{ "Event": { "published": true, "date": "2026-06-18", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-06-18", "timestamp": 1781827382, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "f11b13fe-52cd-4512-9247-c33da33226e0", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a7d1212-6ae5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781766872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766872, "uuid": "d6954bdf-59ff-4aa6-b986-02e6d7ab430f", "comment": "Malware payload (Mirai)", "value": "162a30d306ec2471176133ce8e97c2ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766872, "uuid": "5243e0d2-8c08-4884-9430-c525cea063f0", "comment": "Malware payload (Mirai)", "value": "007b45c37ac19b7be69ad82ca7a84bc92fe51d90cdd7729a2e27c3b120628673", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766872, "uuid": "b796711d-4285-46b1-bb63-29a084ca9768", "comment": "Malware payload (Mirai)", "value": "62d4e4353c62f131d21ba212611313d403c97150", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766872, "uuid": "be12b0db-caac-4462-a11f-7688cbddd5f9", "comment": "Malware payload (Mirai)", "value": "12578ec1356b8ecb3a9704e98ef8469df738249dd1d6432ccaec7debad5c6c64a1723253dde808bcc4c00933605fe99c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781766872, "uuid": "1a1861a0-3bb8-4582-a958-720a958a6963", "value": "T119E37CC1F743D4F5E90A41B03067E7369B72B539102BEF53D7A99E36AC929009A1B36C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781766872, "uuid": "04ebed5d-93ae-4617-9eb8-f98c1d9187f4", "value": "3072:WWujm7omI70KlKPFic1orlwlxrkn4nsCXjYlnl/k9gUMReIDxDzQGGPxy:Nem7omI774Qc1KqlxrknUtTYln0ClPQS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781766872, "uuid": "cd1b601b-6901-4ccf-bd98-227fef486e63", "value": 156616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781766872, "uuid": "eddf8bb7-20a6-4594-8631-7658b2208df3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781766872, "uuid": "4f03b8b8-408c-4501-8335-71aff269962f", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3027c56-6ae8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781768309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768309, "uuid": "a03c5d1a-548c-4c73-a5bc-8ea015ccf41e", "comment": "Malware payload (Mirai)", "value": "245be45fbf3bc39cbbaa7e1b706ad536", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768309, "uuid": "0a57ff1b-f03a-4072-b269-f6df98ac9fa4", "comment": "Malware payload (Mirai)", "value": "00f94e4708c87660ccc5c5399789f5b64c3f09855214cd0bb204ac4b95a4f6c8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768309, "uuid": "4b430a27-4850-44f9-b883-f80b37405b2a", "comment": "Malware payload (Mirai)", "value": "ce613d29db191f2b832af9c88c2ab52d4876fc7c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768309, "uuid": "fda2ebc1-576c-4f9c-9d81-789d929b699c", "comment": "Malware payload (Mirai)", "value": "64248bd71fc47a2a163216d0e3f19d83da0d5c71e29cee44831717087f1b308191af30574411709405a570341ddfe693", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781768309, "uuid": "a0236b78-ac2e-41ae-bedc-f9ffa2280b4a", "value": "T1BFC4D112F631CFD7C0160B7410E9E2344B1BFAE21372A680F3BAD2592D42565FF5A76A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781768309, "uuid": "5c8a018a-735b-47a4-ad02-f6519da3955e", "value": "12288:sWK/WtVhspseFCnODTfr9PSL1S5zf0Be5x47p8pNZcH:sYZODdPSL1wzfX48", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781768309, "uuid": "2a9cdd7b-00e1-4fb9-8cc8-f59ec41674ee", "value": 550472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781768309, "uuid": "7d9d05c4-22ec-4c21-84e1-6390f190f9ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781768309, "uuid": "5ad3843d-f408-40e1-a6d9-23149140cf09", "value": "kaizen.sh4_srv", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a7643ed-6ae5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781766738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766738, "uuid": "647d1963-de8f-4f90-9f0b-9d7f28dd9c4d", "comment": "Malware payload (Mirai)", "value": "00584d20a23508a02a93cda145020fb9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766738, "uuid": "97c015ca-d9c7-425c-b3ea-0d66e98ccc41", "comment": "Malware payload (Mirai)", "value": "013db1cb6c9fcca606bbe39188bf3f477283c46148a3358ddf43ce9b010d4a5e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766738, "uuid": "58f15edc-2178-4c79-bde6-cc05000d4b33", "comment": "Malware payload (Mirai)", "value": "9ec238193563a6f637d6c49dcedcdae6f25507df", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766738, "uuid": "7a1a6018-aa89-46b5-a9dd-75b3586226e2", "comment": "Malware payload (Mirai)", "value": "77d34b8427c01ec2621684bd1f789f314a27241bc218c9acafaad1e5964a0516e9bc0def2ee553cbb31f71ca1ac0466c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781766738, "uuid": "eea0bf87-4591-4400-a36d-827709f5f94a", "value": "T1725312CFC8965231FFC4443605FDF88E8D89F724491896695AC4BBBFDC847962630A23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781766738, "uuid": "1047b8ad-57eb-4498-9f14-924e1364bb8c", "value": "1536:FtCKbOKOv4mqLH/gS5MrGEB8E3s01rXPOZfFMNPZnouy8ryp:FVOKE4RH/LM6k180BPCSNxoutK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781766738, "uuid": "e4e828af-a00b-4624-b619-a80974d84d26", "value": 66160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781766738, "uuid": "02d14ee1-a805-46ab-becb-71ad0515641a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781766738, "uuid": "8c539e47-15a2-4bb1-b732-81d1b66218ba", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7119223e-6aee-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781770775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781770775, "uuid": "a794307c-5302-4b40-8928-edb9b77a2d3b", "comment": "Malware payload (Mirai)", "value": "2a9ef33fb1e0cdee362ad5faa1d685fd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781770775, "uuid": "68b266f9-42ab-4996-9a74-d4694cc03f0d", "comment": "Malware payload (Mirai)", "value": "019c9835a0d62eb6fe5c327e0612a4b53079ed6c47c0c2648c9e41e08d727469", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781770775, "uuid": "b6d1b532-67be-4bda-a626-f546051388aa", "comment": "Malware payload (Mirai)", "value": "a87e0dcab624e4d1910d41c4c066bd984f26794e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781770775, "uuid": "7377dde6-a967-4c13-8253-b8b288c976b3", "comment": "Malware payload (Mirai)", "value": "34dacea8cee692efe7ce038b9a2690c6be312cfb3e90617fc7676b89c77d73c707c1b3e950cd135896f3d23f68228438", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781770775, "uuid": "0ceecb15-20c5-4300-b798-3265edda5357", "value": "T10EB33942BD82565BC6D5637BBA6E568C336613F8C3DB3116CC124B243B8A92F0E73B41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781770775, "uuid": "0b1904f1-7c95-4644-af85-77f7bd9cccc8", "value": "3072:YvUtfx2dRRqD436ghKnk7di8aYY6z/aVM6xaKmkm:htf0AADh46Y6z/SM9Km", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781770775, "uuid": "4f4796b8-1c20-4e91-9461-b223e60feb0a", "value": 110320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781770775, "uuid": "cbb02044-9236-443c-a77c-0e5d8ad55c4c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781770775, "uuid": "110b2db4-8f91-4cca-8c1d-74536340cbf3", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7f048fb-6b0c-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1781783752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781783752, "uuid": "e0ebd31e-f6a4-4927-ad29-0d94866594ff", "comment": "Malware payload (NanoCore)", "value": "96afb4dd35c28e95613b49571fc1370e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781783752, "uuid": "d291c9c8-0b04-4a8a-94a3-ca74105618d1", "comment": "Malware payload (NanoCore)", "value": "03cc05b4b99fd3e65d611943677109c0fd257d03b951d8398c28978ff71d4a6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781783752, "uuid": "cc2ada4e-2441-47b4-8446-0a549f2a6910", "comment": "Malware payload (NanoCore)", "value": "b64ca0b1002bf9868b2a9f71c6c1ae2241ce1aa0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781783752, "uuid": "2f942316-ca99-4609-aaea-2177c69eeb49", "comment": "Malware payload (NanoCore)", "value": "2b95ff82f8c7d7dd46e35a4e66014d764965deca3074ffcf7d5eea22545e2c6562240baeca477c48fb8761c401131a2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781783752, "uuid": "37f85f01-5e17-4980-830b-b07980a87f85", "value": "T13614CF2677A94A2FE2DE86B9701212039779C2E2A8C3F3DF58D454B75F263E4060B1D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781783752, "uuid": "83fe45bb-b0a9-4789-ac4e-afc4464d6825", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781783752, "uuid": "160bab92-ec4a-40e1-8645-eaabf9259af5", "value": "6144:MLV6Bta6dtJmakIM5titzMM3/mpjxE7pzpTVQ:MLV6Btpmk2itoxizpZQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781783752, "uuid": "4861ee5a-e1fb-4346-b7b7-15d2dbd6d296", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781783752, "uuid": "9138c7a7-f045-4159-b36b-37a385e0013a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781783752, "uuid": "4d49e163-c58a-43ce-b6cb-f63899314835", "value": "survivalism.io.