd1e67c2eae0d7c0f1b2f79f451defec6c669f3bec679d0c8a26b329e375cdb45a8e951f63b3180", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998793, "uuid": "96298367-5dd5-4ebf-88bf-3eeb7692cceb", "value": "T176C312685B4EE099E38803B555C7C6CC77693623ACC485DC87E0ADC2732480EE7BAB46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998793, "uuid": "6ad1d11a-008e-47a0-a1b9-6c76c9feb359", "value": "3072:B+8wlJnS+ZPcvz7fh/zEBh8E9CaIszRHB3XVp6Urk0KGp/KIKVMxa:B+xZPQz7fdwBh8EnI6H5XVEgBKwKIKn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775998793, "uuid": "5340ca84-15c7-494e-b1c9-7bc2e8c96268", "value": 125600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775998793, "uuid": "ed4b0d44-31d5-46ef-84a5-1f49f9b57418", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998793, "uuid": "b824f934-22fa-42fd-bcc2-5c7468ff133e", "value": "redis-scoutd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd7b48ce-3689-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776010117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776010117, "uuid": "1aedac9d-630e-42dd-85dc-1f625ceff848", "comment": "Malware payload", "value": "b4ad2052383ce12a1022ea3f77fda047", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776010117, "uuid": "c46ec01b-2340-4d83-bfaf-6aa42f99a197", "comment": "Malware payload", "value": "d1dae703d201083c22f3b7a0a7d23ed874ccebdc22f9ecfd06b82dc685c3f774", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776010117, "uuid": "f9dada9d-7b24-493b-bb5f-d109b73a3138", "comment": "Malware payload", "value": "32bfa98054696d712786028e906c401ed0407a6c", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776010117, "uuid": "29d94984-b4d7-4aaf-8893-5dbbd69325fc", "comment": "Malware payload", "value": "3d643eaf2d44565a2683a9f988367d23dbcd7ee0d023f8b14e83b2831cbbb359401590c221ce0c8f2acbd6a21cbd28f9", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776010117, "uuid": "47837e91-10a6-4154-8aae-6671d05ab4a3", "value": "T183E3671811DE05955B7338DA5FE6AD42FB624713489CC698B72CFFE12F10275E0EA2AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776010117, "uuid": "3b7a3dad-6a1f-43f0-bbf1-1a79335ea2ff", "value": "768:j+qeKS5WIwuBfyN7HIH1Ih6JPT51i4m10vFcszbIDk6HhRzagI:DeKS5tvH1fNiPhRzagI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776010117, "uuid": "0fe546c3-1a62-4935-9863-ad0ff35cb0b7", "value": 145135, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776010117, "uuid": "91398cf3-36f5-4ddd-abd7-5cedc0afce47", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776010117, "uuid": "3ec50aec-0aa6-419e-a36f-646a31e68e97", "value": "Testing_Z_Data_360.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d741e3a1-366d-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1775998081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998081, "uuid": "11431443-7102-4d82-b26c-a1051e658f68", "comment": "Malware payload (Gafgyt)", "value": "c57ad249c1d94b6f86ce36542d34098b", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998081, "uuid": "f908cf32-2d40-4b68-8317-874f5c77894e", "comment": "Malware payload (Gafgyt)", "value": "d1e2eef854955f156a6253754d81fd09720fafdff4a61c0cb6fe1f28d35c738f", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998081, "uuid": "909097d9-84c6-42b6-b843-ae11d3bca48a", "comment": "Malware payload (Gafgyt)", "value": "1a001a956f913290a00e891e88ae5f866925a42e", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998081, "uuid": "5cda1195-d1c3-41d1-a7b5-c34fd5ddffdc", "comment": "Malware payload (Gafgyt)", "value": "ccd1509accd0f923eb758217c7a4d7bce1247a1ae4a53cd1a2e815599d675f8f2033963a9a92e1fc52e8613d80dcd55f", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998081, "uuid": "8bee3b9b-0dd1-4087-b0da-c878d6a788da", "value": "T14FD31213CD40A102F5FE74B1C03A57728B538DF107CAB51AA867610A39EE68B795EFE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998081, "uuid": "267ffe2d-e324-4b72-bdaf-741f207eee6e", "value": "3072:vnGju3GCJvZT/WBYBxeXQebNw40fOVfToyFYfkpwP7PwZ+h:eSFZTJBxHeb/0fOVfToJfkU4Za", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775998081, "uuid": "d318da9a-0c59-4ee8-9c46-e4d16ae0c3f9", "value": 136192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775998081, "uuid": "a2ac87bd-c3dc-4073-a9d6-b811f5488fb9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998081, "uuid": "6d35a16d-137f-4b38-8d6f-3ea86d520697", "value": "redis-buildxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89300542-3670-11f1-a769-42010a9c0008", "comment": "Malware payload (GravityRAT)", "timestamp": 1775999239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775999239, "uuid": "bb121641-b843-481d-958e-5ec66ad5dd2c", "comment": "Malware payload (GravityRAT)", "value": "8415f759e1c774cd12b5750e4327878e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GravityRAT", "colour": "#4729DC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775999239, "uuid": "41d803a9-0c60-4291-9e07-2aa6266bbcfc", "comment": "Malware payload (GravityRAT)", "value": "d2654f3833aec91c254fe096f0ae50db2bde6f23470d6db78891d8025ce88053", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GravityRAT", "colour": "#4729DC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775999239, "uuid": "bf2fe7dd-712a-4a01-8f47-42c0f8e4d5b7", "comment": "Malware payload (GravityRAT)", "value": "f89a4ebb77adfd381f888f78adc90ba9fbe7da62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GravityRAT", "colour": "#4729DC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775999239, "uuid": "9815547b-bbc2-4008-ab61-66b305bb2204", "comment": "Malware payload (GravityRAT)", "value": "84d7f637280f09cbf19511f1ad9fe764a54efbc116a5e19c9f25c6f9b972ce6719c5e991977db547dd439dc684c97a35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GravityRAT", "colour": "#4729DC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775999239, "uuid": "baa82131-8198-45cd-be14-00c0b5e681be", "value": "T1A6C6B032F6E405EAC2BFE274C06216227EB178675326FB8B5F8055E91D63BD0AD19313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775999239, "uuid": "496dbab7-5adc-4718-8b1f-79e67f926549", "value": "f0070935b15a909b9dc00be7997e6112", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775999239, "uuid": "ab08af4f-5f88-4c78-b7f9-a7a3232640e8", "value": "196608:I+D5q1SGs2yRwtkpqShRBhRhhRDhRQhR5hRwhRIhRmhRv:DAkLRLRrRlRMRzRsRURSRv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775999239, "uuid": "5369be36-ed9f-44d6-ae2c-23b09813fe5c", "value": 12287979, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775999239, "uuid": "1789fd96-4455-4d5e-b53d-50ab0c4070f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775999239, "uuid": "46f91b5f-90d2-4abc-a0e6-21829584b800", "value": "8415f759e1c774cd12b5750e4327878e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b886f16-3682-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776006759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776006759, "uuid": "b1764fc8-7fd4-44ec-81e5-82cda0bc7230", "comment": "Malware payload", "value": "1094a1b6c1fd150d4d261c00c198910d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776006759, "uuid": "72eb31d1-8549-408e-a4dd-f9c2c1522e66", "comment": "Malware payload", "value": "d32455fc430ffc13e8a89db9198f17184fd27001fc11a7e9531d6055932853db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776006759, "uuid": "2b379da7-8a27-41ea-bc65-3c85c3a8b6b1", "comment": "Malware payload", "value": "f1eed19e4c80db42ff96d08c2303bd943fed058d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776006759, "uuid": "06ef2749-a50b-470b-9965-d5e6de023f65", "comment": "Malware payload", "value": "38a4cae1a3524c5ebec19598bd481dcf5f908a8b218244877e12a844fe010e8af4d303e08444af177262536cea5afea8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776006759, "uuid": "38d0c2a5-7c7e-41ab-bf33-1efeb8bb84cf", "value": "T105E42365F5264FEDC22CE73DE48A0917F716A611F874274E5BAAB1413E1FB18B0BE600", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776006759, "uuid": "bb25deea-7047-4f36-8dde-9306b5e7568f", "value": "9b760feffec4fca9c313889f9a05ee36", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776006759, "uuid": "8a518d52-aa3d-4ce0-9e6d-b9357602946a", "value": "12288:Z83yNxxLAfRP4OmKBi1gBTABqH2oGRxwupyfxxLAfRF4W22BiniBvAjMd2oGRxU:W3sMflmKBi1gFdaxwuKMf122BinixPwS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776006759, "uuid": "f3379d1f-87a9-4e68-9104-8f8be058ac20", "value": 702464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776006759, "uuid": "2e2e7565-bb8f-4017-b8d3-58c9b92e84de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776006759, "uuid": "ad03a399-dbf1-4cfa-a71d-69fcd96b3040", "value": "d32455fc430ffc13e8a89db9198f17184fd27001fc11a7e9531d6055932853db.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4d9586f-367b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776004009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776004009, "uuid": "d31a7844-09f8-488e-be0a-95a382d5b486", "comment": "Malware payload", "value": "d2aa58c68f360a5d66d3e48252f46fd1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776004009, "uuid": "7c06caf5-2b61-4960-922b-feab7e8ecc03", "comment": "Malware payload", "value": "d5abe59abf73ed705aa7bba798dc417525aec110f3af48cd01c2074e763b6e21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776004009, "uuid": "6c52a553-15c0-408d-a048-041bee3e0369", "comment": "Malware payload", "value": "e623539b5123dceab124e10949e182a6bd45d4eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776004009, "uuid": "668482cf-92ac-47ea-a176-edc24ed696b9", "comment": "Malware payload", "value": "44f44597bb41a0e396975409ce862310425ea8d21a64c33117b861df638977c21c631850a70cc0fb3beb12289c62be40", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776004009, "uuid": "19168de3-7404-4b48-bff7-210993e590d1", "value": "T161A5E156A3B440FCD0B7D2B4CA464A0BDFB2F8061635969F43D44E562F23B729A3E721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776004009, "uuid": "80d0adad-ff02-49fa-82ec-b0647b93b13f", "value": "6a9f6a260ca79fa9a2f283172c4ce776", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776004009, "uuid": "0563eea0-7681-43dc-91be-142b78dd7ca3", "value": "49152:3EBfviDsP8+vG5+At/pjjGRyQs8j2yuJQ2O2eu:MWL+vIt/pghsO2p7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776004009, "uuid": "044b116f-be06-4608-8f65-292ff00ca583", "value": 2202624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776004009, "uuid": "e9c661b3-2bb8-42f5-8507-b24619766c59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776004009, "uuid": "cebe5bf9-b5f3-4119-95bb-f0f531236b65", "value": "SecuriteInfo.com.Win64.MalwareX-gen.72479612", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ff203f1-36c9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776037260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037260, "uuid": "fde78a72-cb5c-43cd-b4e8-dd9fa19afbde", "comment": "Malware payload (Mirai)", "value": "30f83883da9bb7112954505bb042485f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037260, "uuid": "2b8ec616-ced2-4d68-9c50-72ef80c854c5", "comment": "Malware payload (Mirai)", "value": "d6124299baf2703c16c2b79f4dd49cfdfc4e0852fd85d0bb42079fcf739f973c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037260, "uuid": "de67add5-24d7-4527-894e-996035c05f45", "comment": "Malware payload (Mirai)", "value": "d9d4c0e3bf1bd6005559228bcb67152678ef42cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037260, "uuid": "097d5450-fbbe-463d-8224-0f35dc43a0e5", "comment": "Malware payload (Mirai)", "value": "87a9726e72f64287f6f7350c5607afaf7b2ad6ca6bc0eda65e8792dd2d17648048fbf0488832519c4bb47b0cd5faf9fa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776037260, "uuid": "394cf107-3780-407a-bd9c-d75ace2e615b", "value": "T1CF043B46EA414A13C0D71779BA9F524633339BA4D3DB33069928AFB43F827DE0E67605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776037260, "uuid": "559892fa-7e11-4b16-9848-e8b5c6107c88", "value": "3072:KFP6N0kD3aqZ1bl5ehJgVqwaCSm/Excp5yC/1M/9xfzj:KFxc3aqZ1bl5qJk0CP/Qcp5yCNM/9xrj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776037260, "uuid": "3f2e3837-f8e2-47ee-a216-72c6ba2a84c1", "value": 180135, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776037260, "uuid": "fee5b331-b295-4e0b-8316-278b695ba03a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776037260, "uuid": "1cd28252-d754-4b40-9a0d-e714976d7707", "value": "Hammz.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a36de8fa-3676-11f1-a769-42010a9c0008", "comment": "Malware payload (Arsink)", "timestamp": 1776001860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776001860, "uuid": "dfc0ef96-ace9-420d-8618-fdff0a80251f", "comment": "Malware payload (Arsink)", "value": "bdd28852b4eb805b072bca2cb431b9a4", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776001860, "uuid": "dc52e393-fe27-4c7b-b1e6-102210917b1c", "comment": "Malware payload (Arsink)", "value": "d7362ff697a5cae24b4b084d0436ccde7060524a24c34f37f185f64597930514", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776001860, "uuid": "aee00d23-8e96-48c1-8bc0-461aef8a8548", "comment": "Malware payload (Arsink)", "value": "de3291c7b531d3ad70791c4ea057b94ae4e1583d", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776001860, "uuid": "74b70362-4255-4e50-9382-88bba92d9d5a", "comment": "Malware payload (Arsink)", "value": "d9e46cf729affb0ffe9af1be90d19bb2276dbc468a24ae903cc2e8b804c211dca8ec24f487febeb1f1fc7b9e5bf63698", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776001860, "uuid": "e02a447f-34f4-4899-befb-4b17570cb22e", "value": "T1535633038B55362EF4D6477972D315B2F5B75EBBB274A0E2D903F38120B7660AB82913", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776001860, "uuid": "ff01fcdd-5cf5-44d2-b6c4-e15ed354a117", "value": "98304:2m5cy9Z8uTcIEO3KkOtzBJFLOdJvwNciuwRph2dpbKmTAjZCjHXb7ybrQm4:2m+y9Z8KBTK3rJNoIcwRpheTkjSMrT4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776001860, "uuid": "5e5c8ece-3d6d-4208-8914-95e5e3747413", "value": 6075751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776001860, "uuid": "a5753747-d72f-455e-ba60-89b394cb7063", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776001860, "uuid": "53e55d69-1c01-4021-bfb2-6b88dfe1232d", "value": "Robuxi.