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a32e20c7-6b57-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781815956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781815956, "uuid": "b3bf319e-c692-438c-b0bc-163e99bb9e16", "comment": "Malware payload (Mirai)", "value": "109ed01bd54336285bdc5732eb9acd33", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781815956, "uuid": "997f2898-0f6b-40a2-a173-f7b66aff07d2", "comment": "Malware payload (Mirai)", "value": "043b5f1725612f19b65b14429f1eef6a03eca9eb2e812d84d9404f72c1dd9029", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781815956, "uuid": "c9e0e9d8-8765-4f6e-bae4-664de243fe34", "comment": "Malware payload (Mirai)", "value": "71deb03050790feb267db94647981919318ba557", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781815956, "uuid": "63b03966-582a-4565-b3b3-ada80f5796ce", "comment": "Malware payload (Mirai)", "value": "483a85701b054b5cbd7e6f62742f37c1f9c370b5944e622b95c2b364e165cd83d542dc6ab6b89b279bc3cdf4f2049401", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781815956, "uuid": "328d8c41-9842-4b98-9657-4c8fe42aac26", "value": "T139F4BFA7F6661D03C4E39A3F2567C1B44263E65613A29305A70FF6BC3AD62384F1A3C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781815956, "uuid": "40c16fd5-0fda-4fa3-b9a9-3f51c7b71630", "value": "12288:RZoX/5kJHLGMSQsYdPagNYz1uDBKcGzZlnygp9Ot/GKFIQHr6IZllqY0Lcbfx:I+HLGMHPaQKoWsdBFdHr6IZlsY0Lcbf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781815956, "uuid": "0ff42323-4506-4c50-8879-1c9b0236ba11", "value": 728788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781815956, "uuid": "d8ddb92e-2dae-42f3-b163-63fe1c788c81", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781815956, "uuid": "0fa5f739-1570-4a04-a566-ef448496f7ca", "value": "bot_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54273465-6afc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781776740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776740, "uuid": "372e332b-fffd-4a0c-813d-1db38beca95a", "comment": "Malware payload (Mirai)", "value": "8f8aaadd91331f0a798e74f219147290", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776740, "uuid": "169ef249-8003-4182-8b3f-d2286b1220ea", "comment": "Malware payload (Mirai)", "value": "04f83768601580718f8257858001e4a709cebe28ceaf00b809457fbb3290a210", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776740, "uuid": "3cffb90e-1e1f-4371-a9c0-428e5f30f57f", "comment": "Malware payload (Mirai)", "value": "1849df190ef5cb8c3f9b770680a05c612e002845", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776740, "uuid": "fd341bc9-5a78-48ce-93ae-7e3fab03555d", "comment": "Malware payload (Mirai)", "value": "1f53f0d79ddff05f7f5b1fef6da7d6f935293918ae0f3f0c63c94669228eed07c64b48423b95c95898940048f11a63f7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781776740, "uuid": "c3d84ca5-cb9a-46bd-8f9c-b376ab5483c8", "value": "T1B8242A45FD919E13C6D522BBFA5E428C372A13A8D2EE3107DD215F24378A96F0E3B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781776740, "uuid": "fc7f422b-e6e8-400e-8d26-7a51bd9cefee", "value": "3072:YQifqfu+/BcQ4PnK6/Pld08Xku6ka1qO0U40Ei0DSMEmtFzMR+98t:rifeVBN4HPldwuYUJU4070eMF/zMRjt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781776740, "uuid": "98bcd956-ae42-4542-b333-32bf202be3fb", "value": 211776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781776740, "uuid": "ee32c89e-02fd-49c8-984b-d50ba04566f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781776740, "uuid": "764a8914-75d4-4f14-99aa-a5eab34a2712", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42b730b2-6ae2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781765543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781765543, "uuid": "751a20f3-b49b-41e2-b169-9df4abfb647a", "comment": "Malware payload (Mirai)", "value": "b5d3f38d526745db35660a310b18fd3e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781765543, "uuid": "5d29f061-76f3-4f8d-981d-84617cf02214", "comment": "Malware payload (Mirai)", "value": "05714ba2f8092c8acacc59c3c038c4daf1041efa9c443878a5c9013bb4032886", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781765543, "uuid": "4f30bac5-2aad-40a1-8e69-414cd104675d", "comment": "Malware payload (Mirai)", "value": "f74b48db5967aa97fb283cd5c45669f427c7f492", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781765543, "uuid": "ffcb852a-6af3-4085-909f-570c6a0c2c70", "comment": "Malware payload (Mirai)", "value": "bc77a4c751c40c5b542db4984054ecbafa94900bdf8da4b1a899b43a2cbc65f37798772f3946ef451241d691f240a60e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781765543, "uuid": "de7eae20-02b4-4cf2-9310-6f6e5e65cab1", "value": "T1AF140906AF510FFBC86BDD7302EA0A0134CCB81726653B757674D928F64A98B19E3D78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781765543, "uuid": "11cce638-4d70-471c-a5f9-ae8be300b91a", "value": "3072:qLyz3ncbAh/F7ma/N0oMOO0Z3rNQYJNGcbX:qLq3cUhd7Ht9Z3rpJNGcb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781765543, "uuid": "6901c3a5-2585-4178-8964-58120d86de29", "value": 202828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781765543, "uuid": "4dc1f868-d77e-4098-9365-548d7d6d9957", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781765543, "uuid": "74180460-651a-4693-a951-b783bd1d3590", "value": "nova.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3d92e4e-6ae8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781768310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768310, "uuid": "e273ab89-ea0a-4c09-8521-eace22e86407", "comment": "Malware payload (Mirai)", "value": "157486fe70117d49425a38b45811f2f9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768310, "uuid": "7a19e455-130d-47e4-980b-1861c406b78c", "comment": "Malware payload (Mirai)", "value": "05ba5372d3e397bcdef813b2f278f1c80f8fc56a35a06626e2f90467452fe347", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768310, "uuid": "09a75f2b-f8ff-42f6-81c0-34da0285ca04", "comment": "Malware payload (Mirai)", "value": "6b4579f6fe0e7ebe8ea39e8c67e69832c3e5d634", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768310, "uuid": "7ba40e69-460f-4565-90c5-5fccb065608b", "comment": "Malware payload (Mirai)", "value": "03d373e58b45de0db171f181a277b1527415d4c01a013e87929e134f2a0fd475f8e99a136c3ded5039f4976d265f8529", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781768310, "uuid": "4ff8c31f-14cb-46fc-91de-fb8decb79bce", "value": "T159D3295AF8C0DE63C6D436BAB95E018C336257B9D2DAB0039E146F2437DBD9E063E506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781768310, "uuid": "cf323bc9-c1eb-4fbf-80fc-641b7fe3b887", "value": "1536:KKgRre08RdzoKqd64ONiioJGfJRbak8+AHG3XkhK0DBj0f3ucb+8bFQ0rSTyNZAu:KKcrKFSiBjRx6yooucptWRub8YaN46", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781768310, "uuid": "14983e70-4158-42bc-9cdf-93f0626f4e4c", "value": 140584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781768310, "uuid": "649d3cee-080a-4caa-8ea9-ee5041e71e3e", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781768310, "uuid": "e8609a90-1c52-4286-bcca-fd2cee542031", "value": "kaizen.arm6_srv", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcb1075a-6aa8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781740891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781740891, "uuid": "b6e2854c-0256-449f-82d9-a3e3cf47fb62", "comment": "Malware payload", "value": "68c791642d49ab5aabcb554ba5185899", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781740891, "uuid": "c5d45ba5-064a-4f67-9478-5aa629dded5a", "comment": "Malware payload", "value": "0641a46c9d209f423802b02f1fe1a17cb25a0a6997bea2d0c910d63c182283aa", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781740891, "uuid": "2cbdd489-95d3-4522-a23b-3bf112cfd035", "comment": "Malware payload", "value": "83f59b1c41486933c4202f3d7cf8174be9ba09db", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781740891, "uuid": "370e496f-f5b2-4755-9348-41425f8e14ff", "comment": "Malware payload", "value": "2ba9f54649d368f32046bcef1259880e55d67d198877a0dd19876187b90a8cebe1876bf4da68096961bca6d5b3348881", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781740891, "uuid": "d2d94fe2-ab09-4bd3-9d60-6e1ea29e939a", "value": "T1EB2140E294A8807B225967A3A47C0F88F8FBB10B6152A470FA161C4BB28CC54972B0F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781740891, "uuid": "89c6875f-d8c5-4f74-b60f-b26080672366", "value": "24:OZ1WmKIE33trxF71L43XGEhDyvopTrTobIfRURYtY22UbWnssFu7SL0a7SYKeFhT:OjW9IqF71L4mWyvopTnobIJGYtY2iZZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781740891, "uuid": "e7a09b64-4f34-4987-9ad3-3d76331bbe6c", "value": 1329, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781740891, "uuid": "0e81d63f-8697-41ed-9fba-d42f890e8ca6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781740891, "uuid": "bda61ce9-ac21-44ed-9621-3379eb600b2e", "value": "techs.