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "499caec5-36a1-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1776020177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020177, "uuid": "665da585-0dbb-4434-9a86-fcf2693169e3", "comment": "Malware payload (AsyncRAT)", "value": "cc0c75a4ebe978d19c0f78440b49c8e2", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020177, "uuid": "d70b1681-7063-4547-8f95-c7fbba230468", "comment": "Malware payload (AsyncRAT)", "value": "d77b3f897accc56707ba188e39c59fbc10163319674f31cc55c4b7d6641f950c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020177, "uuid": "b8e8cab0-018c-435d-b75a-c7385e356206", "comment": "Malware payload (AsyncRAT)", "value": "30db1d8aed7a8c0f28ecfce37b09066f4e06478f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020177, "uuid": "2cc33647-e834-426f-a4ca-14059767d120", "comment": "Malware payload (AsyncRAT)", "value": "715464d6079e602290943da4011709fc533353461ec8fba4e94b7074274a0e6214017f298657e31c00d0a1f87d1bd107", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776020177, "uuid": "3aaa2255-7508-4a84-bbb7-933d31607dbd", "value": "T1BAF36B17B3A970F9E177C27484924646F736787A4B21ABEF03644BB61F122E09D3DB60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776020177, "uuid": "aafe4823-82f0-41d3-b5b0-3b0ef820c25f", "value": "d010692da5e0e07c07c8928e1fe93691", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776020177, "uuid": "84f32b72-c314-485b-85ec-d26590ccf7df", "value": "3072:HGs2uJl2cH33VUhktwWJ75q9nfsv15O7onZkOGSOCtMtlHGqvXfhw:HGs/P33VU/WJ9q9COUkOGSOCtMtJGqva", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776020177, "uuid": "f968026a-c0c5-469b-869a-42196ec1ed2e", "value": 163328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776020177, "uuid": "ef6bad1b-6d41-4a30-9237-86ba08397280", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776020177, "uuid": "673e707a-e95c-4f55-8d4d-e4fb50666058", "value": "RFQ 2026.08.04 Rosario Factory_Food Industry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e07b42ce-36c8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776037181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037181, "uuid": "3b25b658-bb1d-43c2-a6da-c7d4d550e6ed", "comment": "Malware payload (Mirai)", "value": "ee31f8a1ab1ba9099f430d4357a92594", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037181, "uuid": "e876a8fe-ede4-41c2-b513-92bb79a68460", "comment": "Malware payload (Mirai)", "value": "d7bcb5ead61674a868ee0f4f70ea2fc9b884a4953534530a44b1872b6c5fed4d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037181, "uuid": "4276f542-3f7c-4565-8489-a2930b77d160", "comment": "Malware payload (Mirai)", "value": "1b8c80f06383d33b871f47cfcd4ca8eecb7c9c07", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037181, "uuid": "bf7b5836-450b-4338-8b97-52cbd880e35c", "comment": "Malware payload (Mirai)", "value": "e685ec76e9571144922b078642cb94afae4ae8a557b4977f086ce9858846f577e374000018add577d44509422df4b73e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776037181, "uuid": "5bfaabc4-7c42-47dd-a1b2-446f59e9e98b", "value": "T1B813F1BFF24ED2F0C463F3B218AE4598FE705C56449566AB0AF7733E5065EE50710920", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776037181, "uuid": "cf13f7e6-7c6d-4637-9c4a-4e557023282b", "value": "768:RcIgCG+pIkjT262IrxOz1ujtVi2dSorphL8GaSx02S:SIZpIbIFOz1iBvrIGVDS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776037181, "uuid": "b7e96c16-c566-4e0b-a929-2fd45d2fb70f", "value": 42568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776037181, "uuid": "6a5f5cdd-2a3b-4157-8600-5f5e17b7afba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776037181, "uuid": "a8cb7f8c-3db2-4230-ba47-607ce278f724", "value": "Hammz.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf339585-3657-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775988619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775988619, "uuid": "3997cf19-2dee-4d90-81a2-a847c3d83ebb", "comment": "Malware payload (Mirai)", "value": "4688b4346b22306e593000765cf3c479", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775988619, "uuid": "35795e73-2690-406d-8a39-ec7766d09e06", "comment": "Malware payload (Mirai)", "value": "d80bcc8a926440f4033946f46680ddaea8e1bd9e4cbd64732bc94a84845c8e73", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775988619, "uuid": "f7433a5d-113d-44fb-8953-ab95d9344743", "comment": "Malware payload (Mirai)", "value": "5fd2cc745cde2981b11c380ed79d16ed00d2f120", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775988619, "uuid": "dd8db50a-c2de-4a4b-bb31-03105ed0384b", "comment": "Malware payload (Mirai)", "value": "9000a6721cf4aad7cd1e25d61c5e4c089e3a8651437035da044ac1856660d100b9ebe6010f09e227b1ce9862f81c48e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775988619, "uuid": "53db40b4-11cd-44c0-9de0-3b75d1d0251f", "value": "T109B56C43E683C0F1EA1206B11117E7779A359A1A0136C9A3EF98ED35AE71742E71E37C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775988619, "uuid": "b3149a30-aa51-4c8d-9e6f-8c5110ba4a4e", "value": "49152:FwYF2CGciLc3fSLjQ45hzf9Q/k6cb1p6kV+9:J26i7J5xndp6h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775988619, "uuid": "16a9c4b6-155e-4fab-a324-06f275c24559", "value": 2411388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775988619, "uuid": "bb8d4e29-82cd-4c17-b733-4556d4f761f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775988619, "uuid": "8fd413ba-512a-4221-8b4a-fc135dfceeb7", "value": "ciubuc_i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e774a60c-3683-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776007557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776007557, "uuid": "d15bbdee-12ea-43f3-a01f-b80342629aea", "comment": "Malware payload", "value": "e8ea2a65fddd52a17af97c4b68119942", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776007557, "uuid": "1ba88edc-504a-49f7-a5d9-321a622cca01", "comment": "Malware payload", "value": "d8e382a853e43096d94179955954165c8b688727b6d3b1d54b3fe3948ccd4564", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776007557, "uuid": "f60b0eee-5622-44de-a786-e4adbbcb04a6", "comment": "Malware payload", "value": "b38e1ee2a73050e07c6c6adcf567c958c2483e79", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776007557, "uuid": "c822e1a0-04aa-4899-a7a1-0d27b6de16fc", "comment": "Malware payload", "value": "01260b0231e1fffca27e7f35ba94d357f1ff193cc631e81c65bc783c92bcd3eae6302e7f37dc0fea6a8cfd2eeee509ee", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776007557, "uuid": "85a75c36-605c-4e0e-b5ac-0d204b886f15", "value": "T12031D2C9176244756ED69FA7B1A4C934B488F0D6ACC4DE84C5EB38FD894DF087C41A63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776007557, "uuid": "98a48318-3c4b-413d-a087-c3e092fa1dcf", "value": "24:vXROSlIOSKuwoOSBpOSUOSElGOSOOS5eOSzOSyz9Ol:vhR6RKgRBpRURwGRORARzRce", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776007557, "uuid": "a143826b-6e19-4749-9056-fa90dfb09b74", "value": 1803, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776007557, "uuid": "0009e5af-2205-4348-ad3c-c27e96edc2e2", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776007557, "uuid": "dcf281cf-7910-4bb2-a3e5-1bd3d204822b", "value": "bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d48d4223-366d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775998077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998077, "uuid": "fae40232-79dd-41d7-a239-190cba6245fd", "comment": "Malware payload", "value": "850e08c90260e43596f12075f401f40a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998077, "uuid": "e072cbff-3c09-4955-a01f-83d9f0358a5e", "comment": "Malware payload", "value": "d9446dd0cf0f40014b3893b46f2738d566b3c1799624d0b9381396f3545b010e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998077, "uuid": "d8b34bc4-fb26-4e75-b011-a34fbcf5007f", "comment": "Malware payload", "value": "4d1026107ee79ceb5811a33426285bc433453240", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998077, "uuid": "0442159b-fa19-4224-805d-98341b5da523", "comment": "Malware payload", "value": "82958daed3176bb4911946806082a0424aac0f9bc7da8c1b7d20e74366e8581e0e264c4915acf19d2912938ec97fc74c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998077, "uuid": "c0a22886-ad65-4a34-8ec5-647c9d0c3322", "value": "T1CFE312417E978490B3F5CFB04BA42928CBD93D6AE0B056B75AD9978C7C310AD1847F2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998077, "uuid": "6ac2905d-e4f3-46dc-aec1-18432c17602a", "value": "3072:3mUgDO7YsO3+chg9U929L/jlexmhHq/oaEdj7ahBf8F:3mUQO7tf+9qlU+HCvExG78F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775998077, "uuid": "fe0722d6-b8c6-45e1-9801-89d931971d5f", "value": 145592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775998077, "uuid": "3b1c571b-df26-4db6-9d07-0dcd7f9564c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998077, "uuid": "76b19aec-aa6d-4d84-b4ac-f5de863ad31e", "value": "redis-credentiald", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fb5e91b-3629-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775968702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775968702, "uuid": "4a4f5a39-ebbc-42be-b9d4-82e0809b12a5", "comment": "Malware payload (Mirai)", "value": "128ae2ceedb20829a6c1ed22b035c8ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775968702, "uuid": "87813f5b-7c19-4557-85d1-ba879986f4e9", "comment": "Malware payload (Mirai)", "value": "d9cf616d3ee2e3876c290d87b32ee7ae84d0bdbaabaad7e2345e85a480e2004e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775968702, "uuid": "74db542f-88ab-47eb-af26-499d65a0ac2d", "comment": "Malware payload (Mirai)", "value": "3a00edf528c1c482512b69bd1887a7c222e1de36", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775968702, "uuid": "a39fb4d7-c6e5-4205-8de0-d385fb4a18ec", "comment": "Malware payload (Mirai)", "value": "ade4108251835eeb2fb27642450c4ed298f2e33ff2d01eb2f93174985d958a8cd5bf811d1e54480ee300a92676d9f0f7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775968702, "uuid": "0e03be88-70b6-4c9e-b964-22b52c571ab1", "value": "T119341902A8528A53C5C21B79BB5F46593733AB34D3DB7302DA18AFB42F476DE0E3A511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775968702, "uuid": "dadc5b75-ece9-4ba6-8acf-18ce73e20c62", "value": "6144:XAUxYupsZDff/aj4s7fjOyCShXQuyrnmW2hVDZI0/16O7Nc:XtxuZrf/a57bOyRX2nmW2hVD60/16O7G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775968702, "uuid": "69f5fef4-471d-4afc-ad81-f6c3a5cbbef6", "value": 234578, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775968702, "uuid": "ba3b7181-bde7-42e9-9718-65658e39af57", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775968702, "uuid": "e98d2b9c-c35b-4744-b677-3510aa7e653e", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ae8dde3-3612-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1775958896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775958896, "uuid": "5f2bf887-8306-4ae9-87dd-ddde94c688b1", "comment": "Malware payload (SalatStealer)", "value": "f56c640eeabbe9ff787bf814fedd111a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775958896, "uuid": "09ad25eb-2e5b-4c7e-855a-84a2f875da65", "comment": "Malware payload (SalatStealer)", "value": "d9d2ececc26200a3704d8c69ef2f9c2eceffe0ebafd7448c0801fcb7eaf68d44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775958896, "uuid": "ae6e4647-6f25-4399-83df-ecdf2b8fe7cb", "comment": "Malware payload (SalatStealer)", "value": "30091f54b694dfff8b7a604fd6b39dc290bcefc5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775958896, "uuid": "91be8d2c-2515-423d-81e3-6303c9f9d195", "comment": "Malware payload (SalatStealer)", "value": "b84a7351329360a9d84bea92e7cdd4755163045db89c1c6d872c134d8d276cd0dbdde66e9a13c486386d81c45652a4f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775958896, "uuid": "09fa4283-8f6d-4ff0-b22a-e1c57882777d", "value": "T196863342B9C052FDD6EE00B0046D63EC8B326C494F0ACB9FABA179952BD17D20765D7E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775958896, "uuid": "10bbf5bb-cc72-4f37-a971-755b821602a7", "value": "6393705e169b09ea70c2ac6dc6e617c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775958896, "uuid": "2bad3bde-245c-491a-ab50-83516b628f92", "value": "196608:W2eMKu5wU6BM98EWyPVjU8toykxSxdMONX1:Hvv5wRSmytbtuIdMOF1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775958896, "uuid": "66a1653d-7101-4e52-a5c3-709e76f996cb", "value": 8352792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775958896, "uuid": "3d50209b-aab0-4726-9b14-0e94ceaf1830", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775958896, "uuid": "789637df-9daa-4379-9bff-a028772b8ae2", "value": "Fatality.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9880e64-3683-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776007534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776007534, "uuid": "5c8185ad-c204-42eb-9698-fc9e5f54aaea", "comment": "Malware payload", "value": "8142007103374b5a7860739811d10043", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776007534, "uuid": "3a95afbb-a4e4-4940-8ffa-e27ea1afc208", "comment": "Malware payload", "value": "da65c30f4dee13d3c85c6a31386018d101d635e28eeb65ac73699787fecc20e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776007534, "uuid": "b0f06525-5b10-44db-81bd-5323f28de55f", "comment": "Malware payload", "value": "736ab1cf54c575f2bd48aa7f3065458d222bd284", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776007534, "uuid": "80e250d0-1bcc-4f11-a6c3-c9c16850e2db", "comment": "Malware payload", "value": "1615aa0afb527011f6087b470098762001e5cd5c4981f204b111bc2d684c3e73d3e6e71bfcbbffbf2f66dd7c4000ea43", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776007534, "uuid": "f915021e-affb-43fa-87f2-82ea898c201b", "value": "T1E315C056B3D403E9D23A5EBDC416470FC6B0F4024BB1EE1A14FA59892F4BAB6721F349", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776007534, "uuid": "c4372c92-24b0-4d20-b823-b4ecda6a022a", "value": "9b760feffec4fca9c313889f9a05ee36", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776007534, "uuid": "1487630b-814a-4afc-93c8-13b0c0347a56", "value": "24576:3SamPs8e1/0NQzqm+6Se5J0rwJVG/SOb:3SamPs8e1eQNb0P/S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776007534, "uuid": "a26a38fa-c1be-4cd2-9af7-f87f86e97be8", "value": 951296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776007534, "uuid": "2017ea52-0a4e-4027-835f-14c0d30f1a0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776007534, "uuid": "28920961-7e53-49ab-90cc-68ed37b3dcc2", "value": "da65c30f4dee13d3c85c6a31386018d101d635e28eeb65ac73699787fecc20e0.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38e64225-368f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776012418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776012418, "uuid": "9434ef0a-908b-41bd-b9a1-74b62efeba44", "comment": "Malware payload (Mirai)", "value": "5f9916e876bcb27e98498fad96d89b8b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776012418, "uuid": "cf04bedf-319e-41dc-91e0-b2c189d155f8", "comment": "Malware payload (Mirai)", "value": "db5f3a03ade2258715eb208894c881170690d2d6a9c36fcec86cc78c32ddd3c7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776012418, "uuid": "8b4539e3-0f06-494a-8ce9-621735a5ee67", "comment": "Malware payload (Mirai)", "value": "7187f40220f4e51a4429fe4d4717d38d81bd6659", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776012418, "uuid": "dd6caa55-82ab-4c8e-a8c0-326ea4a2a087", "comment": "Malware payload (Mirai)", "value": "fcf1e33cbd60daeb40b9ce07a77dd83a83528dce9f51afea7d62c6d8346e5a9052c28c6769dbafdb917178f467db87f6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776012418, "uuid": "f470b19c-eac3-4715-a4c3-84738992c7f9", "value": "T1898327C1BA4BC4F5D90748308067F33FCB32E6395065D65EEF5ADE69DA33602662628C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776012418, "uuid": "5192c18e-8e07-459d-aab5-e580ede4c959", "value": "1536:XlKTHE09UKYEVI0gG5dWAcDsWyAMnzGLAoGa1hnM:VIHX9U+VjggdWNv+zGL9Gj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776012418, "uuid": "7b542287-f5a0-40b2-be9a-617bce7fa50f", "value": 87696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776012418, "uuid": "62e0542a-369d-47ed-9617-d24454bdb488", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776012418, "uuid": "f5395181-57ad-4bc6-9e26-4de9b83ec914", "value": "titanjr.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18f2da46-36a3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776020955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020955, "uuid": "44a193a6-5d07-4b34-b24d-e62389faba45", "comment": "Malware payload (Mirai)", "value": "0d997b2e2dd461b85bb7554bdb4c31a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020955, "uuid": "4fdc038b-90b8-46f7-b194-cf8d26b4bc31", "comment": "Malware payload (Mirai)", "value": "db97b1b055716fbc65be3c0dc7233b78a1be70e0ce7b04cbf8c167321af88a80", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020955, "uuid": "ebe087f1-6ff4-4dd1-aa86-3512f19a04f0", "comment": "Malware payload (Mirai)", "value": "4c3e20537aee6d23fe8355948fa1145d6a2ffe1e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020955, "uuid": "af1cd8eb-90d5-4018-b2bf-e4cc278a078c", "comment": "Malware payload (Mirai)", "value": "996105ca99ede2f119e35e02af48a64b53df6223c329febcb2db465f60be3e7708ba84480ac8682d73b7fa4e7d9666ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776020955, "uuid": "3c7fbdf1-73de-4ec9-b4ce-00a37a38deb7", "value": "T172C4BEA7F2261F03C4E3963F256782A45373E60627928705B70AF5B83ED52799F0A3C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776020955, "uuid": "e691ed91-7cbd-4709-835d-67decddf55cf", "value": "12288:cRKXkGTQ8h1pc2vLvKed8Kw8ppwRrxSVU19HrwRnZ:mKXVTtrcI4AU1FrwRn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776020955, "uuid": "c1313033-d070-49d4-b188-d5677059e34a", "value": 596360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776020955, "uuid": "2e960c59-dcd5-4efc-909d-7c2c0c8cf849", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776020955, "uuid": "05a7bdbd-5880-4a0c-904e-2cf748067a3e", "value": "armv7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e5ce580-36c9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776037258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037258, "uuid": "a0b01dd5-d5b6-4d56-ae5e-cc097c0d6251", "comment": "Malware payload (Mirai)", "value": "e410948c4d1eea537fb743038850f120", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037258, "uuid": "e0048235-0a48-4018-b9b9-9e109ac1968d", "comment": "Malware payload (Mirai)", "value": "dc9475723bbe500db0c2d063e1a1aa646ef1991cdf2cb9fe53e29a9501edfa3d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037258, "uuid": "2f1be868-36c1-42c5-813a-6da6984d67ab", "comment": "Malware payload (Mirai)", "value": "468821b38340d6d5356733f75c9a7e8034c8c700", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037258, "uuid": "2a81f8b4-ee98-4435-bb7d-2d9268ff555d", "comment": "Malware payload (Mirai)", "value": "77dc687fe9def187053848491dd164c2d55b01b8ed3ade5c265fa5cd1e22a68928bce8c6a4c26e4c7a69ac816f8568a5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776037258, "uuid": "5b46d3ef-7383-45d8-a85a-2a9813455043", "value": "T1E7935C45FC818622C6C5137BF76E268E372663E4E2DA3203DE25AF2137C659B0D77A41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776037258, "uuid": "2c323df6-2beb-4b48-b4a1-94b619255bb0", "value": "1536:M4ESq7NPYbnKd4ydmED4PvNnuq4mOlcGiELvKuA:M4ES64G/qPvNn6xzKu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776037258, "uuid": "8ad1d59d-9638-4737-8486-045096ed4a3c", "value": 95756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776037258, "uuid": "85a9a23b-25f1-4536-9ae2-a0565a006653", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776037258, "uuid": "454f1b65-132e-4b08-9b3e-040508066130", "value": "Hammz.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a672092-3661-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775992798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775992798, "uuid": "551ad40f-a2ed-4ce4-8750-32d09ae0b119", "comment": "Malware payload (Mirai)", "value": "bfde217d96dca8d495a4c4c96ea5e95e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775992798, "uuid": "46781ffb-e49a-448c-8f44-7f092f31c66b", "comment": "Malware payload (Mirai)", "value": "dccd478f4294bed4711863026d1212783fedba62f345ffdf61c1beaf32800024", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775992798, "uuid": "52dbc68f-5ad7-47a9-8db7-5bc90a8ca322", "comment": "Malware payload (Mirai)", "value": "765bfd34562d63af1dc68dc8f6e42d8859ce50b5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775992798, "uuid": "463c490c-f58c-4be3-9ebd-c8d6087832f9", "comment": "Malware payload (Mirai)", "value": "d3d427e77dc2db6473d81b6913dfafbc048973836978bae1e55b3a562dc712568d1bf630db23a02049d6fc57f517b75a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775992798, "uuid": "b4f2212d-3de9-4c6b-8a5a-9a53828242b0", "value": "T1BFA31A8ABCC5C702C5E0A1B6FB1F52CD375643A8D3EA7147CD19AF29274B85B0A3B251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775992798, "uuid": "4a0b07cf-5916-4ecd-81a6-068d6fcb6113", "value": "1536:0j3VgSyozdJWM6/gJj44SrT78ktLGOktSBwI6IP85gZo+n4b+R:0j3VgSy26/TprT78ktLGqnPOgq+n4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775992798, "uuid": "70a6c1f7-b934-4b26-bf03-92d7558c94bc", "value": 103820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775992798, "uuid": "006a1031-381b-4281-886a-97aa1c4b0000", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775992798, "uuid": "94c7f93f-166e-4928-a8e6-8f9073ebd503", "value": "splarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30d422ce-368f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776012405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776012405, "uuid": "422a381c-537d-47c5-898b-557b3fd1c369", "comment": "Malware payload (Mirai)", "value": "c4a5df3c724d9832ca9cd279ca0e301a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776012405, "uuid": "22c37cd4-1d6f-4aac-a504-8db3d9952845", "comment": "Malware payload (Mirai)", "value": "dce63ac00258991a419cab894133ac6a9b2792e119b730b8c35f26f936866ff7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776012405, "uuid": "6603e546-aa59-4a7b-9449-19c73d22c331", "comment": "Malware payload (Mirai)", "value": "c42a674ceb105db59606d9e4174f6dcd29dcab58", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776012405, "uuid": "d38f6e2c-a2c1-412f-ab37-f8dd59ae7561", "comment": "Malware payload (Mirai)", "value": "1759404956bc053584dc997aba6631913c5ec38b36376f658f78e69b2844ebf0957e63508b171fed3b01dc69a31a9fb0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776012405, "uuid": "e2dc82d8-6d14-4667-87f1-042b2beefa91", "value": "T12D934A52FD818622C6C126B7FB5E028D372663A8E2EE7203DD156F2137CB95B0E7B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776012405, "uuid": "2f429b83-5692-497a-b317-c7c1c1514b3d", "value": "1536:Iy34BZFRc9c31tfghj4InVHSAijIIC9/wsJsIMFZpDBeJCQsLvo0T1:Iy34BHRc9corBijNCRHsIuCCQATR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776012405, "uuid": "876b97b1-4c32-4681-8951-ddf0098fdd30", "value": 89380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776012405, "uuid": "ae9c23ab-871d-4e89-bdd1-30ce8310df71", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776012405, "uuid": "da409287-feff-4550-9572-0523d43cde0f", "value": "titanjr.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cac36ca7-369b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776017817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776017817, "uuid": "952b5dc3-adb9-4ab8-8d71-dbcbda19fb51", "comment": "Malware payload", "value": "a523262efcb36d53f580a29b6ad79ed0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776017817, "uuid": "5bee3058-d1b5-4dbd-801f-799e9594384a", "comment": "Malware payload", "value": "e12187d77f5e19e53e3ff9e9dd3913b3e7e7b6c410a571a6e01a263a53319a11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776017817, "uuid": "38cd75e0-fcf0-48d2-9044-6076ac0516ca", "comment": "Malware payload", "value": "77e16b371d1b49a67fdec7124ad011d1f2102fde", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776017817, "uuid": "e3a6d6bc-b71a-4f41-a1ac-94f2235380bb", "comment": "Malware payload", "value": "766f49bbf8690b1b8cc3111a004bec0a30df7ab8ff5bf17ac905f64b77522fa49ebde83b6e217326d2fb62495a193d31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776017817, "uuid": "1051dea3-ae3b-47a6-a79c-2cfd572b7ea5", "value": "T16F045B1677A910F9E0739138C9521A07F77278151760AAEF63A4477A9F233E0ED3EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776017817, "uuid": "8ee1881b-55de-48ce-bfca-da958131293b", "value": "4d3b6280fd28aa5171ba0084806cf803", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776017817, "uuid": "15ff0a12-1f93-4399-a1a9-a55f607e9791", "value": "3072:4l/Gu4d/VaxmvcMzuvPqzvxZADOBuibLZXc119L3V:4JqV6JMHdaqKF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776017817, "uuid": "f71d3df8-5792-403e-8d69-fec986d34696", "value": 186368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776017817, "uuid": "c9d7dd93-ed2b-4e49-a671-766f41d2c9ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776017817, "uuid": "1d915fdb-d39c-447a-ae6c-856a9386d731", "value": "wowk_netlock.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe5b02de-365d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775991275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775991275, "uuid": "5bc3a308-8de0-4c6e-b096-f66f65f8313b", "comment": "Malware payload (Mirai)", "value": "c8e3dc5ae2b1eecb6e54b36d4046f149", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775991275, "uuid": "14049049-1818-4fa9-9012-dd34c502edbe", "comment": "Malware payload (Mirai)", "value": "e1f985722037c5430194a9e973c557c3871bd23d41f505b2fad1e51ad135b249", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775991275, "uuid": "b3552e1c-ce49-4270-81cd-9831694a1a39", "comment": "Malware payload (Mirai)", "value": "5d5a75b4536f9138d60e9094b5ed36dea3c6b805", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775991275, "uuid": "bb379bc1-9d40-449c-9da5-6771c0fbd099", "comment": "Malware payload (Mirai)", "value": "909fbb96e1c4f5829e7f34fd7bab4134d8b0acbc4082ee186d4808412fb244de64fd90efc5596bcdc3fc46dd9a6b5524", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775991275, "uuid": "746815b6-cb4c-41f0-876f-e985e01d577b", "value": "T14E83B516BF605FF7EC9BCC7346A51B1528CC651E25A93B75B830D828B21B28F15E39B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775991275, "uuid": "47ad3b79-f0c0-4216-ac5c-7308afe7585f", "value": "1536:6w4pjQLOQrZHYxdGAopJpPok9Z5zty7d42+9:6w4pjWJFYxdk9w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775991275, "uuid": "8cac34cc-42fb-41fc-ad28-e1ad9101e289", "value": 86028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775991275, "uuid": "e109337e-9405-4dc1-8939-6ed5a9c1fda6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775991275, "uuid": "21f70275-5266-4c15-a21a-51fdda8aea9c", "value": "jew.