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a841ad9b-6afa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781776022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776022, "uuid": "8802241f-bed4-43d2-9a6b-12fc4f1f14a6", "comment": "Malware payload (Mirai)", "value": "4c6d03e2416fef92361b5567e0715e02", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776022, "uuid": "20bc6fc1-2eb7-4edc-9b44-991d601521c6", "comment": "Malware payload (Mirai)", "value": "0742f4674b6257c87987cbdee14f1770af85a29775fa233aa20de2a5f1a72b37", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776022, "uuid": "8efaa31d-3136-4275-9449-01c84adf389d", "comment": "Malware payload (Mirai)", "value": "fd7bcec49155b5a9ed751152a66707e28d92141d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776022, "uuid": "36c741fa-d309-4b18-88bf-054ed30bfcc1", "comment": "Malware payload (Mirai)", "value": "20cd699c8e8bebc94f5e9b652d10f2c9bf0ad0d58dbef0dc7dfc4ccb445ebb92d9b0733741a0ef0f326c24abdfb7e0c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781776022, "uuid": "efe5cadc-c36d-498d-8b46-47353614e98e", "value": "T18E830235D6CDCA3DE07C8C346F600FE9B213A646E2B63466B0346DDCB2799084AB464F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781776022, "uuid": "a7b431b9-5a7b-4ebd-a382-070910c5d448", "value": "1536:iXtOwsCPPOJEGr0txPm7Q3tvYY2OLepjNhtzkh6PE1eQ+K3NwJiB9yv2T6wjFwz:iXE1EGKx+8Y4c5ks5KaJc0C6wjW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781776022, "uuid": "273809b5-b48b-422e-a1eb-d82c70def7b9", "value": 85532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781776022, "uuid": "7fc91027-08b8-49c8-92a7-f9ec959859b6", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781776022, "uuid": "d4830aa3-2f41-459c-9e18-df1b963033d4", "value": "monero.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ee99e8f-6b24-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781794045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781794045, "uuid": "3ea21cf8-fe7e-4aff-932c-25d32ab0a17e", "comment": "Malware payload (Mirai)", "value": "eb775273af14ef58fbc1f7d6eac17f7a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781794045, "uuid": "5dac52c6-6bcf-48a3-9c27-94c1309db23d", "comment": "Malware payload (Mirai)", "value": "098b6b4af50f2aa78aa07936f8a96b7121423f35f0579ec6caed668908d4a2a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781794045, "uuid": "ad3e4453-8390-41e3-a7ba-fdbcc2960064", "comment": "Malware payload (Mirai)", "value": "8ba392d5604fd8a27c13d3a05427b7fb846efa9f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781794045, "uuid": "d12ceabb-f3f6-4494-ae5f-9c440b322b96", "comment": "Malware payload (Mirai)", "value": "28fa366df723680bc4ec8dbba84c5241f9986444d4658de3f2ce63507650680bc98bc07e08382ed8ca6f78e23d3fff98", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781794045, "uuid": "35ea5e73-8637-493f-ad30-4a78ad117061", "value": "T162543B46EB404F13C4D627BAB69F4245333397A4D3EBB206D9246FB43B8779E4E62601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781794045, "uuid": "33a1bf6d-09ae-4697-9daa-888e12d56787", "value": "6144:ay7a78xDqtsv8lC4ejpa0veZtGxozbiUS1NMzY8Y4V/GPmPi2YxJs:k2qS2C4ejpa0veZtGxqpgNg/am6dxJs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781794045, "uuid": "e5f8d790-0262-4991-95c7-7a9134bd7e38", "value": 291463, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781794045, "uuid": "7147b212-3576-4dfb-82a7-aca8ca0d2803", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781794045, "uuid": "e1dd5282-8a97-443d-b2f3-e2ff8541a886", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7b5c054-6b31-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781799670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781799670, "uuid": "e784479d-9b35-4666-bf2b-b12d85f8d503", "comment": "Malware payload (Mirai)", "value": "d2e8dd90944963f9627e38ae99688763", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781799670, "uuid": "f70266f8-3338-4e0b-a132-4828a9967716", "comment": "Malware payload (Mirai)", "value": "09ffffbf9663571c580963579c874a0ac5fb1bffbf1aa05040de0530753f923d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781799670, "uuid": "bdeb8f8e-37d3-4ad0-9cab-b13a10b4800e", "comment": "Malware payload (Mirai)", "value": "aba2d1d49edaa78e15c5e541d65cd7c22f519a85", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781799670, "uuid": "f7246694-9b29-4cf6-806f-bf336f1789fe", "comment": "Malware payload (Mirai)", "value": "ba2f5925d2ea53f7e72085444cad9771016620d52be59e9aab9b26fa31f8acadd675aa02039451054f2f28cabf30798b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781799670, "uuid": "17930c32-dd73-43a2-b1c6-14e88ce51df0", "value": "T121042A45AA404B13C0D627BAF6DF42463333EB5497EB73069528AFB43F867AE4F12605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781799670, "uuid": "c473d91f-3b03-4cde-81ed-74354c120629", "value": "3072:ecq5Cd/qjq6XgMcBaf9ZzG2mZMXGBaF8g3vR+oiM/R8PdIuC:1qMdyq6QvBaf9ZzG2m8h8g3JniM/R4dY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781799670, "uuid": "dcf06ff1-3762-409c-a0ed-4f5f52df7899", "value": 183902, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781799670, "uuid": "857e2550-9d2f-4bff-8009-00c7f0b6b487", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781799670, "uuid": "638dd5c3-c16c-4422-ab42-5fceb89e7e18", "value": "main_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39b548cd-6b16-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781787862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781787862, "uuid": "aa47bb60-8a7d-41e1-82ee-0604296fe18e", "comment": "Malware payload", "value": "0e543abd76fae6c6bde3f362eae9fb4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781787862, "uuid": "1e613ac8-6c21-4d63-8bfb-539911073611", "comment": "Malware payload", "value": "0a62be276406106da3ec16a2f8555ec3c2c325647bbedc1591495e770617a400", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781787862, "uuid": "be1544b7-220d-4240-93ed-d9680a37c4c7", "comment": "Malware payload", "value": "c104e9b251f4ea36570597635caac690b174eaa3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781787862, "uuid": "d68b2b1c-79ec-4c1b-8518-e7693c70ecfe", "comment": "Malware payload", "value": "27e03e860f8433b51d4c98b3b794606c251fcd0d9c116deec972a1a97c00e5e2041f52f9df9e9e31a0a6d21b24b510cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781787862, "uuid": "8abadc7f-f31c-48ae-9af0-b83374e4cbaa", "value": "T126641C037F509692D19A6E718AF4C7A87330FD49AA52974B31E2AE1FFDD92C36D021C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781787862, "uuid": "bcbc2f53-f357-4a9d-b0a8-7d6ccffd9ae6", "value": "59aa8a4d305bcd18a76cabf8035d479a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781787862, "uuid": "cec0d686-06bf-4280-ab78-29ed310d82c4", "value": "3072:M/4I55DXdiBH4mDQ8t2hvn71+x3s4gFq:M/J55Rmrj2hvn71+WTq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781787862, "uuid": "b8cad8ff-9b38-47e5-93ec-84cd2861ba75", "value": 323328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781787862, "uuid": "c095ff0e-8ace-4e8c-98eb-2c3a9f7aa681", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781787862, "uuid": "cdca64ee-21a7-45c0-b578-e56751578741", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e51bb0a-6b33-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781800325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781800325, "uuid": "132c8f9d-5da9-48dd-a73f-d80d41cd2689", "comment": "Malware payload (Mirai)", "value": "8188d639f9a01b4bfb4a351588c0ebff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781800325, "uuid": "8790e51e-5a22-4ea2-acc2-3bbb40e3782a", "comment": "Malware payload (Mirai)", "value": "0be1e52e59f56b50c4e1e66e2b48facd0abdf4b2e465670ee747ac615af6d485", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781800325, "uuid": "51e48b0f-b888-4315-829a-47189e1ca21f", "comment": "Malware payload (Mirai)", "value": "a72067163ca258fff39eb18f9ea1e77284aaf666", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781800325, "uuid": "d498e7d7-f8f0-4811-80d3-36627282299d", "comment": "Malware payload (Mirai)", "value": "0813f3e0de946d0ab0c01da06a8be62d5a8a9a0f3a7825913f27e75d55b32234d275b99e10b83cce8a9978e6ba1a6710", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781800325, "uuid": "6fe5c40f-9679-4ddb-a64a-c4946ffcc242", "value": "T1B293E842BD429F13C1C621F6FBAF059D3B166B79D6EB3202D921BF9023868D70D76251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781800325, "uuid": "3f945ccb-aef1-41f5-a4f0-a6a39bd905ad", "value": "1536:4V4F+8wMvh/zTjmCon3rqMGbFCive+vkQWvW/DgQ8gdxMUZ4/5a:4VSUujmCon3rqlpWEkrvW/XMr5a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781800325, "uuid": "9e372317-d40b-4992-a56d-0a59eaf90dff", "value": 91532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781800325, "uuid": "80d90cd9-b589-4097-bc99-d7439f99dbf8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781800325, "uuid": "070bae01-cc56-477e-9b9a-e3137b5a570d", "value": "manji.