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23f47904-36a3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776020973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020973, "uuid": "f8dc5555-8dda-4a30-a74b-2414aa5f638a", "comment": "Malware payload (Mirai)", "value": "4019196f62ae30f8cbe72f39d6708de7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020973, "uuid": "ee6d870f-99c0-4f31-94e1-86ca1e245eb0", "comment": "Malware payload (Mirai)", "value": "e2209ebe053639731e9b7cd4f31ce2b7af42d784f66f3b44227f9e567e1985e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020973, "uuid": "28a4c90c-4232-4d1f-bfe0-172e09f5b54c", "comment": "Malware payload (Mirai)", "value": "afdb89bc881014084959525e5fc2c0545ccaf99e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020973, "uuid": "b2579cf1-74a4-408b-b09e-6458fad3999c", "comment": "Malware payload (Mirai)", "value": "fea191bc19b82a0db56636458320cdbedee7d0bec5b5ed755b665b2a6dcc7b05696c202216ded0ac03d842d95e350ab0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776020973, "uuid": "971d7149-cb36-40ef-9e54-b05517e57b91", "value": "T1DD154C06FF405FEBC4AECD30492EC35610EDE8D796D5A62A71B88B8C7A5D31A4ED3448", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776020973, "uuid": "b864605d-e947-4949-b371-a4dbe70cb0ea", "value": "12288:5/wRedTz247uZgrMI0y3Kx1/PkinLxisuZrfpmiDaI4oRUxRXNPIlKulR3Iffh5f:5IkrMINQ3kinogIkISB5PAl3N2q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776020973, "uuid": "659956d6-92b2-4ed0-928f-5e6aeb503206", "value": 883168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776020973, "uuid": "e1dec222-c444-4137-a6fd-1666e1c3d1c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776020973, "uuid": "3ceac505-c307-4211-8680-9d9b25f95105", "value": "m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d73c03a-368f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776012399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776012399, "uuid": "e3b3cb4a-6e06-467d-bfbe-f808ef473e18", "comment": "Malware payload (Mirai)", "value": "acbad3702c7339d389ac5e17a8fe503a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776012399, "uuid": "323a9f21-e9f8-4d6c-bfe1-fae4544e723a", "comment": "Malware payload (Mirai)", "value": "e3a5f3449c079eafc122f3c2b488e51f75621fb603801d8cd00ebfcc384b4ccc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776012399, "uuid": "81838096-1406-4375-978d-bc37ad07bb58", "comment": "Malware payload (Mirai)", "value": "a8a2cd9ec7f505fb3b9d186de08c1cac988fec3b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776012399, "uuid": "34ac6243-1f13-4677-a321-f2ce1b11a04a", "comment": "Malware payload (Mirai)", "value": "dbd15819f312d6bda288ababc28eea7ed1eaf599315d95fda3d17e463d2b3e43d3cc0545b37572bec1614d5999366ad4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776012399, "uuid": "5aef4d6e-22dc-40d8-85dd-ef4d6f824403", "value": "T12B736CC6A747D0F4F8635572213BF7325633E53A1029EE83D769A932FD02541AA1B3AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776012399, "uuid": "980fb726-5ee3-4e48-898a-dcc8917f952c", "value": "1536:VFaFoDSdGELb2UmTNddZfBVbhBAO3p95WuyjcNKzhs9MJO+nD:VQLLdmTNdPfTheO3pzWuyjcwNK4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776012399, "uuid": "50bd79e0-993d-48f2-8139-e273012feb7d", "value": 80656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776012399, "uuid": "4a4a6b3b-84f5-4c97-8090-0562931ac00c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776012399, "uuid": "103fee1d-b65c-4705-a357-b665f67fe992", "value": "titanjr.x86_32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df97da65-36c8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776037179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037179, "uuid": "386ca3ef-d92c-4100-9954-781792ce4af3", "comment": "Malware payload (Mirai)", "value": "79a7ff9166d69f3fa58f34e67bc67a98", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037179, "uuid": "4e56372b-08a3-4338-b7b9-03d0ab807c70", "comment": "Malware payload (Mirai)", "value": "e3aaf6dbc1e0f2faac9211baa870e71a803a321f023bfe56a9370cc04e08f50e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037179, "uuid": "a5d43106-6ee8-4396-9f16-cb3f880ad3f4", "comment": "Malware payload (Mirai)", "value": "d03f184aab8bda610c49307cbc4eff4e315eb99c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037179, "uuid": "dfaf8163-05f1-4ca1-9ada-4fea7c738249", "comment": "Malware payload (Mirai)", "value": "687a6e64a39e3d81df5afe35f6020f1cf089509c2937eb389e850c498321158b9b96e73f1d037e0e2fe7ad60995134ad", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776037179, "uuid": "cb8fd01d-c587-4b88-9b68-8ce0f6933b3d", "value": "T1CB83AE62ED252864C19601B0B0A8FE361B23E5C056936FF717AAC776A047DDDF806BF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776037179, "uuid": "bca8cf4f-c135-4e93-a865-6e9f367b31f9", "value": "1536:Sm/PI9RruM0yiSY8KDBNV7p+U1ICAWnlwO+JL:Sm3I9h2yFYjDFkU1I2lv+t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776037179, "uuid": "c8790e4c-dfd8-4185-82d9-e31087caaef4", "value": 83580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776037179, "uuid": "fddd3dbc-8606-4635-b7c2-097a63cf3a44", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776037179, "uuid": "4450d2ef-007b-4219-8b26-143310aef00a", "value": "Hammz.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25a3d2a8-3649-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775982321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775982321, "uuid": "14902f95-7029-4335-bb29-f9ce45355af4", "comment": "Malware payload", "value": "92c11229121e7c5e90cd3a0997d3155f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775982321, "uuid": "2c86e758-cd8d-47d6-ae46-d853701498bf", "comment": "Malware payload", "value": "e3d794a4a3ea047ce75d00a145aa4d857f76bf8698c00631694d0e0337a160de", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775982321, "uuid": "34d42a9c-427c-4334-90a1-ecdac843b13d", "comment": "Malware payload", "value": "b552637757f5541f8d3538717c21acd95a542352", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775982321, "uuid": "a2313190-5d0c-4af0-b96b-ba0a5b978ddd", "comment": "Malware payload", "value": "202b195560eaeaa74f0d4a3b6a659918769a56235c85dcfcdcbe4cc2a024958a56ef454aafdd48a8f7bff93555d599b6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775982321, "uuid": "335b40aa-faec-41e0-8ec7-bdbe3a6e5739", "value": "T144B02BDB0242B830136301FD1111DC784019244E9E820A50F98344040708878619A511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775982321, "uuid": "7729e321-3bab-4bd4-8c54-9de6f0fa56a7", "value": "3:ZILTd7C+EgFN38f3TN26f3TaZsNF+qs:ZI3d77h8fRFfmsVs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775982321, "uuid": "f8eab4ec-fd0f-4089-b610-b28f9a5fe44d", "value": 119, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775982321, "uuid": "0efcd938-6c70-4860-956e-db0aa36e02a1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775982321, "uuid": "bb98ffc0-8ada-48d4-8243-6beec3694627", "value": "cgi_bin_shell_escape.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "438aa51e-36a1-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776020167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020167, "uuid": "ba094595-3577-4802-9afe-57e0ed8a8de4", "comment": "Malware payload (AgentTesla)", "value": "b342b6f72a31214085f58fce6a4bf70f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020167, "uuid": "d2c6f844-6ece-4dd8-a916-bec3be85199f", "comment": "Malware payload (AgentTesla)", "value": "e4ca434fb241974f51d5d97868563052a57f2e7786fd5941ac42d6a98e5fce69", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020167, "uuid": "7e8fc778-7c75-4daf-b552-1ee099ca4626", "comment": "Malware payload (AgentTesla)", "value": "fc6707a99d5c93a3f82bde589db2f4bd8c923e3b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776020167, "uuid": "7b8c2207-31c8-48ef-affa-6323226ffe92", "comment": "Malware payload (AgentTesla)", "value": "6d6764741ff4c543f3de972f9f8aad977e761177b0e33157b0398d28512a2fe1e147fc21225a5db1036f8feac8514e34", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776020167, "uuid": "72f1ccbf-1007-4378-afb2-c6e4ddaaf6c0", "value": "T17355CF0273C1D062FFAB92334B5AF6115BBC79660123A62F13981D79FA701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776020167, "uuid": "faacb904-87b4-4fd7-847c-e1dee2aef31e", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776020167, "uuid": "3b0bf61f-71b3-4e32-8d38-3a186e2ee05e", "value": "24576:l5EmXFtKaL4/oFe5T9yyXYfP1ijXdaX3ihRxjcPV8bn9:lPVt/LZeJbInQRaX3ihjAPV8b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776020167, "uuid": "357870d2-a990-457c-aa94-b7ea8a6dffe7", "value": 1283072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776020167, "uuid": "17aa7bfb-ac49-4f20-8894-ddac16a6a7b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776020167, "uuid": "10790582-1586-4f04-9e2e-5adad52436f1", "value": "PO G2605-3445.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "607de00a-36bb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776031383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776031383, "uuid": "bb64a8a1-74e8-49b4-ac58-4318b1572c9a", "comment": "Malware payload", "value": "4aec1f9f7f49416bc14a490260ee5e17", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB4.file", "colour": "#68624C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776031383, "uuid": "7bc4a2a3-c02f-4600-83c3-d45f80890fae", "comment": "Malware payload", "value": "e5929c73939fb69820a63bdc6e2a3014a405815840ec5b346fbf0ccb9ffc4fa9", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB4.file", "colour": "#68624C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776031383, "uuid": "13eff872-5754-4f64-ab01-5c8987f3c94b", "comment": "Malware payload", "value": "3c89c68195374a2ed0420897a23251acc456a98b", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB4.file", "colour": "#68624C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776031383, "uuid": "8ddcb5a7-f843-4a23-a353-b7400b6dc757", "comment": "Malware payload", "value": "876c05dc7938392fa81bca966a6d6a788c6808ab48f84909923e4e5d94d1fc9ba5549ecc6091e9b149a2b256a006d6c8", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB4.file", "colour": "#68624C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776031383, "uuid": "0fa53152-2371-45bb-866e-625f036d602c", "value": "T18BC63350B36555F9CC2781731F99E308C979E3F63781AF0B91806E1FADA362626134EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776031383, "uuid": "dfaae825-43bd-4b0f-8b4c-9936c79e265a", "value": "b5a014d7eeb4c2042897567e1288a095", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776031383, "uuid": "3fb2621e-4063-4991-87f2-16e34e17fa12", "value": "196608:+pHpqKWAIIbCYQrPyAwKsNgUQTsbk9d+lmXVffJ2BcTi+dSPZVVWsFj:+pH2/byABTsSzpfvT3AvVWsFj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776031383, "uuid": "1ca92ed7-5a53-4897-96e8-2644669f7ac8", "value": 11576177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776031383, "uuid": "30b8ae4d-017a-4f35-ad27-20bcbffd3de4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776031383, "uuid": "e33f8672-fbf7-422e-a552-4de9f9ab2034", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80b61b15-366f-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1775998795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998795, "uuid": "a343fb76-a583-4a08-89bb-b486eaad42e0", "comment": "Malware payload (Gafgyt)", "value": "994130096b31e34916fbfc8347e49098", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998795, "uuid": "58b8e5c2-9351-4998-81d9-00985efded60", "comment": "Malware payload (Gafgyt)", "value": "e5ad2b9e92e3b44793d50383ffa145126a3132dbf65b8324183d901f689def77", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998795, "uuid": "b1962a69-e80b-483c-b09b-d5412b512831", "comment": "Malware payload (Gafgyt)", "value": "b59a97fdb3ee616143b19f58e4a731307b225b67", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998795, "uuid": "d420b79c-1530-4213-af74-b3bc2e18a564", "comment": "Malware payload (Gafgyt)", "value": "4551a09be32663f7fa6b199eda7b30ee869c632e715cf217d91c66b39b3545a46cf2991d0334884acc6ae88058a73054", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998795, "uuid": "fe91894c-4292-46b9-a3bb-37e4c6e7e5a0", "value": "T188D31215EAC1A3CFB72590B36DC9930EA6010FACB2ACF51461266E6C029CF16795FDC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998795, "uuid": "54a50b1b-248d-4115-aa45-cc5f57dfb0b6", "value": "3072:yhNL3LhszrQclI09Gwf5C6FqzgoD/NY5O1x3U9:yL76LOw86Msy/Ngr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775998795, "uuid": "f922030c-4c06-4354-848e-304c14242ae7", "value": 130284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775998795, "uuid": "46524e85-d09a-4f7e-a4d4-73b36dcd9bb0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998795, "uuid": "86566559-8c25-41aa-a75b-1b24b17f45c5", "value": "redis-conteinerd-shim", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "325790cc-368f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776012407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776012407, "uuid": "5414aff3-1e7c-4253-974f-bcebab64269b", "comment": "Malware payload (Mirai)", "value": "3ac3178651caa20216360fea59814f3c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776012407, "uuid": "fb8979c6-4d85-477d-a53e-29ed683d27f7", "comment": "Malware payload (Mirai)", "value": "e788c70846e6df7caf57ec7e21c9495f6b4ea678a93039503d19a68c6ba5ea65", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776012407, "uuid": "cdc8e08e-3a0b-45fd-b165-94012f7e9d0c", "comment": "Malware payload (Mirai)", "value": "84286bd0e5bb17867c8eccd5192cfdccbc6874db", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776012407, "uuid": "439672d4-43c6-4fad-87ea-b9e7c3608ea5", "comment": "Malware payload (Mirai)", "value": "09be12d67c3013504d3cf682ad1ab8b6a180bb9b8819d84b9dbd8ad51ee15865d0821f57b1fc8f8eae47f549bd580742", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776012407, "uuid": "ce1e69fb-422b-4e6a-86ad-6feac41246f6", "value": "T101932852FD918622C6C116B7FB6E428E372613A8E2EE3203DD155F2137CB91B0EBB541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776012407, "uuid": "d3c4a014-04fe-44f7-be1b-14a9f7fa5949", "value": "1536:r66cjIgJYI3CXdp/vXzZnp+c9LByHGQSGuHBYd0r1oOL5PvMGx5:r66cjImR3CtHnpbV4HGQe2epNh5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776012407, "uuid": "495277ac-a5fd-45ef-a8d6-03f411e9fdbf", "value": 92892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776012407, "uuid": "1a52d594-b79d-404b-99c6-41abf679cef4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776012407, "uuid": "4b8d7dc3-57d5-4b68-92bd-3d8a37a96528", "value": "titanjr.