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51a4b6ac-6b18-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781788761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781788761, "uuid": "f1c407e6-0fe2-464c-9b66-059707908b1f", "comment": "Malware payload", "value": "0c64a15a1b53ae66ac5210a6a0d56f59", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781788761, "uuid": "27e225bc-903d-4e9a-a4b7-ecf16507502e", "comment": "Malware payload", "value": "0ca79384887031895f4cba8166c03294796f6aff6ea1f70a4ddfad5048ce969d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781788761, "uuid": "5a244c60-9782-4b8a-9c2c-7f3a83a17738", "comment": "Malware payload", "value": "d6678db3d630f36adc52833a0f2a4c653e9619a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781788761, "uuid": "925678bb-867c-4637-9f61-6733aacc26bf", "comment": "Malware payload", "value": "64658908f934700c74e31dd0c59781436af3a0fec16ceef2c2dbd832ed2c5b45cc92c4dbd6c70a6c85fb15c7ea9f7c55", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781788761, "uuid": "163cb9ee-3a53-4ca0-abbb-34a332e1c8db", "value": "T1B5D4121473FD3A15EBBE8F7E19F090480E727E974E20D24C4D86B49D1A75B42A924FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781788761, "uuid": "d743e7e3-eab0-4576-b47d-17de81a7e58d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781788761, "uuid": "a8f234a4-811b-4e3f-a3d8-4d26d8ba6bab", "value": "12288:rB2DR3374rIkzE7tnXknXQaBFJi4RkTAJ0MK86WoLb66OPfD9piIX/:SL4kkA7lXkXDDuAOFhWSApi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781788761, "uuid": "51069c71-33bc-4552-907b-f0d70bc08953", "value": 610816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781788761, "uuid": "321e9b2f-e443-4b0a-afc3-ad67d4695227", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781788761, "uuid": "60c698e1-bad8-43ed-b2ee-d3f05ed1a078", "value": "0c64a15a1b53ae66ac5210a6a0d56f59.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab125131-6afa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781776026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776026, "uuid": "1569561a-0423-485c-b784-acbfd95516d3", "comment": "Malware payload (Mirai)", "value": "4f45f0e89e9cb4627be1ad43cd4ec48c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776026, "uuid": "fd2f413c-f502-415d-b21e-a226107882bc", "comment": "Malware payload (Mirai)", "value": "0d07cb0e763541a24bab200b2a807ae5a554518aef630c805325010c534fb21b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776026, "uuid": "3e9736a0-4301-4802-8f94-23ef6cdbf464", "comment": "Malware payload (Mirai)", "value": "779e15fcaf929b950e6cc485d29fa5dcc5c1d8c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776026, "uuid": "2303a52a-f351-4f1f-b5c9-1655e8746982", "comment": "Malware payload (Mirai)", "value": "4ad1af1f8514e0fee3e3eef2f54ce51d03d0b8342a4d3586af62a888f306f8bf1e55a4cc28296c1eff4be0b4080cb4cf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781776026, "uuid": "894cf9b2-30bc-4c47-b677-f6cf152cf5f6", "value": "T17883128885FAD0B4DC78F9B42106C19ED1FB92418FDD2C4AD31A0D52BB8236232D97BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781776026, "uuid": "ae568ce7-27bf-4ded-ab2f-f6da6760999b", "value": "1536:PqvSSUdscVh+A2klmqEvrcmbhG34cdU5xPtGgtokEWm4S6aJJSCxfE8xO5Zzx:Pq5wscVh+AFlpEvrcmwoxP5oka4ShJSd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781776026, "uuid": "2ed62b3f-3f3c-41b7-a11c-2efd3e464fc1", "value": 85676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781776026, "uuid": "81d61019-4ba9-44e6-9347-66fcac370156", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781776026, "uuid": "e5d2c043-3e86-403c-baa1-7bb6d013a85b", "value": "monero.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87b8ec5c-6b5d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781818487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781818487, "uuid": "7da9f4a3-091c-4c71-941b-56c42c39bdac", "comment": "Malware payload (Mirai)", "value": "3b8c3122cffd949d1b58de4d7d7c5b54", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781818487, "uuid": "69b6ffea-d7c2-4e07-a699-48a76e61059f", "comment": "Malware payload (Mirai)", "value": "0d652d94ea679649573f612899593f771f6605df3651e0fc327a2128952435e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781818487, "uuid": "c0472fd1-fdfb-4599-8dda-a2af12e96d99", "comment": "Malware payload (Mirai)", "value": "11888cea7dce5e659f20c8f88e3716b0762fdd86", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781818487, "uuid": "18b01063-b2f0-470e-83b2-28568ba1bc15", "comment": "Malware payload (Mirai)", "value": "6171c2e355cdd4284a5f4305b2b243d8571de761e6c40053d5ce632e4cb7de90a53c0e438bc1969cec149eae33cfbdc0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781818487, "uuid": "339a469f-42c2-4e32-b30c-4419e9c3fbe4", "value": "T1B9457D2BB2B2F17CD01BC03457DBC6A25531B07526363D7B36C4DA352EA6DE12369B22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781818487, "uuid": "36c93fa0-0249-4cdb-a2d6-c115c484e797", "value": "24576:XkV2mNgEAkbySkvg3vprKlzM+kovjQJko:Xk4mNgSuWrKlIHg2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781818487, "uuid": "e5677b16-7687-4805-9cc2-0c58a0657992", "value": 1170448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781818487, "uuid": "6fca59fa-21e7-4fa9-842a-f0b5c992cf0f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781818487, "uuid": "abc22fde-1f35-4664-878e-2db6f58d061c", "value": "bot_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6e75aa1-6adb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781762705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781762705, "uuid": "966019fd-379a-46b9-bb2e-c0e079b36e5d", "comment": "Malware payload", "value": "f85a47cfa8aa9795f9b8a37ebb29925c", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "purmed-ro", "colour": "#29855E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781762705, "uuid": "dad2584b-cd0f-4d33-a9fb-d5062c648d46", "comment": "Malware payload", "value": "0dd457b97dc92cdd6a4591af53eeb4c9ce0acdf806681d69ecb36c9cdd535e53", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "purmed-ro", "colour": "#29855E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781762705, "uuid": "2e77b69c-19e0-4055-978a-ee0329b03ea4", "comment": "Malware payload", "value": "7297add5893f4f28658796faf7e23dff0154091c", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "purmed-ro", "colour": "#29855E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781762705, "uuid": "50be61c1-7de5-471b-8355-e9bdf7b18468", "comment": "Malware payload", "value": "0dd410f66da8181b1176afbe0f05c22228c55e96ab28121baa32676033307e9ada270c3db0f2e0f5751d99a6b1813cbb", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "purmed-ro", "colour": "#29855E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781762705, "uuid": "90d35bb9-cffe-4cef-8f8a-6c33f95c6529", "value": "T1585164B4830A1FBED9CD0888D3823247D0FB3C8876D29D467B35A9521D6F2F45AA08D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781762705, "uuid": "8f475c17-8384-4c8a-bde4-ab6f5e0e101e", "value": "48:NoTy7ytT7WZuWLxUM2WeYkE54ihLcn0SRRB8kURosLN/YNg3Ul:NO7fWJ7pN5x2/qkU2hN8Ul", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781762705, "uuid": "9a37c31c-1153-44da-9b40-0c0fba328d0c", "value": 2732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781762705, "uuid": "5bd739ab-c77a-4c08-9736-7f6cde2b1b90", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781762705, "uuid": "2741f08e-39f8-4a1b-b796-bbf09805b455", "value": "ps1.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b92cbe43-6abb-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1781748992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781748992, "uuid": "015b0e77-2e72-4144-b077-d4fb946a74ae", "comment": "Malware payload (SnakeKeylogger)", "value": "e50903df6b58e0fc36ecab26a171af01", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781748992, "uuid": "019ccdcb-b185-448d-8b16-ab5bbc37ffb8", "comment": "Malware payload (SnakeKeylogger)", "value": "0ede0823018786b0b086803b03a0564866cee4d6a34c91b84cbb1c0f49122db3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781748992, "uuid": "8a85c540-acd8-4067-8172-cace5d5ff12b", "comment": "Malware payload (SnakeKeylogger)", "value": "0a64c60c956a383be0483c07624c8cc430b34a18", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781748992, "uuid": "1093c48a-51b6-465b-86ac-b7eb7fc3fb39", "comment": "Malware payload (SnakeKeylogger)", "value": "ff1ff41a0bb21fdff7d5ec59b083c2b3e44070cce60878253d96949f2b53e579734458f78198dbbbd3d02406a1788c0b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781748992, "uuid": "e26dce84-8cc3-4a2b-a7e0-cdd6ad5df25c", "value": "T1CA556D17D6AE574D180A3B61106B5D9AFE89CEFCFF726BC4E08F90B164EA1110B851B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781748992, "uuid": "f1551be6-55c3-4922-95f0-a9bf89792b3c", "value": "24576:ypaWKIJH+FvbsFGx96zxROjQuYFniwYOS8CukJbqzwiomenmoUkfO:8eIJH+FvbLT6zxR9uYFiwYOS8CukJbqJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781748992, "uuid": "4545de89-4ff3-4f56-b134-c31321a946b1", "value": 1377194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781748992, "uuid": "649e6dc3-6cea-4e97-b651-ba2bb48770fa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781748992, "uuid": "5a6e8ec6-1eac-416b-ae5b-aa53681297bf", "value": "Vessel's description.