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd25885f-36c8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776037175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037175, "uuid": "98d51bb2-9c28-43e4-ab24-14302fc068ff", "comment": "Malware payload (Mirai)", "value": "0efb6593b335013b38a936e1bcfd4d62", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037175, "uuid": "2930618b-aed7-4350-945c-cbc79713f13e", "comment": "Malware payload (Mirai)", "value": "e7e91c068ff5fc64d37c637aef49d4a9c3b608aac170e4c73fbea44e0bc28c18", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037175, "uuid": "da4ce653-c194-46d4-a13d-4af0e8295117", "comment": "Malware payload (Mirai)", "value": "25539c8e0e51307c1a9aa133df7aa3acd39cfad6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037175, "uuid": "5b835cfd-fdb4-4d27-b84c-4cbf99b77618", "comment": "Malware payload (Mirai)", "value": "62bc2ce2200c2ac7d5ad02cded07b9f572b72774351fc316826632daf5ee0eccab8dd00998881b25798c1c519de1139d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776037175, "uuid": "9d55339c-63d7-4289-a5fd-e9285ce8e293", "value": "T19813F12F660001CFE2E9D5389BDE03486E28064350C39DC87479F2478D59EECAE91BEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776037175, "uuid": "ec16d4a6-f53a-46b5-a740-99e1884dc102", "value": "768:YDlp8BmS4ydkRZZK1vD/SynMcysc4XmKn0HI9LPcRqdHYDYbLmEQm7wccJgGlzDy:YR6BmNDrZKRPMRHKmI9IRqQYXmYwcUVy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776037175, "uuid": "6df26fd6-e44f-4317-8732-e5fdcfb30ac1", "value": 43764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776037175, "uuid": "26ea15fa-5627-43bb-9622-62759aeef588", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776037175, "uuid": "973d7056-e10d-4359-bc04-0ac980cbffcf", "value": "Hammz.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "833b1ad7-366f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775998799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998799, "uuid": "053a2d94-e59a-484f-ad86-a83f3dc4d8f8", "comment": "Malware payload (Mirai)", "value": "67059131cb7a3114724f06f51bc9480b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998799, "uuid": "58c9c834-a18c-4136-b5bf-837edff9fecd", "comment": "Malware payload (Mirai)", "value": "e81deb508bdc9254999629a04029bda6c3304dc64d49b01826b2392a97575022", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998799, "uuid": "c9e7c2e1-f17e-42f1-89f9-76f592ea30d1", "comment": "Malware payload (Mirai)", "value": "c4a95d8b465436e322c72d3a7332ffc5aa88f3af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998799, "uuid": "939671f8-8c73-41fe-8a22-36bffa7b3c62", "comment": "Malware payload (Mirai)", "value": "2b037026180956d018e36c08e74a77b6421876f0338601d237d64612a89641dc6ebd4b5e2a6dbeae789f458d722984b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998799, "uuid": "5f436760-3678-4ddb-bcf2-c1d37f04d53f", "value": "T1F734CE97B60F1445CC2701F947CB9F8DAA2326068E2785EAAD0DB63F2A735DF24167C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998799, "uuid": "9cf6e8c6-3a04-4be2-9a24-310a276520ac", "value": "6144:c6Xsawy0vzyqy5gf+ahjBc0LOPoHzWCB4zdYrIq:cT9tyKf+apBcloHr9rI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775998799, "uuid": "173d1312-5ef0-4e3a-a51f-4e52fdf15a4d", "value": 239536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775998799, "uuid": "a1413ef5-64c4-48ca-8cac-68a7b6a74d2e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998799, "uuid": "5057c29a-7416-451b-9024-4cc47f204aa7", "value": "redis-swarmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3db5fa3-3644-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775980439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775980439, "uuid": "7486fd5f-d532-4cda-9e0e-4823a41027c9", "comment": "Malware payload", "value": "bc2ff89cdce9ffa3c1f35e3b8c56dd78", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775980439, "uuid": "f2f87d88-fadf-4a0f-9dde-8e0371aaf328", "comment": "Malware payload", "value": "e87d6ed194740280796554c213dc17de06e5df1fc20ce0b2016c587493a558f4", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775980439, "uuid": "ac3987f0-344a-4467-b300-e3203dff8ca6", "comment": "Malware payload", "value": "9ff0197374c81322dd54459b1e6480143bee86fe", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775980439, "uuid": "1a0d4149-eb14-42cc-b3bd-f1a47d3dcca6", "comment": "Malware payload", "value": "06bd1f77826f322116d3281c5607a18284b1abc4c06834fd952ea6f2f1e86a10997798af902f9d7159cac183293d4cd9", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775980439, "uuid": "74c144ac-b379-4adb-be9d-6fcefb3868df", "value": "T17107DF02F2FD01E8E5BBC178C6675517EBB27819172097EF52648A692F23BD06E3D321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775980439, "uuid": "d14d3599-b180-412d-964b-ff8128effa10", "value": "70d2e884fa127843c5bcbb53da86b6c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775980439, "uuid": "da5d6787-ec6e-4de5-9c41-f8d12e0ba562", "value": "196608:rdvIyQs3CY9eO8OwcPFGUeTZId/NN5+X9rhJtvtp+ebma6EwumUpd8MaKc7eLVmI:rdrz7whrlId/NNqhbHd6tumqd8wef3py", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775980439, "uuid": "610a1f5c-d50e-402c-898a-0fcaa87b4951", "value": 18332211, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775980439, "uuid": "af0de327-be9a-4e31-affe-b7fa9d39b09a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775980439, "uuid": "b8f7a693-a10e-4a22-beb2-12dccb554449", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0278101-3646-11f1-a769-42010a9c0008", "comment": "Malware payload (SantaStealer)", "timestamp": 1775981265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775981265, "uuid": "f204243b-3839-4760-aeed-83c0e7ff2c56", "comment": "Malware payload (SantaStealer)", "value": "1f7aa3a0425d198ff16df8e903d56aac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775981265, "uuid": "9a78ac78-edb0-458e-810f-abb08ea99e20", "comment": "Malware payload (SantaStealer)", "value": "ea28b85e97fdfe77335e8625586212f0df64ceee15c8290d17b75e6096694d81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775981265, "uuid": "7e33da04-9e94-4628-bc5c-b5342ae28363", "comment": "Malware payload (SantaStealer)", "value": "cc514536ad84fca256cb1e5f7255f18a6809e6d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775981265, "uuid": "6894be37-308b-4740-a381-167894bba9e2", "comment": "Malware payload (SantaStealer)", "value": "ef7176db1a3fd1b38127fd69fbcc4d3fb2528be582cbc98a0cfe3d80e30d0bb897859866e5f1c1fa7befda38c7a18a0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775981265, "uuid": "1c426b19-5f28-4fd0-82f7-19c22f1c0ae8", "value": "T16DC5029F31E62069F9E83330D47577B60ED2BD8A78E49E8CC694552C7E0D02D498E2F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775981265, "uuid": "32df9ad6-d52a-40e2-9670-05f199237fb8", "value": "f1d840d6eae17d90e2995a85b3633177", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775981265, "uuid": "88c6cace-1112-4864-873c-6d1c5a59ea66", "value": "49152:i795t5WNFN8llgHKWmBNzD+CnySA88RvCEOV70eM1VM6Wys:i795vWNP2lsV+f+CnW86CEOVEDjWy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775981265, "uuid": "a3c8df49-8647-49f3-b5d9-5eb2e86c4507", "value": 2696704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775981265, "uuid": "300e5090-eb40-4cb0-913b-f51900497bdd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775981265, "uuid": "2658fc7a-a6e0-47ba-a61b-3c37188f475f", "value": "4J8576A0E8V3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8769c4b-36ca-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776037999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037999, "uuid": "fe433c2a-f42b-4e11-9d4d-2a5236e06ffb", "comment": "Malware payload (Gafgyt)", "value": "349abe3137ceadde94312a193093eb2c", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037999, "uuid": "75509f58-23d0-4d7e-948b-a04f8a58ddb0", "comment": "Malware payload (Gafgyt)", "value": "eb3e9080f46e18844eba9fbcfe464d5656c684fec013133d98aa6be2e1363402", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037999, "uuid": "9dc9192f-d895-487b-b813-aff14c49b3e6", "comment": "Malware payload (Gafgyt)", "value": "cf900bbfb6c65861c167229082985e7b58d48db0", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037999, "uuid": "9fd42bc9-17a0-464a-b620-3d3bdfd95f6d", "comment": "Malware payload (Gafgyt)", "value": "626dc5b7d70755a522c2add9c2912cc4d92b4f4192ded2a4269685ba5ee94bf569d0b264079141a5a31e2589378b4537", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776037999, "uuid": "b121d6db-af39-4520-9a8d-1d7de122fe58", "value": "T1F6F34905E6408B57C1E2277AE6CF824D33338B94A3EB33155938ABF43FC27995E26915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776037999, "uuid": "0e06f00b-cdcf-48d8-8531-cee083a8a562", "value": "3072:T1g2/eINNlzx2kkQCMOaQcvBDYnyLRM/9q3tmFwfBxKQodn:hg2hNNlzIkk/MOa/VYnydM/9MmFwfBxE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776037999, "uuid": "a0658745-fa7d-480a-9ede-51f040dbe71a", "value": 159888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776037999, "uuid": "d28c1e57-9adb-4ed6-a893-913333360e6b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776037999, "uuid": "e358b3c2-ed7b-47c8-9c94-52012a1e6472", "value": "Sakura.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6f252b9-366d-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1775998027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998027, "uuid": "92719ddf-1d26-4f1e-85ae-bb3eabaef0f1", "comment": "Malware payload (Gafgyt)", "value": "cb31343d59c748540fed902306b79425", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998027, "uuid": "5c118abd-59b6-4078-852f-ecf129c7f193", "comment": "Malware payload (Gafgyt)", "value": "f04230c06e1eee118571f25b22a34debc45f5d05e88cd2f72e22c71c960e0877", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998027, "uuid": "33c30013-a9e8-4dbf-9b32-0fda449ed7d4", "comment": "Malware payload (Gafgyt)", "value": "e11c3d99b68de2f7413bda4eba348f549cfa90a3", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775998027, "uuid": "1e17a556-913f-4fb3-bbf6-5d618440bfbf", "comment": "Malware payload (Gafgyt)", "value": "c24bf725feea1d9998bdc856feb62bb28f33c7f370b3da1f735ba621fcf083fd4a83ddd8d297ba592fe2012ea37504bb", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998027, "uuid": "3202e5a7-6a6f-4253-b3b6-f39ecd8259a7", "value": "T10234BEA7B70F0454CC3701F447CBAB5D6A2366068E2785EA5E1CA63F2A735DF241A7C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998027, "uuid": "42e8a3ce-9ddb-424c-bd14-4669e9281bb3", "value": "6144:mTXi6KEbqJ9q+P2VKSbvySdYhJChTd659qt:mr3bG9q+PuKTEYyC59", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775998027, "uuid": "1346251c-7b98-402d-bc6c-5b798c5d57b7", "value": 239536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775998027, "uuid": "e133c237-5349-499b-ba62-26238089f13a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775998027, "uuid": "15c42026-2e9c-4698-89de-01c93a228908", "value": "redis-swarmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a81faf78-368c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776011316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776011316, "uuid": "8e71142b-5003-416f-8254-dbd08d18c3d8", "comment": "Malware payload", "value": "1d7b6b8f16501a238f9bf9f0d5083034", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776011316, "uuid": "bc9b55b9-7aac-4427-9c63-9aec9f6c029a", "comment": "Malware payload", "value": "f04b0c3a53e3af7699c30ab9adb4d60a71a7da6945cf0ae287a9f67675433a67", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776011316, "uuid": "a5d224bb-1917-4b73-8b7d-7b972f9af90c", "comment": "Malware payload", "value": "800afcf21098a11cf1ab327f14436d4ad74a8042", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776011316, "uuid": "bbc2545b-0df0-4620-aebf-affd40874c26", "comment": "Malware payload", "value": "6285368f7a08157e5ec4585fe1e2cf024ea7cd6b9270b08f1e4845ff3a2de55ff48d967c9d1074d8650e6d4aceafcf01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776011316, "uuid": "79d33cce-9e84-4715-894a-050651e479c7", "value": "T1B1D46B1166F503E9E07BA738C817530BCAF1F28119B1EB2A11E905950E8BBFA776F315", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776011316, "uuid": "54371d85-df57-4ee4-b528-5f5f672332d7", "value": "12288:RmRTlZmX9xZVLcftzbJF8PLC4/R5D5by3ked/:RmhrtftkPLCMEn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776011316, "uuid": "38183842-c443-4e7e-949b-240ca61a16f1", "value": 633856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776011316, "uuid": "2fe3381b-325c-4ff1-a08f-17699d053309", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776011316, "uuid": "211dcc17-ccda-452b-929c-7a32cdf8fdcf", "value": "f04b0c3a53e3af7699c30ab9adb4d60a71a7da6945cf0ae287a9f67675433a67.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6af9171-369e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776019125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776019125, "uuid": "03351de6-f829-4118-9aef-14d7b5ac8174", "comment": "Malware payload", "value": "9c3569ab1b596c498affaac0e106877a", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776019125, "uuid": "b449976b-de71-4376-8a8a-79a75eeee41b", "comment": "Malware payload", "value": "f0819642d941529893521f7afe4a44fedefbc867b8554b2145791a7dfab003d5", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776019125, "uuid": "a5e30d8f-91ea-4cbf-ba29-45196d529cb1", "comment": "Malware payload", "value": "d53430cdd84c3e3e4c608710a9d275ffe256c093", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776019125, "uuid": "77d1c017-7060-4a93-ab14-a93348d528d1", "comment": "Malware payload", "value": "3ccc50b3b417844c9b860e97c553bede34a3d112090fb0dd2520c2abe26a3b023098cb20d5a5a03b3b3824d0c571f5fc", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776019125, "uuid": "431a6e19-3483-4aec-a38a-c81304d28645", "value": "T1FE9402436E9035CE7BFD02674A680F4D17A815748C4FADECF6A172CE0AE790A7B805B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776019125, "uuid": "e49189f5-adaa-4a78-9783-ec0344d3680f", "value": "6144:iEd6GYi0AT91O8UAR2VbF6m9jifxKC/wo0bTlFY3BJ0r2IMWhP9hgx/6k2AAVNuX:iALYe9bR2im9jeR/mf481ngiskuH3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776019125, "uuid": "55cee0a4-3cfa-4540-a964-09b41ccf3510", "value": 417936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776019125, "uuid": "e112d428-ffaf-42e8-bb02-4c3e426be750", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776019125, "uuid": "abc70bd3-e74a-4250-a473-1afb321e2231", "value": "loader.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "273ab8fc-368f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776012389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776012389, "uuid": "22f8acd1-d29e-45b0-a8ad-6770cb7eccb2", "comment": "Malware payload (Mirai)", "value": "08517c5253a2b3a1f5092ff206e54cda", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776012389, "uuid": "820ff72f-b0d6-46f0-912b-3b1e0e24a825", "comment": "Malware payload (Mirai)", "value": "f247299a708d7bffd1ec9db5c224d87ca828ec70e1ab2f7a018c37ebf5a9a79d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776012389, "uuid": "397261cc-14a8-4b19-99b3-0434b906e81c", "comment": "Malware payload (Mirai)", "value": "6ac3274117eeeea6f25f019ff109a3ca30828168", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776012389, "uuid": "927267ab-a9cc-49d6-946f-45b6e43a5762", "comment": "Malware payload (Mirai)", "value": "030f8a827944895ed953ffcce40947ec97b7137206383e5afb0e5eb68e8026975869863e3b35ce552d86f7a74c5717c8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776012389, "uuid": "5fd76c82-dc2b-45be-9ef7-4cebab881876", "value": "T1EE334B02D5BC2A2BC4D0A27701A74363F2EA1B5545A4E64FBD264D4FEF543502ABB6F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776012389, "uuid": "b7b9fbf6-d27f-4905-a42a-6278c8202d04", "value": "1536:EqmNLqiESWHiPvIkHXceY/VzoYHqlFacR:EVxUYVDX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776012389, "uuid": "79948b80-7380-430c-b25c-9c78bed8ac1c", "value": 53400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776012389, "uuid": "44f69662-3057-405c-97c8-75865dced76b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776012389, "uuid": "e89da622-b2e0-4976-b2f4-e8ded0dda018", "value": "titanjr.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c78a265a-36ca-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776037998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037998, "uuid": "165ba4fe-fdd6-447d-8f9f-c0ef0d59b66e", "comment": "Malware payload", "value": "f582824d36e7d6c1d9606466af861244", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037998, "uuid": "935a159e-dc55-4ce4-922e-ff1a03fc7479", "comment": "Malware payload", "value": "f2fea1a11ac9ce7edafdab83aeac2ad5e8855ce46094731f89e436255bd7cda1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037998, "uuid": "5fed9a3d-a4e5-4267-990d-3c2a318994db", "comment": "Malware payload", "value": "98ef455928124e6444c2cfd4108aee7e48817473", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037998, "uuid": "d71ce2ee-8843-4a1a-97c1-faf15ff62da4", "comment": "Malware payload", "value": "86e02ef0e3ba412368d68e2c6743f8640233f69054a89feaa8685d87a1d3173b80606adc15e17d7cb993207ab3bd3574", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776037998, "uuid": "1fbf1ece-6c89-44a3-9ecf-38cb9a32767a", "value": "T173416255B19554F72509D033E70DF004B9D214FF18A4DD38309EEABDBFCE22451ADA6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776037998, "uuid": "e97c750e-83b0-4c43-8fed-a0e0cb98c9cc", "value": "48:eeB7Sqkea1ybGDU2DZpDfiFxqMn2SFZ/QMUcv1ttukAz+HISg3aLXXcwmQFAVnlk:iqkFybGlzWD92wlQOukYoISg3WLFAVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776037998, "uuid": "24ea1e9b-1f90-4fd6-b181-6eba378c8985", "value": 2151, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776037998, "uuid": "183e439b-b137-4d24-871a-b6eb0430faf6", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776037998, "uuid": "f8c5d997-815a-43f1-8949-5cd34711197e", "value": "payload.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3d78fb3-36c8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776037186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037186, "uuid": "e0f73d8a-1088-4e3b-9848-de31d2aeeda4", "comment": "Malware payload (Mirai)", "value": "28c07f0c3d79d5801ee80082bd520b70", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037186, "uuid": "6feaf91f-693e-44af-901f-9e715a2c113e", "comment": "Malware payload (Mirai)", "value": "f35a82e9c545a512ee70bc2f4f335626bfab43beef18092320af11e356421365", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037186, "uuid": "968ee00d-1ae1-42de-954c-7a87ad6b0c7f", "comment": "Malware payload (Mirai)", "value": "5482d7dbaf66d6e91f181b06eebb6a86ee9b19ed", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037186, "uuid": "aa5ff341-8a82-45ee-96e5-cf3e4ddde558", "comment": "Malware payload (Mirai)", "value": "fcddfb40da083310678d0d04f5984775235220e973009dd26339e6951d82f02c3c168c34bd93b8dd98a100f78109a908", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776037186, "uuid": "153ffdd2-44ff-4a76-b7d7-f01dd129d749", "value": "T1FF934B21B5391A3BC4E0943722F75762B1F543CA10A8961F7EB10E9EBF116D03A47BB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776037186, "uuid": "7e6b0099-bcdb-4a3e-b09c-d35fc7714a2c", "value": "1536:sGDLI5JOt1j8BycB8xNUg9jAv0osUt89Ym5pDk2PHti4b:/piYfaFi9YOBa4b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776037186, "uuid": "16b69ae2-1499-4d9b-b01b-0b7e0ff48b69", "value": 95016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776037186, "uuid": "184e1129-d71c-46d3-82c1-2fc9e4064efe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776037186, "uuid": "828eb4bf-2b8c-4529-a755-2942be7d1270", "value": "Hammz.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a5d843f-368b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776010837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776010837, "uuid": "36edc8e4-31bf-4e92-8bd7-23b3f7da1184", "comment": "Malware payload", "value": "d1a92fa9b855c1cca8f4d63651bbb9b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776010837, "uuid": "5257dfd4-f335-4d02-ac74-962884fb05af", "comment": "Malware payload", "value": "f431ff7bc59df48c137ef63839a5a2af520e0d3b28429468398e3b291f30d1e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776010837, "uuid": "568ca11a-a6e6-41ee-b80d-7a326d4581f1", "comment": "Malware payload", "value": "6be97689db017f8801e1f1536011b85cc7fd0f39", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776010837, "uuid": "296fe90a-8fdb-420f-a9e0-3af8a2a59c20", "comment": "Malware payload", "value": "57c44be1c6e57f831612003bb37445de8035de110c77e87339da10c5fc30fd25061b83a9b8bbc8ba3868c6e6f185bbc0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776010837, "uuid": "5535b753-e38e-42a6-a256-e6fd03f2dd79", "value": "T139D46B1166F503E5E07BA738C817530BCAF1F28159B1EB2A01EA05950E8BBF677AF315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776010837, "uuid": "0a11b14e-f0b5-4743-a883-c62848139ec3", "value": "d386edacb5bc531cae23e0abe0d5b57a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776010837, "uuid": "5a96c47e-772c-4098-81aa-a760cc9ed87c", "value": "12288:3mRTlZmX9xZVLcftzbJF8PLC4/RED+ay3keSy/:3mhrtftkPLCZgn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776010837, "uuid": "48d8e041-6dc0-4181-a11e-9f6f7fabd771", "value": 613376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776010837, "uuid": "8fa35c86-5b56-4c9d-93ff-f20444bdf473", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776010837, "uuid": "42d80fb8-0479-44cf-8bcd-06c9af8be8c0", "value": "f431ff7bc59df48c137ef63839a5a2af520e0d3b28429468398e3b291f30d1e6.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee6aa18c-36af-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776026467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776026467, "uuid": "66d78db0-2664-49a4-ba88-ab1a8e6cd465", "comment": "Malware payload (Mirai)", "value": "1b938b2276d911ad440680fe7becb59c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776026467, "uuid": "2c78c9a3-586b-4c7d-bc4d-cc06e96a9fbd", "comment": "Malware payload (Mirai)", "value": "f4ee55870257652da4b0979262625f3a67def54dbee4628a17e91f46cd2010b8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776026467, "uuid": "964b46c4-6e08-4d0d-a8be-65fa6c4a25ed", "comment": "Malware payload (Mirai)", "value": "6255ada6341c177abcae5ad6c4ea7808306346c6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776026467, "uuid": "f241cfbd-59e9-4f1d-b29f-3a932acc1009", "comment": "Malware payload (Mirai)", "value": "154b71e0d35003d1c1521f43dacdf6d2d303cefb4aac86191f7fffbf55938ad8503ba594d0a6978c0ea7d9ee9e7a82c6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776026467, "uuid": "4edcc263-3fed-45ff-82be-0e721605667c", "value": "T160E52B156F900EF7EC6FCD3356AA4B02258DA40622D53F36B878D914FA5B60F4AD3878", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776026467, "uuid": "af694e3c-9ff4-4be2-a878-c3a5cb22eddf", "value": "49152:qno9YUoRt8nm/XZQX33CQMCcunR2sCL9AtAomN33puvP+Zu:hY5Za+Kyfpu+Zu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776026467, "uuid": "2e943a01-7a54-442e-a94e-2172acac7785", "value": 3164412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776026467, "uuid": "dbd22433-4fad-4477-9f6e-d30cf0878abf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776026467, "uuid": "bd06e13c-672d-4cf1-a357-458b09871fc7", "value": "ciubuc_mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "046aee19-36c9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776037241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037241, "uuid": "4cde95b1-1c60-402a-a208-b20d9dc8ce24", "comment": "Malware payload (Mirai)", "value": "0903e5639d5013c4dce5e39e00bcd0ea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037241, "uuid": "f6968a4d-0c4c-4ef4-a477-ce1253e79c50", "comment": "Malware payload (Mirai)", "value": "f68a0941f015f64b403e6d3b9eea2daf1fa2b5a930c038efc55ea0c957bd5b9b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037241, "uuid": "8f3c3a5e-1ee8-44b9-9837-be87e5c73b50", "comment": "Malware payload (Mirai)", "value": "63ccb505ae09548fcb13e0042a9aa646caf4e5f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037241, "uuid": "7870c0b7-9dfe-4fb8-9f34-00640424d599", "comment": "Malware payload (Mirai)", "value": "aa6d38b92ec308223a139c2f37fb7fdd3dcc5fa6d007dae51aebb972cd7f87ce81a5c8c2ddd68ac372713a03ded610de", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776037241, "uuid": "d6fcbc73-9e42-4e6c-b1d8-590623f36dc2", "value": "T1ECA32946FC824B21C5D512BAFA1E318E331317F8E2DE32229E245F3177865AB0D7BA55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776037241, "uuid": "2fc3d6ca-39c3-484d-8c1e-ac250accbff2", "value": "1536:nMnXldeqcNZa5HkLtqvWHIXuSF4O7a7qagvjuXdDDuRiZMLx6HpBb7WL5xYWuN:adkLKGga7qagaMLx6JNaLvLuN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776037241, "uuid": "e999422d-ae3f-4cb3-9fbe-0957a3eca907", "value": 103904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776037241, "uuid": "e4d500a6-2795-4b22-9240-e875cfc06936", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776037241, "uuid": "531d69dd-7ecd-43ec-a17a-8f0d1211de44", "value": "Hammz.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68ce1da1-3629-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775968690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775968690, "uuid": "48dee2c5-836e-48e2-8666-0538922a6de3", "comment": "Malware payload (Mirai)", "value": "b2a8ff96dfe651057f9d9ed8425c23c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775968690, "uuid": "44539ef5-97c6-45fa-9036-333fbda080c7", "comment": "Malware payload (Mirai)", "value": "f6b52f4dfe4fbffe0f7322b6290bd60bb99830407ef4345584a6075d18f4948d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775968690, "uuid": "0d0349e9-73b2-4c1c-adb4-dfe6a07e47e0", "comment": "Malware payload (Mirai)", "value": "7b6773e5f4bec7343559fd31c108e275c1f30c20", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775968690, "uuid": "2471fa61-044c-40a9-9287-e0858ff82b66", "comment": "Malware payload (Mirai)", "value": "99347f09831feac5e470686dc1d4fd0db024a181ecfad01800ab1fb7e9a02d1b3f84743355fb1fcdd90027bfd56a0109", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775968690, "uuid": "d3477c44-4208-4839-8e39-500a29186612", "value": "T1F7B56D99EE0E3D42E3C7E27CDF4A4BB03137B6A8E32281B37952425DC0DA9D5D6B1215", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775968690, "uuid": "fbbdf395-afc5-4b38-9bb2-c3eacc1d328f", "value": "24576:KxD7W4st4avMIjwTJU3cctrBiUKaUtLW13p2aMKCww8Xij/Wf6d4LfP3wgOB5E4A:MWV3v8VuwHBKPeyET4dt4yPc07P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775968690, "uuid": "56f78ac5-0db6-4d28-8161-1eb40e195dc0", "value": 2489264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775968690, "uuid": "f237307a-024c-4ba3-bc77-390f7bd217dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775968690, "uuid": "b5210d5d-00ac-47cf-8f02-4720cdeaf0be", "value": "ciubuc_aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d193a54-3689-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776009875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776009875, "uuid": "e85c43c1-a824-4b7a-9beb-fd1063b0f8aa", "comment": "Malware payload", "value": "2f59a0933228bd4ac5e45f0ed508318a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776009875, "uuid": "e05f2be9-464e-481b-bcf4-710490356f91", "comment": "Malware payload", "value": "f74d052337110c6282f4d9738263b89056d0c89d131b329d5d4e3189b67206ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776009875, "uuid": "ba07525f-5d86-4934-b593-6533f0c73e2e", "comment": "Malware payload", "value": "a97db430c076d50ffdf0fcd37e7a1a7c2ccc4d32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776009875, "uuid": "b92067e3-92f7-4961-b2f8-bfc47c2e1dc9", "comment": "Malware payload", "value": "257458318acb804402866644453784787105ecabbcbbdb4502b795c2371c7dd24d113d5e8e4f696775e8406f9965bdad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776009875, "uuid": "245ba10e-c545-4ea2-acae-2df366349f78", "value": "T1DBD47B1166F503E8E07BA738C817530BCAF1F28119B1EB2A12E905950E8BBF6776F355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776009875, "uuid": "f0c77670-f91a-4ba3-bf11-bff962f934c3", "value": "d386edacb5bc531cae23e0abe0d5b57a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776009875, "uuid": "b3863e3e-3e20-4d99-9a6b-07c5e088376c", "value": "12288:3mRTlZmX9xZVLcftzbJF8PLC4/RED+ay3kex9/:3mhrtftkPLCZgn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776009875, "uuid": "4b7f2c2e-919b-45c0-a473-32b5ae054e33", "value": 613376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776009875, "uuid": "3237ae9d-85e1-4977-9621-4503d7a1b829", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776009875, "uuid": "bc8e69c4-0f47-4c3f-ab0f-6942bf8987e4", "value": "f74d052337110c6282f4d9738263b89056d0c89d131b329d5d4e3189b67206ae.