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79dd1dcc-6ae6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781767354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767354, "uuid": "b332775c-1dcf-408c-ba0c-21d4fe13e5e6", "comment": "Malware payload (Mirai)", "value": "2b6cab1eca26941064fd814e796ab9b9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767354, "uuid": "6a9e7896-7027-409e-b3a8-8a21a79e5126", "comment": "Malware payload (Mirai)", "value": "0f1f20550b96df1297a01589eb625081443c234f229ac158f1322a06d32f7326", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767354, "uuid": "91d33679-6d85-4680-b9f1-e83a941ee238", "comment": "Malware payload (Mirai)", "value": "b82d588f3579f629796034fe10d3daca723dc89d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767354, "uuid": "7eb88102-d8dc-4fdf-9005-f5cf5c406810", "comment": "Malware payload (Mirai)", "value": "7cb6aa094dbcd2ddb50d1ae28c3d6f380a21e30cd15977fdc398859ea1a5a72aeb0cbe53b93d56836f0a112cbb71606d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767354, "uuid": "40f8eee7-c608-4103-9d22-84e93653f480", "value": "T160C2F1B1C7EC69F1C6340939DBF94E42536A183CF4CA307964D84ABC998644EEB78583", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767354, "uuid": "ea206a47-69bd-4695-8e62-07a4011fdbe7", "value": "768:Qu2+HfSSgBhqh3KOcx6xSX6NeT1q4O3UbW:U+HfSSgPqh3Kn6xSX6NKS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781767354, "uuid": "e7cee44a-a953-4a8b-a5d4-287fe473ac39", "value": 28204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781767354, "uuid": "ebf0267c-b72a-4b78-ba3b-2a5278bbbd46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767354, "uuid": "ce06b935-40eb-449f-8e37-6508a79cfd43", "value": "h0r0zx00x.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27d367d5-6b59-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781816608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781816608, "uuid": "7cac404c-f763-48a3-80a5-28c9e4479bc3", "comment": "Malware payload", "value": "bd11bd3227b0c88d463458da1c795f9b", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781816608, "uuid": "978ed2c1-a094-4f1a-ab5f-d99d990f5635", "comment": "Malware payload", "value": "10528a25ae6f69c144369b8860aa1910b128cbd4f9cd6c1195058deedb567585", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781816608, "uuid": "97e90cd0-da42-4fc5-ab97-1a806161b3da", "comment": "Malware payload", "value": "ece4ae64a17ab77dd0a0a11fea1718df4c3d406e", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781816608, "uuid": "8e86e8e0-1cef-45b3-89ec-13fb0e5c6104", "comment": "Malware payload", "value": "64893da387bf69e2442cb532cd6a3ddba4933626f20e380a305cb1f7317ced95da15bf8c5d295954c63d04c1a3849fde", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781816608, "uuid": "f87c3711-669a-488d-9fb7-40e707a3d669", "value": "T124C6128568D2C1FDCC458570E24819FDF0EA78984DBE992B7FCA88027AB1C55C8F5BB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781816608, "uuid": "68ff5247-4392-477f-8127-350d0994fee0", "value": "64a82792ae217a318cbb528c890e0d46", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781816608, "uuid": "aa7e59b5-c7f9-4574-a3e5-91af3dad8ee4", "value": "196608:Hg+5vtb/lA+VxMfdQCKobzdDrSfbMohcqK2UGxr:AmvtRR6fdDK8x8xhnzR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781816608, "uuid": "dd3a99e0-03fd-4cbd-8d6e-684e2d95f718", "value": 11970048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781816608, "uuid": "b67fd8af-5beb-407a-888a-7d8a4f7d76a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781816608, "uuid": "996d2759-6a0f-4cac-888f-f65383f95e06", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2ee2dea-6b05-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781780764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781780764, "uuid": "419ccdeb-e553-4abe-a17f-8b3ee62488f4", "comment": "Malware payload", "value": "5a685f5cf12b697761ca75e5a9bcffe3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781780764, "uuid": "361386d1-8f8e-44ce-8c44-17a8a2d73145", "comment": "Malware payload", "value": "1123597a95a9de807e7a91448e6442811b35eb73dd2f6506ab5c4d3c1d772d33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781780764, "uuid": "fe734863-615b-4425-848e-87473043e593", "comment": "Malware payload", "value": "74e0ef000a6501726a7bd5e53e0cae12c2aec605", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781780764, "uuid": "be8edb29-fa3b-4961-b6b6-b501f8513a4a", "comment": "Malware payload", "value": "d27eb78116c045cabc0c5fdf25a936a9593b7661ef55932a33a0c32b6cccda69273023dc4954139e651b8ff63d1a0363", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781780764, "uuid": "287286cb-c90b-43cb-9d3b-ce69838b4025", "value": "T13E086C03F2A341D9C06AC17587D6A233F671BC0A5B34A6DB368C4B222F76BE05B39755", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781780764, "uuid": "1cad4a14-2a7b-4602-8ead-29b4eab028e9", "value": "fee2d6808999044373ca2120a0122d0c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781780764, "uuid": "3c44a0b1-1ee2-4000-a820-890e8f569708", "value": "393216:eA8R+jJqy2uq3xv7KstO9oCFsqdOrjaj+XvfF42a0ZvMZKfRO13bzwXls8vrnqwS:eA8R+jlnCK0lCFsTpTNvHBO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781780764, "uuid": "55e2b5a9-7f08-4cc7-ad3b-6c032f6dde2b", "value": 84044800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781780764, "uuid": "361e5380-69a0-4982-baca-44e6b0566cf2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781780764, "uuid": "707da993-97d0-40a8-a1e0-099c2da5416c", "value": "L\u043e\u0430der.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "596ed7f1-6b4d-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1781811538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781811538, "uuid": "dd73315d-bbba-47dc-815c-504690461863", "comment": "Malware payload (CoinMiner)", "value": "78c79caa0f066efdbd0b6824d133fdae", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781811538, "uuid": "9ed58c5b-9290-4a3e-bf60-01c8780b21fa", "comment": "Malware payload (CoinMiner)", "value": "114ab04a7669147c1fbf25fb4d44d18021fc573f653d6eff3bdfa508316d5317", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781811538, "uuid": "498ce17b-a325-4600-ad06-1c4860fe80da", "comment": "Malware payload (CoinMiner)", "value": "ce59c0c23ddf918b27947488caeb0d51e653f878", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781811538, "uuid": "063ce6f2-eb19-46aa-be9a-fbd7bec4157a", "comment": "Malware payload (CoinMiner)", "value": "1e9be9e7198cd6d249ae11207410ac9426d6c8f8fda4a58c2ae968ddfc1c4700c7c35594f67752a362a6efb8c6ab9e5b", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781811538, "uuid": "47567f75-847e-411b-8208-9e64951455eb", "value": "T14732292B6E490331E3A04DB81576824F513D2633A3C3B3EFF37396591B962498440EAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781811538, "uuid": "f5bc7ec6-9cc2-4d61-a5ad-18657c76da43", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781811538, "uuid": "60353c4d-51db-4a92-8757-6acf2a35ddea", "value": "96:Y0KdUo0Yz/9PYz/qYhjKBaNdC6xDbFx+ZQ+lc9dcN1Opg9PFJxGE9mZ2FFhxC7tE:xZojWrKBEx+e+l9XPFJxTEZmFhSuc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781811538, "uuid": "217ffef4-56b0-48eb-a8b3-0ba08aec19d7", "value": 11264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781811538, "uuid": "5cff511c-74ec-4df1-9895-84872bb66032", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781811538, "uuid": "03eb0b95-65d3-4d4a-b5dc-1a8bc3a37c9b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54416683-6b42-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1781806805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781806805, "uuid": "cb62621d-6b40-41ad-875b-279907db25c1", "comment": "Malware payload (NanoCore)", "value": "43d75c8f4be6b84b03639d5fc76a36ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781806805, "uuid": "e8bcddb2-f000-4117-85e7-aff129f6373e", "comment": "Malware payload (NanoCore)", "value": "1151e92ea0cf27378a52cac921ad761a65604500655fe7bedb00963e08fa98a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781806805, "uuid": "db11dc1a-6078-4fa8-8819-2870d6296cbf", "comment": "Malware payload (NanoCore)", "value": "d48650b788391ac5e5f628be61295314ddfa5897", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781806805, "uuid": "87018954-3597-473d-8878-cbc106c18a1b", "comment": "Malware payload (NanoCore)", "value": "4dc9965361be85040f908fe63d50805a8a91115e5b75b070a79f7a4db4878f55813efbe92fd70f7d1fa2df4b8b724056", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781806805, "uuid": "a393402c-1b43-4a7d-ab88-3e693ad6349c", "value": "T19114CF2977A94A2FE2DE86B9701251538379C2E798C3F3EE28D814B74F667E506071C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781806805, "uuid": "630e9c1b-4ad3-4e8e-95b0-c2f9682407f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781806805, "uuid": "06e6f014-4a24-43e5-9b59-a56d2929d3c5", "value": "6144:MLV6Bta6dtJmakIM5fEN/wjwJsvle+o9f/C:MLV6BtpmkJElepS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781806805, "uuid": "d13a20dc-9c1e-42bf-8536-5de63f87a3f9", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781806805, "uuid": "21bfb2e6-85b9-49b1-b096-5f5aef3ca0e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781806805, "uuid": "02fa5a23-bf4e-47b7-bfa9-bf045fdace6c", "value": "thepowerproject.io.