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f16a5f39-36bc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776032055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776032055, "uuid": "9e372ba4-dd3a-4294-86f9-64bd84827b1c", "comment": "Malware payload", "value": "b4263db99b0d01d92a32cf99adcd3e60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776032055, "uuid": "1b2041e6-1a5c-4f79-af87-665420cc1cad", "comment": "Malware payload", "value": "f76c31ecdafb59279833f17f350d9c2b1317da269823097e8dd1736c72449c88", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776032055, "uuid": "59649498-3513-473f-9eb9-570cef8d1f33", "comment": "Malware payload", "value": "1930771ddbb704a3c42ca503b4d33215f7cd4e09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776032055, "uuid": "8af302dc-78f2-4421-a327-e5765e338818", "comment": "Malware payload", "value": "5ee4d4b876a1844f5a1aff9394024e698027718d400d965d0575c1465cd77632e5d652f57cf72c07f4cda5d02247a854", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776032055, "uuid": "5b36f36f-c7e5-4ab8-a829-ede292a99506", "value": "T12F137C69577C5E33CA5F0EBCA8A2129707F5D2266042E38F6CCCD6E81A823DC05493E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776032055, "uuid": "1a24a30b-92ea-41ca-8865-6d18356c7578", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776032055, "uuid": "98a78529-0115-49fe-8e91-aa4f08161124", "value": "768:jJG53MejpXnTPrkENDhGEWAK3KthKegV+qzji2dVEFoC1fHYi/5AL/:jwVXjpXTzoV3KthIQqz+iVEFo2fH7U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776032055, "uuid": "ec3a2a56-b2c4-4594-8bd9-ebab01d5a0f0", "value": 43480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776032055, "uuid": "7e2a642d-1d35-4767-9ee8-9e326279fcb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776032055, "uuid": "f622a6df-1a42-4df3-a4b0-92965164b891", "value": "java.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cfbc596-3688-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776009365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776009365, "uuid": "e3d052a0-2634-4d65-b58c-6fa5d140f562", "comment": "Malware payload", "value": "d899a4f3153f3e1fe6e6c06c4424383f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776009365, "uuid": "bd919cb2-24da-421f-92c8-26b4630cb14b", "comment": "Malware payload", "value": "f81e14ac7309019208529599a848c2287789f0ccbcd2f7609e9f239f52376763", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776009365, "uuid": "84b69fde-bb79-460d-a0b4-f3dfebb4dd34", "comment": "Malware payload", "value": "bc582907c6861fdeb9dd59642ffccdc62f6262a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776009365, "uuid": "9f22c6cb-387e-4382-a5d0-e0a117e3229b", "comment": "Malware payload", "value": "783dd9cdf5fc6f83bf65fddbe737e0fde1dbf1762a13c58d99b0dd2c4a02c809764bddc071d598f067b36b8ffe4475fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STX", "colour": "#E0BD30", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776009365, "uuid": "ac5f5829-8bed-4982-8ca1-e8d606e43903", "value": "T113E42365F5264FEDC22CE73DE48A0917F716A611F874274E5BAAB1413E1FB18A0BE600", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776009365, "uuid": "081025fe-aed5-4abd-9bfe-1975e4e536cb", "value": "9b760feffec4fca9c313889f9a05ee36", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776009365, "uuid": "eb482f8a-e187-4161-a0c1-118d08ae29d6", "value": "12288:483yNxxLAfRP4OmKBi1gBTABqH2oGRxwupyfxxLAfRF4W22BiniBvAjMd2oGRxU:93sMflmKBi1gFdaxwuKMf122BinixPwS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776009365, "uuid": "bcc67406-0db8-440f-8533-a9424bf8b9a7", "value": 702464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776009365, "uuid": "567370a5-12c7-4705-a48f-0c87a6f552a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776009365, "uuid": "7559959f-0c3f-475b-8cba-93b450771d26", "value": "f81e14ac7309019208529599a848c2287789f0ccbcd2f7609e9f239f52376763.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95c543f5-365e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775991529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775991529, "uuid": "9157619a-9296-44c3-be7d-763206ea1cab", "comment": "Malware payload (Mirai)", "value": "801a684fc18266745f92ecd2d284ad74", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775991529, "uuid": "d399026d-c98a-4c1b-a834-4fe637eacb17", "comment": "Malware payload (Mirai)", "value": "f8e6b423c78e5e01f17154dfaadff17e88e9b95be37fb8ba158f3eb2ac883aa6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775991529, "uuid": "2138d10e-1cdf-4025-bfb9-7731dfe63d97", "comment": "Malware payload (Mirai)", "value": "7e1f9dbbb441f8324e3d891d9a811ac94225bac6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775991529, "uuid": "4b9fe560-d818-41c4-ba98-95ebbe01340c", "comment": "Malware payload (Mirai)", "value": "ec71ad5e10dc41cbe6d0d82dca9ade96c1e2fd2ebc282224889cb9b2b0e87f6cea3bf3420877ca36893c2f88938fc1ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775991529, "uuid": "09b2713f-8897-4bdf-be94-88899dc5aa2b", "value": "T193436B23D93FAFA5C14652B865A24D301F53FC0989A79EF9AA819FD41007AFCF5083E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775991529, "uuid": "f623a2d6-ba30-46e4-a702-c3427141f25f", "value": "1536:P7dIsToytwtd1fGGX4WYN9F53Y7ImV1Ckod42+:P71ToytcOZN5Y7ImV1G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775991529, "uuid": "ba891de0-f0ec-41fa-8073-e25454e21b75", "value": 57080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775991529, "uuid": "524c7ef8-2d8f-4c17-9c6f-99c4a6bff768", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775991529, "uuid": "ec28cfbc-e1ca-44d7-8647-9cda499da63f", "value": "jew.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6329f4f-367d-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1776004898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776004898, "uuid": "83e0b0df-de77-4760-b66e-4404d96cd3ea", "comment": "Malware payload (Vidar)", "value": "51c154be851be468efc4223ed1e8e58f", "object_relation": "md5", "Tag": [ { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776004898, "uuid": "814378ca-ab4b-4fad-b77a-66f646840c23", "comment": "Malware payload (Vidar)", "value": "f90c6b104dee5d4e59f8d6c10b2be3c02d052201bdce9c2134035c9ded077945", "object_relation": "sha256", "Tag": [ { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776004898, "uuid": "44318804-a4a5-4b1c-8854-d777523cbde9", "comment": "Malware payload (Vidar)", "value": "5198f6bcd9c0acc100cb196efce09e00367d3048", "object_relation": "sha1", "Tag": [ { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776004898, "uuid": "c92dd754-39f7-47a3-9386-3c3de103cd77", "comment": "Malware payload (Vidar)", "value": "44e0fc1ceb3f3454437fe2373e34ac9fa3d59613d20c4caece4f4a4290577189b3ca20f566dc5b0585a4762d45c4b931", "object_relation": "sha3-384", "Tag": [ { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776004898, "uuid": "e226de37-dd9a-4145-bae0-5a657a07f0bd", "value": "T14B152352C6C0FCDCE846D0BABA4E41EFFD95AD6A1D29F51F5EB8A05034480A3BE175D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776004898, "uuid": "ad9fc1fb-3eb3-40a1-a046-7744d2bfda86", "value": "24576:Rs20JIGrpGJ5wlwNO8wb5n6s2ig0kcR3Wt:K2cMJOl58wbVkizjVa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776004898, "uuid": "166c0d45-8204-45c9-86c6-f906a974d089", "value": 878416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776004898, "uuid": "7dde4800-1f4e-4689-b2ed-1b96217d581a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776004898, "uuid": "b49d814f-8516-4830-be66-0a57a27fa619", "value": "setup.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c4e9d7a-3633-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1775972857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775972857, "uuid": "c97c2d76-3b7c-4303-b28e-f63a2df1d1ae", "comment": "Malware payload (RustyStealer)", "value": "1d0cf3a8b9d0face5629beb290291c7d", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX10.file", "colour": "#B80CE5", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775972857, "uuid": "6dceeed3-5ded-41da-8df9-f37297ddeb9c", "comment": "Malware payload (RustyStealer)", "value": "f9ec3083b6c8f782bee1ffd731df5eaae804214668794f6dd298bba3f460b3dd", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX10.file", "colour": "#B80CE5", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775972857, "uuid": "e1fbb47e-08c6-4430-b819-d1102074cb0c", "comment": "Malware payload (RustyStealer)", "value": "9875f6e2673c647b635958bba4a6ee6a159c76e3", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX10.file", "colour": "#B80CE5", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775972857, "uuid": "1501170e-c3f4-4ef7-a18f-4bfd267fa3dd", "comment": "Malware payload (RustyStealer)", "value": "ce90fb45db62674800da84777ffd8603f0880eace200e2a150c7356f914300095d517543c5878ce31fa6652d5513b25c", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX10.file", "colour": "#B80CE5", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775972857, "uuid": "36e1524c-3c5a-4302-97b7-05256c32f487", "value": "T15706235E6074AF24FD45C4306695E0A33B5CFDAA4527C46B0AD87B209D0EC3EEE6F249", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775972857, "uuid": "1614bd52-8175-4f71-8504-196512ae7e07", "value": "56720a0219cc1a5225b827e19e3be6e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775972857, "uuid": "47ace004-796f-4421-920a-9b3f7cc281aa", "value": "49152:xYl4pxpdjL082mw6kPvlY1lnIWiTegI+fJFp5O9pq1weXmIXkp8Qkbr+XW4J6qK/:w4pxvFhn6nvJjckwezUJkqrCwBC8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775972857, "uuid": "36c44d7b-9f63-4f2c-a959-5fd4273d1af6", "value": 3688960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775972857, "uuid": "2e70dc79-de49-46de-a561-e683301acfdf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775972857, "uuid": "47529143-5986-47fe-b7a0-eafb0b202484", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a3cafc5-368f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776012394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776012394, "uuid": "9bb0e080-4c8f-4610-b9a4-96d23ab5b801", "comment": "Malware payload (Mirai)", "value": "628d639fcb9a696f4b0284cb908e1ea7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776012394, "uuid": "bd0f7521-6df3-4930-922c-0caeed338696", "comment": "Malware payload (Mirai)", "value": "fa4d871b328a58008977b1c855d3ca2f57d143cbc117f0f33f217f2955e0bc4a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776012394, "uuid": "3228fcfe-d839-4605-ab9a-ab6fbfb4737b", "comment": "Malware payload (Mirai)", "value": "d6ed03a972b6667f300c6b2b5dca55101fe68f27", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776012394, "uuid": "eab5610e-27f6-4605-a3e1-1210c2d02333", "comment": "Malware payload (Mirai)", "value": "f55efdf9fdcab53c7f91eab7984dc4dcf0b3de98efdf870988e10346494e1a6528e272c8801d6534dd72804d3d852be1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776012394, "uuid": "f4fc153b-dda3-4538-8e09-53bc8b140c69", "value": "T16A935C02B31C0E43D1675DF02A3F27D1D3EEA6E021F4F689691E9A8691B2D361586FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776012394, "uuid": "d77f1298-145d-4a17-93eb-0a0923e127fc", "value": "1536:M4QrHilJu9T+drNU8g6LpzlgkcG7YetxwxqJKZ4YKRHjHcIMTvyC1rvReck9x5/:GmJu9TyU2ptFa4YU1M2C/K/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776012394, "uuid": "8ae04f3f-2c45-4e6b-ac66-2c58399cb001", "value": 92044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776012394, "uuid": "6cb309de-9b6b-49a3-ae31-b76734b921b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776012394, "uuid": "2b8f505d-1403-4b2e-be21-2797a40a84ce", "value": "titanjr.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c68b6ce3-36ca-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776037996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037996, "uuid": "6c7cd889-a169-4449-908b-c017774f08ee", "comment": "Malware payload (Gafgyt)", "value": "e4efeaaeb66e8ec5acbcfe7d645c2c2b", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037996, "uuid": "b8d14c61-c38c-45b8-ba89-8b9fcf221d3e", "comment": "Malware payload (Gafgyt)", "value": "fc108cf9e74c6882ed8b6dc1023020fdc61221ab7344e4c9815cd2639889f5de", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037996, "uuid": "d3c27121-7ab7-4322-809d-5ca09fd1f647", "comment": "Malware payload (Gafgyt)", "value": "e8fc79c42ce482b682e4956b0bc59c7609c335c7", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776037996, "uuid": "d5617cb2-8f9a-4370-8b2f-b8304ac9c601", "comment": "Malware payload (Gafgyt)", "value": "26314be437ca49f0ee77befe8951a27f40ec8ff1cd7879e973ddc880a38e18013f6e3b3fe7f967ec85a7f1283b64e7d2", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776037996, "uuid": "452a0f8e-97a2-48a9-afd4-f42615c109fe", "value": "T1D6E02648143A30738FB2C53713620DA0A1815AA56CC4D936D0D81DB6D4ACE0D710160F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776037996, "uuid": "a12975cd-f65b-4ca0-af14-b3344d6f873c", "value": "6:hbswOnFfl6xXcf1JaREKua9KZlAUbaREria9KZzv:p7UJaiXogaU+iriogzv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776037996, "uuid": "08804a20-ccf0-4739-9f5e-15af0f9f2ad7", "value": 314, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776037996, "uuid": "0f5059ee-a1b7-467b-b081-21a879aae5c5", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776037996, "uuid": "8e700deb-1a1b-4665-b6d6-eb11b0805f69", "value": "Sakura.