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd57f6fb-6aeb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781769642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781769642, "uuid": "bbdbec81-9f3e-48f5-85d2-f00bdb3c0ce8", "comment": "Malware payload (Mirai)", "value": "f6536c6bc057235bfdfb1abc00c4e045", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781769642, "uuid": "0e69c35a-0f68-4628-a7af-bd550fbc0dfb", "comment": "Malware payload (Mirai)", "value": "1159fdca750eac7816a617d741386234f625d759d00e11395c9be65f8c47c754", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781769642, "uuid": "5526749e-7e5f-4ba8-8a14-86a75c2c978a", "comment": "Malware payload (Mirai)", "value": "bc0f40aeee9da05fe30b13a39d7e76f44533000b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781769642, "uuid": "b4bc4fe8-d7b1-4025-b9a3-a270d4cb42db", "comment": "Malware payload (Mirai)", "value": "94140bda2f38e0362a23f2be690a9bb1fc425841affa5c7f81354a1eeb989b933f7a448ce819b968faa915488dd88c27", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781769642, "uuid": "eeae6cbd-9168-4a2a-a70c-fe367e465f5b", "value": "T12BC35C46AB52C6B3D9D61FF50AB753210631EC261B3FCB86E32D3DB49E02689711A35C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781769642, "uuid": "928a2d83-ff11-40c5-8c7b-b78a5565864f", "value": "3072:g+DwsTtLJ8Bqo1WKo/k8nIxsRkTShFccfwgQGH:TDwscUgKTnesRkShFccfwgQGH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781769642, "uuid": "9267cbe0-c929-4186-a713-c3c1cbcd926c", "value": 121711, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781769642, "uuid": "60486cb8-1f18-4943-a308-196ad008d1fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781769642, "uuid": "f7827a6b-03c0-45f2-b615-96fe5ad7f938", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd9e8946-6b5f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781819437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781819437, "uuid": "592e30a9-5e52-4d34-8bdd-c618036058ac", "comment": "Malware payload (Mirai)", "value": "92b906cb863da33ace0cbfe9ec56df88", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781819437, "uuid": "8c655ec4-0cf9-46ab-8632-1e6275c5a422", "comment": "Malware payload (Mirai)", "value": "1165677cf4b80c45321379f8df41f3283dd0b67513dc5cacc94c092426f4332c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781819437, "uuid": "8d3d42e2-b6bf-4f3a-9201-708836d69efc", "comment": "Malware payload (Mirai)", "value": "5bb4ab27c676636a569a65152fc0310c7ede5ce9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781819437, "uuid": "4657fe5d-6798-4cc4-918e-a2fa8d6fad8f", "comment": "Malware payload (Mirai)", "value": "aac0d2f78cf9b25bbfa1f66629f440153f7841079c20494b614aa6a67043a6b9f0b1805b9a7349062412ad93fb877247", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781819437, "uuid": "8d45d174-9416-4ccc-a6ac-eeedca9fb134", "value": "T1D9731274DA818950C7F812787A3365F41EAD0E7DD66A32A62031542237C54C7A2B9BF3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781819437, "uuid": "6f864313-a3b1-4c36-898a-bec4a026cfc9", "value": "1536:sNc0gJ6Nzo0TurKlhEGW4QBtKnW7HTv5eb3fV5J6tpUO9153iznIVzU:sYCE3rK24QBtKnKMb3spUOVun0Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781819437, "uuid": "8f09b117-05cb-44a2-9d79-df0648d6004d", "value": 80524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781819437, "uuid": "265f04f2-b03b-4a1e-9a97-d0ce22b682cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781819437, "uuid": "ca01e2b4-46d8-4722-8170-2bbdafce1625", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a70d011-6b1d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781790789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781790789, "uuid": "c195cebb-a8b1-497c-8d38-b7447afbfee1", "comment": "Malware payload (Mirai)", "value": "2c1dc5473d0467a0fbe7274b8740c085", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781790789, "uuid": "62712e7c-93e2-4ec8-83a9-dbeb9eb44bb9", "comment": "Malware payload (Mirai)", "value": "11eb3db08b03ea2ec1726f8ee5a1ea1827ae400b36e9c15e31f290c8798e1649", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781790789, "uuid": "5bf9f8c1-6da8-4582-8b05-16eb3b118081", "comment": "Malware payload (Mirai)", "value": "68a49d5e82762cd1e3a083e2916c752fb77320ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781790789, "uuid": "086989fa-f6ce-4221-b130-2236f3ce29f3", "comment": "Malware payload (Mirai)", "value": "2193bd9bfa2968204b89abd4000e2293b916100538f9ea4ebef210fcccd2affcae4e680de4cb0e5bef9a035bde7d3106", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781790789, "uuid": "b08f09f7-6a8d-4174-87eb-fce4cfffebbc", "value": "T10B24B75E6E328F7DF268C73047B74A34A76963D627E1D684D1ACC1141F6038E681FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781790789, "uuid": "8b658bb8-9f53-4f7c-986d-fc20d252e02d", "value": "3072:8a7lZvUL7u8MQoBu9r0QH0Jn44SVCZPK/GCp82BnfIraitK+3+SLAs:8a771Kr0QitS+kBnf8E+3JLAs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781790789, "uuid": "f12d9945-25b7-4eea-9ca4-3661c891fba3", "value": 220420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781790789, "uuid": "d9f8984f-c709-46a9-9694-70b8a5cb0e8a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781790789, "uuid": "e903aa3d-8579-4be8-b124-bdf809384bde", "value": "wicks.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcd99a48-6abc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781749481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781749481, "uuid": "4e4da026-fd24-47fc-83ec-fc9f23c9b742", "comment": "Malware payload (Mirai)", "value": "d758744a29a7e301bdf2f37ad370de42", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781749481, "uuid": "d495d0fc-bc9d-4535-93cf-9944473b1036", "comment": "Malware payload (Mirai)", "value": "11f47b496fffb6c66668d2754c5e323325e5ff227ec85fbc00fbeefdcd84edd2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781749481, "uuid": "0f7c8473-f606-4293-9da8-0fc15f36212b", "comment": "Malware payload (Mirai)", "value": "a3eb4a5797381d473a1d3d9d9d21901a9bb10983", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781749481, "uuid": "e465a594-944a-460d-b2fd-95c93bd43d5b", "comment": "Malware payload (Mirai)", "value": "7bb96bb7e8af56ca80b66248a8dcc73599f6fcbab6307002357008a59f859d6528b0ff71b9363c66bc97dfb7602663e9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781749481, "uuid": "e0cae6c4-8d68-4daa-a800-6c0356f604ad", "value": "T14BF3E70ABF610FF7E8ABDD7702E90B0528CCA95B15A53BB97534E818B54B18B09D3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781749481, "uuid": "fd5c4a8a-7644-4e5e-8b68-1d7224b2162d", "value": "3072:UnBDa3onu8FJHY4lIH33ZKpxQ3ZcOEXnGZw:UnJBJHLlk33ZYQaXGZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781749481, "uuid": "7563c1a0-6619-4602-be1a-40531402433c", "value": 161896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781749481, "uuid": "246811d0-1bc1-4c2a-bd2f-d5e40ed88be0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781749481, "uuid": "a2a81ffe-3154-4487-97cb-8d10dc517635", "value": "data_mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71f32694-6aed-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781770347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781770347, "uuid": "a1e6026a-246b-4b26-9108-26b3ce588cc7", "comment": "Malware payload (Mirai)", "value": "1c22e5fc2e83cfc2838b31b7c7751d6e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781770347, "uuid": "65440cd9-2b9a-464d-80b1-28ad41b0cd8d", "comment": "Malware payload (Mirai)", "value": "1234ec8ee5388ab7249b2d87db0a2a84b949d87d3640b5d21ffb786b92664c67", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781770347, "uuid": "be770f4c-8fb0-4b57-bb7f-e4d4b9201564", "comment": "Malware payload (Mirai)", "value": "6904e1a4262ae1935a5b061358436baec6998abb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781770347, "uuid": "e3c4dcd6-4ea2-4ddd-961c-3eacde02b1c8", "comment": "Malware payload (Mirai)", "value": "d8334190496349f46e213dee7ba1ecde7c4353fead5e84c5fa6ee92617cf75fcd9cd93c023a7bed0460b942096ecdde8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781770347, "uuid": "864937b1-367c-4221-90f4-5266532f8afc", "value": "T11A44C61E6F228F7DF769877547B38E34976823D627E1E580E1ACC1105E6038E542FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781770347, "uuid": "2c4664fb-3b0a-4297-b56f-323c1ee0eab1", "value": "6144:1DF8V4nxlY4vQMy607YbhXJz6uGa8eFvVHg:1q/MZtrfvVHg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781770347, "uuid": "53d17067-b94d-49ed-b16f-cc297206ef95", "value": 277728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781770347, "uuid": "22b75ebb-626b-48ae-a54d-d1e5ef8b8b1d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781770347, "uuid": "5cb34223-68f1-4fa9-871d-d03384444f72", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7b924f0-6b15-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781787698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781787698, "uuid": "5b160879-4ee4-4b14-952a-263876b911a5", "comment": "Malware payload", "value": "3cccf0acad273190fd515cabf65fae0c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781787698, "uuid": "cb913583-130d-4fa9-9302-6484918ea3d2", "comment": "Malware payload", "value": "13625802ea4ade73aa1c741cc05495af93a9c5edc3d19c194c5d3449d4478b2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781787698, "uuid": "87537fbe-4981-4ded-9c4e-909c3666e55d", "comment": "Malware payload", "value": "94c012b0189d5da5bafb15d8aa68595b6382a638", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781787698, "uuid": "b6ebf101-e029-4d33-8766-0425db95972b", "comment": "Malware payload", "value": "f23031f6d859790274b54c25573f1fc2c1799e4e290c4147f0c639af4612e6be525ee72075c7a20e4b88c243035d5caf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781787698, "uuid": "158572e5-d2e0-4eec-8599-6880934395fd", "value": "T1DD068C07FCA158A6C0A9A33288B612427B3CFC461B3323D32E54A67A3F777D59979714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781787698, "uuid": "3ce1a7fc-6465-46d5-ad99-f0c16bbdec00", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781787698, "uuid": "2ed7ea00-6026-4822-b753-e0c814280aa6", "value": "98304:lUEHuc3USraOPxLfIcCAn7eTLjmTJPpFvPFLQus012ns:lzOc3JxKk6QHsI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781787698, "uuid": "18d64cd2-a188-4071-b3ec-c88f6fd359e3", "value": 3865408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781787698, "uuid": "ec704b38-a4a1-4eeb-b018-57b51226cba0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781787698, "uuid": "17f0bf85-aa65-4f78-aa40-410fa9efea3f", "value": "mpclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a48bf63e-6b35-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1781801356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781801356, "uuid": "913b4493-7511-4506-96df-5104b64af934", "comment": "Malware payload (Formbook)", "value": "c8511af43f43cb35e8a90191278b2591", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781801356, "uuid": "13ffb80d-10eb-432b-a914-71ffee080118", "comment": "Malware payload (Formbook)", "value": "147ac0fd88b0a7d99eddbcd7cd6a7c61ed66b2ccbf1f617a2503892e1382e7c9", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781801356, "uuid": "eb50ff2d-128d-4039-86ce-c5362849d8d1", "comment": "Malware payload (Formbook)", "value": "a84966dbceaa0a3278e7cd653f05fb8412c99e9b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781801356, "uuid": "dfc2fbfc-5e65-40d6-8bfd-2083c7c9ad1e", "comment": "Malware payload (Formbook)", "value": "42b9527f08524c7a53a163d973c3e186b6f8d3f23a166f31bc0d8a97c3b9e8feb813337eec06367ed4f3a1ca154f1275", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781801356, "uuid": "397d88ac-f9a4-4297-b919-ed992d2bee18", "value": "T1816533908C912DEC497D8318327FAE7B23A486A7E43BD8EF26B660DE053F7544253365", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781801356, "uuid": "5a174d6a-cd9c-4d9d-8507-2fab572e6dbf", "value": "24576:mr93xUTnEIFwKvvlQddnVyuSFzCBanGPAYsQk/TGRx+QVvaU:cyUfVqrUsQ3IQVvF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781801356, "uuid": "94d56109-d32f-475e-88cc-7aed9c750926", "value": 1483421, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781801356, "uuid": "21db1b11-4d13-43cb-9791-57586e01cdf4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781801356, "uuid": "33616c8f-d783-42f2-9d8d-a8cff2263542", "value": "KBOBI2KJ.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f8c7afd-6ae2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781765538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781765538, "uuid": "fa397dcd-0631-4660-aa42-419d47641211", "comment": "Malware payload (Mirai)", "value": "af7da81a6fab41f89fc459429dd82acc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781765538, "uuid": "0c84194e-d281-411a-8b82-63569be77c04", "comment": "Malware payload (Mirai)", "value": "153a6f83e01f59f52b7c2749168de5d90191e1b6644d4d39205480adb09f8679", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781765538, "uuid": "8eb1b219-a381-4e82-b012-ee8935f60a9c", "comment": "Malware payload (Mirai)", "value": "0151f10794719b8175b89d1d2f449b94d1ce036f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781765538, "uuid": "0697d34a-d4c0-484f-b0b4-4aa3e9c20518", "comment": "Malware payload (Mirai)", "value": "1dab7c194279bccac2e208ef7e3c0977d36902877cdf4698ba3c5e8677b4e18e5b039364e593beffb4b5d739cebb1584", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781765538, "uuid": "9b271f1d-778d-4936-9966-f1eb6316976d", "value": "T1DCD31709ED429F11D4E635FAFA9F41493353AFB8D3FA7101D9209F6023C6A9B0B36616", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781765538, "uuid": "85fb845e-c8ba-453f-86f3-d4a8fd6bf8ae", "value": "3072:FMMJlCQql1gI0Nxw5aA2F2a/NwTEdYYN0PPSTCeU7TCq+bu:OmlCQql2NNxAa5Ua/+TEdYYNoaT6TCqf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781765538, "uuid": "51fbfed5-6b10-4333-acf9-35c5c15df067", "value": 138268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781765538, "uuid": "f87dd487-0cb3-4e37-8062-a454f5de73dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781765538, "uuid": "37039ca4-7552-47d1-9e0c-7bf511a961a6", "value": "nova.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "731a1f3f-6ae8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781768202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768202, "uuid": "7660f613-2065-45ee-a564-7d5f9d733ea1", "comment": "Malware payload (Mirai)", "value": "3bc05eeb7d73845f1fbe838ffe4fca09", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768202, "uuid": "a04418f7-2f1a-41d6-97fd-cc669ee8903d", "comment": "Malware payload (Mirai)", "value": "15495d978314cbc03ed3014e9987f134bfc56d811d8ad819039d3a5792f829b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768202, "uuid": "b8b6980d-29ca-4eca-985d-533d4e3ded2a", "comment": "Malware payload (Mirai)", "value": "93f0cd47f1ff3ef99e94b5a1d23311131a00833a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768202, "uuid": "9fda182c-ac2a-4c0d-9eb5-34849e7e3c44", "comment": "Malware payload (Mirai)", "value": "b7360643b15fb3825a9567879aa1651dd1ed34d994a04f7210ad8405431a0125807e56039cfdde7afd00989b5079311c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781768202, "uuid": "ef371220-1801-49f7-909d-1b67257bf6d8", "value": "T1426422D0A23B429224C327B7127C65F31E99AB4B88CDD94B6089FBE075FF069D8D0795", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781768202, "uuid": "34d2841f-7cdb-47b7-bdfa-21f020ac6e72", "value": "6144:2FZdbcT6bELto5iUdUfZSnozl2C4mGKaXbvt4uymwd4O:2bNOWdi0UhVBJZaXbvyuymhO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781768202, "uuid": "5fb078b2-e2bc-4f11-a337-58729123ace4", "value": 311032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781768202, "uuid": "6085260e-1550-47a2-9b64-ce8cbca5b795", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781768202, "uuid": "7cc6c0da-dd55-4318-b865-aab4d7acd188", "value": "kaizen.mips_srv", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd83f59f-6afd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781777453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781777453, "uuid": "1e54ed08-1e7b-44fe-990f-6681d564316a", "comment": "Malware payload", "value": "7c393fdd4c42c40db047f03cf74be2f6", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781777453, "uuid": "a075e109-1d72-4d60-9a48-945160b11da0", "comment": "Malware payload", "value": "175d26c8c856c0a942a26e28f470574046a152437b0d71cc239d0c119895d98d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781777453, "uuid": "b5b238fc-bed3-4bfa-ade5-97bfcab1cd7b", "comment": "Malware payload", "value": "1db458d9288d24d878b902080d83b8fc8dc0e40c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781777453, "uuid": "5e24aca1-cc67-4b13-9112-539cb98a4c41", "comment": "Malware payload", "value": "c16f1a2882050c66663ab95e979de3c65b89f75363ae014d10ec4c477ff917335869e20407411f398ebb69d40aa5965a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781777453, "uuid": "1d80c84f-535b-4e55-afa6-027b248d3b7e", "value": "T14B0188CA80106A0090EEA84D32DBA044F421D3C7164A4F6DFEAC646EEBDA914B015F98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781777453, "uuid": "4f552951-8172-4f47-a2cd-258274d4f6aa", "value": "24:kXCKysE2hi0ziQvZoha7RFpVapetjpkpDqXpN93X:e9Qp+Ms7jpVapejpkpGXpN93X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781777453, "uuid": "b6a89a11-3b26-4afa-a6da-307ffd10eebb", "value": 847, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781777453, "uuid": "6f67a15c-e6e9-4587-aaff-19494f3cc658", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781777453, "uuid": "48de5713-cf79-454a-8294-f41bbf78fd6a", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2243b474-6b0f-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1781784816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781784816, "uuid": "95d401db-1383-456f-aaf4-9e95a2d6abb2", "comment": "Malware payload (Formbook)", "value": "202d7015430b3789322208cb120a2f45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781784816, "uuid": "cb951859-d336-4d82-a7e6-2468fae46097", "comment": "Malware payload (Formbook)", "value": "1797f76fed29dfe04c18d3d338223e8dc610e5d4476396d2d0fbff33d71ed965", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781784816, "uuid": "6f9bee9c-e759-4428-94d3-db65e31d0426", "comment": "Malware payload (Formbook)", "value": "0fae33a23b43ef8b1c267b2f116233adee241cd9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781784816, "uuid": "dad37e7b-b3ba-4deb-8cee-7f6143c6e8db", "comment": "Malware payload (Formbook)", "value": "f1ccfa85b32b66e0f2d9ba34fb92387b9303c9b0c9deccdd8a40eea0d4efbfe584a94ab687a0297acd1f351dbbeeb971", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781784816, "uuid": "2e79957d-94bc-4ec1-80b4-4ab4ee201e60", "value": "T185251204A2ABDC03E6B21B3648E1E03447B17D5AE972D49F1FE82DEF3662FA54585703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781784816, "uuid": "360a5ae6-9161-4b98-bd79-d53df83b7ad0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781784816, "uuid": "7cfd1b58-fa8a-4a99-a901-b59cda1a8510", "value": "12288:yvnju1u4FO3Zk0b2x+b4jrkSu+7AMi3bRQ3mCPNBIMmL3+Jy76xoPoThgR46xCG5:cjHqXxTdNi3bR4FNKR3+JDxoQhgSGXZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781784816, "uuid": "cd9cbed8-0480-44a8-b830-bce36a1e8207", "value": 1028608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781784816, "uuid": "08565bef-4563-4043-9fbd-2f9b9ff91601", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781784816, "uuid": "cb0c3ff2-07f0-4d8b-a21c-dc51b64038cb", "value": "dwg101330816.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10ffb9df-6afb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781776197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776197, "uuid": "298f865f-fa61-4b79-84c9-c2c292feb270", "comment": "Malware payload (Mirai)", "value": "e1fbc18d87ae4ad64807908c373bc652", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776197, "uuid": "79e84599-2f57-4d85-b3d2-3932a2eb184e", "comment": "Malware payload (Mirai)", "value": "18cc9f82f38b8346cd2d8ec5634773186398c46e1c1a80c0ef76a0016272ab03", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776197, "uuid": "783d6aed-cf68-44d4-a8a0-dd29c81d3940", "comment": "Malware payload (Mirai)", "value": "580efb76725abb15cce537bf57312a0e32970c30", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776197, "uuid": "2004be12-b1e0-4328-96d0-c00d514592d3", "comment": "Malware payload (Mirai)", "value": "a411296ac92a702dcbdaa1eb35bf457041711d7b03d406ae50cd018ed984867fde1106a32d629773b9c9de25dee93776", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781776197, "uuid": "30def1cf-079e-492e-9ac1-7917bfbd4183", "value": "T1EBB33B4AF8D0EA22C5D4667AFA9D029C331317B8D3DA7102DD14AF3533EB55E0B7A606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781776197, "uuid": "4bf5d381-f55f-42e5-8dec-446ec2f188dc", "value": "1536:IVKQw+ULLIBuQTzn06Zl+hcENn8FdxtaCYOuYNhw2f2d/EwWOzwQIBQS1SxcX+yP:IwN+ULs8QTz0OWctpZw+OBzwQXWXv00", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781776197, "uuid": "817a687e-16ad-4689-91fc-73b4b5626120", "value": 111940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781776197, "uuid": "f09955ce-e475-4313-89a8-791673d6bcfe", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781776197, "uuid": "1220dbf1-4caa-45b3-8a62-fe126be686ac", "value": "monero.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46f9647c-6b34-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781800769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781800769, "uuid": "acb90b66-d0a8-4f7b-bd49-92446c0467d4", "comment": "Malware payload (Mirai)", "value": "ad1d4d0628af7c5187a547026f388f2a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781800769, "uuid": "60ef3e9b-cc91-4227-9b09-e8f2b58666a3", "comment": "Malware payload (Mirai)", "value": "18cfc34d2f57d88d3d8bb662e6a23e26ea6a849e16cdf169a64b6a318265e624", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781800769, "uuid": "aa940fba-84a5-4616-b0ea-2e6a64b36d02", "comment": "Malware payload (Mirai)", "value": "4eebf88de1383390554e07b9fef87f08e1748d33", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781800769, "uuid": "151a014a-2867-44de-abeb-d2367e3a932b", "comment": "Malware payload (Mirai)", "value": "9fa3a92d2e2d0201383ee918df44faf7f6f0ecf0955aa0ce85f25f0205b139a1a17023bb18bfa046c38e165541ef400d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781800769, "uuid": "77b07c3a-68ea-4040-9c3d-886e5b34ba57", "value": "T1E8730A826A43DEF3E85710F502B7EB365A32FD3A083AC5C6E774FCA15A515C0A5163AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781800769, "uuid": "54a7d5dd-c444-483e-a785-63e8be16bcf0", "value": "1536:Rcz8Mfl3USRL+r97S3Tl9ffUr9sFC1qs3vLJ7LZaA14B6Kk3u80g:RcICl3USMsTl9HUrS6qs3TJ7LYK4fQ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781800769, "uuid": "39e9d434-a9cc-42f2-9b79-5b4051d5d85b", "value": 75592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781800769, "uuid": "5464bc2d-ae50-4a2a-a53a-af11b202d4b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781800769, "uuid": "c66dbab7-2223-420e-9fcf-66062077363d", "value": "manji.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec16f412-6b3b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781804053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781804053, "uuid": "51409314-1d0b-4dda-b279-0bf730e66ab5", "comment": "Malware payload", "value": "3abda8076fc0d1a9c3bc2731cadeca14", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781804053, "uuid": "3254092a-2c2e-4ad3-a1f9-6986d5607195", "comment": "Malware payload", "value": "197c74408e15bd1168105f564f96aace4fd4819961b724630bf5a6be4878daf8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781804053, "uuid": "98aaabba-b6a6-43d0-805a-7d180bb8e86a", "comment": "Malware payload", "value": "468999fe574f51fde2d115ff6fda491a64ff531b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781804053, "uuid": "89870e03-5df3-41f0-9f17-53b5acf9317f", "comment": "Malware payload", "value": "e0b00a661d2601d25913b60a976a2dde8b1be1852a351073ca11697987c75c5782a02cf0dd85c8cf99e3f820d3700746", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781804053, "uuid": "fc700ad6-bc4e-4b25-8886-7041b0b3c91a", "value": "T14621AD8EBAA1DD3124D9D928F7F1493E5A62F2561C217912308731FCE5EC26033E9CB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781804053, "uuid": "10cae758-55fb-4f24-8d0c-83bdfadf7137", "value": "24:M1jvF39RbinDSx1wyx1eC2uK6MTzaH+2TMTSIAvF2b2m2p4nKTNXT5eORpprjZi8:K9Rbiny1wO1F2uK6MTu+2TMTSIfy3dAK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781804053, "uuid": "7bfde3a5-f865-4a83-9e38-4dbf7e6e34e0", "value": 1269, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781804053, "uuid": "0073ce72-a58f-479c-94b1-cfc4644799fd", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781804053, "uuid": "f4dd3936-ceb3-4966-be5b-503ca41764a0", "value": "197c74408e15bd1168105f564f96aace4fd4819961b724630bf5a6be4878daf8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c37c3f3-6ae9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781768512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768512, "uuid": "5ec96328-d20b-434b-b643-1596457815e3", "comment": "Malware payload (Mirai)", "value": "f3ff5405673b8762b54099b2ddc8c352", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768512, "uuid": "6e46b160-636a-41d7-8822-e0d7127ba910", "comment": "Malware payload (Mirai)", "value": "1a088078ca66a64248f597a30a03f301c79b99cfee1152efe365036e67a872fb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768512, "uuid": "761cb6f8-11e9-4c40-a43b-9189c9b32eca", "comment": "Malware payload (Mirai)", "value": "622ab5a31d8e435fb7e7033f8a33035653b46c29", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768512, "uuid": "efe29f06-a93d-4fae-93cf-98f7f33ed201", "comment": "Malware payload (Mirai)", "value": "57b303eae74a1108fd7c90af206ca51644f14f1936813fc0592a12ffce4d8fa72fe3df582eff16a974f2ad14396c3cb7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781768512, "uuid": "cf932c08-a449-41ac-98cb-9f