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7d4544c-3677-11f1-a769-42010a9c0008", "comment": "Malware payload (Arsink)", "timestamp": 1776002350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776002350, "uuid": "b3aa570e-0f91-4ad6-952e-edfd8a9f298d", "comment": "Malware payload (Arsink)", "value": "01bba6dae6fd54ee5f27e03e89ac9719", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776002350, "uuid": "676aa0a2-a472-42ac-bad0-0a0182ff359c", "comment": "Malware payload (Arsink)", "value": "fd263056adfe6cb5596a11612440fa5d851b3b9bed34a481139c2206a6c570b1", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776002350, "uuid": "fba6695a-192e-45d6-ad46-78c4c50c3555", "comment": "Malware payload (Arsink)", "value": "5d6e1edfe066512d852c15b5e79508d20fd0135a", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776002350, "uuid": "cbf66079-58d7-4572-a529-c8553b558d12", "comment": "Malware payload (Arsink)", "value": "0880bd3da83abed9503694380811ddb382799612f1e1abc3e1573f25e25b3e93f517e64600f1c94741fa2641b263655b", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776002350, "uuid": "65241de5-fc33-4e0c-b013-048ca486a938", "value": "T1D67623424704223DF06BAABD338B43A5D7552E59E60DC4D2F66EF36823B7070279369B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776002350, "uuid": "90604cd1-5814-4348-8a78-144725ac1c80", "value": "98304:2XYrXYWBSwgCtxZiMkt2o4YU15jOJrMXJzLP4O8h74Iqy7iY0W0hV4c3CEmpom2l:YMpBSWtaooBU7EkDrgcM07bs2tT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776002350, "uuid": "b1470d65-89bb-4f81-b55f-02d92b1581f8", "value": 7173145, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776002350, "uuid": "ad9f466a-48fe-4a48-8b9e-5f4bc85fd47e", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776002350, "uuid": "dde6edae-b9ef-43fe-9e24-6b7aec018876", "value": "base (4).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3342a746-3613-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkSideRAT)", "timestamp": 1775959151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775959151, "uuid": "fed304cc-a843-4bde-b11b-4f2cf41c0da9", "comment": "Malware payload (DarkSideRAT)", "value": "ee2d4a5cde1342255559ec4023d15cf5", "object_relation": "md5", "Tag": [ { "name": "DarkSideRAT", "colour": "#E2B7D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775959151, "uuid": "847be478-88d1-4689-ae20-73218e5d823f", "comment": "Malware payload (DarkSideRAT)", "value": "fd2b7f9ade749c08cfc11a27d0fb5f094d044a59b11b17a8767ff891f89f55a8", "object_relation": "sha256", "Tag": [ { "name": "DarkSideRAT", "colour": "#E2B7D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775959151, "uuid": "bb51e30a-1b8e-4f16-a598-2ec5b2849edf", "comment": "Malware payload (DarkSideRAT)", "value": "9f851cfbbdad90ef490025590d3026b4b84cdc14", "object_relation": "sha1", "Tag": [ { "name": "DarkSideRAT", "colour": "#E2B7D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775959151, "uuid": "0b3a40da-2849-43a2-b8dd-e834854991b7", "comment": "Malware payload (DarkSideRAT)", "value": "170c0aa464e1afb45ab7e8527cc0db4a62d05a77b3bf27f400e13f0f1142d688243ff8f8aad2dc1faf1fe36fca4176a4", "object_relation": "sha3-384", "Tag": [ { "name": "DarkSideRAT", "colour": "#E2B7D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775959151, "uuid": "eef7b2ac-2f1f-4466-8b6c-48ab75602e38", "value": "T14836D145F1E9C192DD6F537C44AAC61AA0323AD44770B3D75A9A08E41E2FFFC0A79706", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775959151, "uuid": "b745cefe-64d8-490f-acff-b9f15db2bf29", "value": "d049318f16cdc785c2b66ace69544ea9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775959151, "uuid": "997feaf1-1c75-4ff2-bcd9-f29f9e36e07e", "value": "49152:PxF/pJvvTNgiYNXmA9VAxgnCAGYBhRKYmDDEje45+Yjn+oBLess9CNlbkYDm7POO:PxhvbtYNXm6Fess92tkYDmLAq3E1pv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775959151, "uuid": "bc425541-4a40-4bc0-8849-7a23e051df8e", "value": 5209600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775959151, "uuid": "4188f9b5-e5b8-4044-922b-ec334037344c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775959151, "uuid": "46053941-776d-489c-a419-e6630db99c85", "value": "MusicMiniplayer1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3561e362-368f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776012412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776012412, "uuid": "e93bfebb-ae72-4c9c-bb52-0d246838ad8f", "comment": "Malware payload (Mirai)", "value": "c0855b5855f1ba5fb9e7e054b697ee59", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776012412, "uuid": "e9e4ce78-607d-4e1c-ad4c-cdbb8420776f", "comment": "Malware payload (Mirai)", "value": "fd5b38774406f9c080ddd90ea7a234fa6c782a623117264d6429dd80b9c1da54", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776012412, "uuid": "3635f372-8daa-4e70-978c-b22a2ff7039d", "comment": "Malware payload (Mirai)", "value": "148a3674a1d571eb901d1af4ff6c0d1ff06eb34e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776012412, "uuid": "3d6023c9-7cce-4576-b9d9-df29cc250c68", "comment": "Malware payload (Mirai)", "value": "4e4a81fa27e7987cb8cd92898c1a8dbeddc0134e6b4be51228cbc20aa1532750f8a685fde81a56f430c00f28fc89f65b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776012412, "uuid": "44680dfe-0c71-4fc5-9053-8133ffd13994", "value": "T1B9936C85FB83E0F0D94605B011AFFB799631DD361014DE6BEB98FE72AD32602A11A75C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776012412, "uuid": "6035eec2-c15f-464d-8506-cd834089bf9e", "value": "1536:6wlkmqWBf6gew1FPIS0LJUS+8GG+/qoo54TU931QgHLA9D3Ur:9lvqWBflv1FPIS0LJUSPyUumAM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776012412, "uuid": "2a381eff-5f57-42f8-9b04-362ee90bc4b0", "value": 95444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776012412, "uuid": "9e71e1af-68a1-493b-98ed-2b3d802ed144", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776012412, "uuid": "abeee7cd-8e44-455c-80ab-dfd1c61ba272", "value": "titanjr.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfbcf803-3679-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776003196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776003196, "uuid": "c51eeb32-c1e3-4d90-b4dd-10ebf9cd2b22", "comment": "Malware payload", "value": "582963ef05b23d3a58e353bda6bf1596", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776003196, "uuid": "fedd2161-e66a-4eeb-b6ac-32b6ff335d84", "comment": "Malware payload", "value": "fda43cff6300292bda2cffb9bb067fec5ae714a4f277f7fc571f7143d454fd25", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776003196, "uuid": "275d01be-bd7f-443d-a25c-5847bbfdb9d2", "comment": "Malware payload", "value": "eae27ca2480050db8fecaa18ae46f7cd5d1fa458", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776003196, "uuid": "d3a4d78b-ede8-4746-8472-556f4242c7cc", "comment": "Malware payload", "value": "f2fff7bf4e450b32d0a7dbdd292af2df1185605d556028e6dfa60b9aaf83d96a4faede14441b0b7a138e2b387ab46fce", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776003196, "uuid": "7e017676-c974-4aea-aa73-eec58c442298", "value": "T144A5332015582B7EEC8D3E255F007ED7A967383B76A4061943A8C4C9DB1CE746ADF0EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776003196, "uuid": "574c2284-78be-4d58-97c6-c36dba482c22", "value": "49152:kgRMxpC2CE2C83Zvsr+1R20TZreBGZ4Y5fxQHArZxBk7B5RRj:vqT226rOHAtE7B53j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776003196, "uuid": "9bd7a45e-577d-4657-8b87-e16ff4677efe", "value": 2200238, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776003196, "uuid": "5724b7c7-b24a-46d5-a1ce-844ff4651edb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776003196, "uuid": "28f59f16-f566-4ad8-b0c0-28cbefc3990e", "value": "bober.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b31cb15-365a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775989659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775989659, "uuid": "8a53a518-c26e-4bce-970b-b3d24a474bcb", "comment": "Malware payload (Mirai)", "value": "6f7802f47c27d8c38869e7e304761aa5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775989659, "uuid": "15487415-8fc3-4e86-bb0d-2c591413c96c", "comment": "Malware payload (Mirai)", "value": "fe60cb7477ea67c5655ce362eedf2b8e9ae323d8770d60760a496876f560c9cb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775989659, "uuid": "d3a4ddd4-415b-4a99-87a7-b50f3e44b269", "comment": "Malware payload (Mirai)", "value": "64816968968e46f0974dcfeba2ea7a6c46ac435d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775989659, "uuid": "dfe6830e-cce6-4d6c-9776-df9ee6a2a7e8", "comment": "Malware payload (Mirai)", "value": "330884b4f01832567c3d6408abe652b5a79658479f23e3d696f53e5ff1865a70fe85309a71d4f6b58a0597a4dc215c24", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775989659, "uuid": "eebe4209-cb9e-40b7-98cf-16a9e41cec05", "value": "T1B4B34A21FD785C3BC5C0623A51E34630F5B643AA25B8DA5F7E631D5CEF14620312FAAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775989659, "uuid": "4de51849-b229-4f79-892c-7d634ec55580", "value": "1536:zSqGsPwnyGs2wF5kiiGO/Hk9HYGv0hjVcjR32aNWWD2Q+mcH7Mehmq:zBGsfn2WkYqBetNAXH7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775989659, "uuid": "e8bd9277-1889-4e40-99d1-a72d4200e042", "value": 107928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775989659, "uuid": "89dc8d54-a108-4af6-a746-290c8f1dce83", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775989659, "uuid": "c50302b2-c8a4-4f6c-9907-0a7e12d0aacf", "value": "splspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abcd3f5b-3663-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775993713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775993713, "uuid": "5b2ac604-2071-4d86-a295-280f6e112548", "comment": "Malware payload (Mirai)", "value": "e0ff2753236ce9a009cbcee836645a04", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775993713, "uuid": "c21fcccd-c858-4c54-bebe-966b1385f3bc", "comment": "Malware payload (Mirai)", "value": "fecaf42b84a51bee82faffb3594b1e00d436ee2ce5347e26f3983e10f1e2b1ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775993713, "uuid": "a8ead536-18f6-4ae7-9e41-df00130054b1", "comment": "Malware payload (Mirai)", "value": "551839e476c9725b8e1a978b9c0c1e68b27eb683", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775993713, "uuid": "5aee7e49-1df2-433c-b739-f1d1e13b5a14", "comment": "Malware payload (Mirai)", "value": "8bdad132cf9577e0d5e1c5a2f746bf765ba0222103408dadce49eb91797163c159dfa20a43d8dfa60bce362c3be4ee89", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775993713, "uuid": "1032fd33-55a8-4313-a4ec-7f0fe220079d", "value": "T16383C90A2F35CF6DFB5A827697F78E215644339626A1C245E16CFE021F7028D341BBB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775993713, "uuid": "f631c69a-2d49-496a-89ff-2571a512a111", "value": "1536:5o89L2T27mQaXcn6EyvRaQSjIHOVVU+6Y3zbNZtyQEc8LMk7d42+P7Q:5o+2TIaXIERaZjIHIVU+6ybNZtyHc8LD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775993713, "uuid": "7e9c94b8-3ca6-4ef0-a89a-cd1c3376358a", "value": 82044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775993713, "uuid": "c8458ed1-eafd-4993-bb0c-bae51bdcb15f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775993713, "uuid": "f3a28831-4484-4efd-a14c-0be5e0500048", "value": "jew.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2a61b33-3657-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775988624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775988624, "uuid": "ca2a69e7-ae49-479c-9c08-d688c0cee587", "comment": "Malware payload (Mirai)", "value": "19c3457a5803f3b1b8bb2cb68fd120db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775988624, "uuid": "e17fca36-5c21-4063-86cd-1678d84fdbdd", "comment": "Malware payload (Mirai)", "value": "ffe12ef5b7c080234d6d5d46f0cfca724faddf648e9c7615512a13f2bac2d471", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775988624, "uuid": "535bd030-1c06-494f-9a90-3074384d6e61", "comment": "Malware payload (Mirai)", "value": "ec4edcc77ea20dd76fd4848367887bf2ac5848d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775988624, "uuid": "cfaf80e5-b223-4ce6-a075-74614e1032fb", "comment": "Malware payload (Mirai)", "value": "bed921d9f39428ced83af0b410350bbce42a079c1563e0f7e0a518376928e1f6e48c4eee0993eb2f0cd72dd01a22e6f5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775988624, "uuid": "50001376-b6d2-488d-afe8-dddfc6ca0e3d", "value": "T1CFB56C47BB08B9BEF246733784574A0E34047F12C0815F23A2B5F5AD5E7A1A91F396CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775988624, "uuid": "dbb4750b-ebe4-4437-aac3-16d4555bc5da", "value": "49152:H6wXN2WD8Xu2Fp6r0oFNH0ZzqvvZbhrBk0w:H6wXN2O/govdvvbBk0w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775988624, "uuid": "d1be5293-6909-48bc-8f68-8797a94c7663", "value": 2322044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775988624, "uuid": "55858183-3498-40ba-bd96-ed88c9ae16a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775988624, "uuid": "16755516-1580-4c05-8a49-b85412ee006c", "value": "ciubuc_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }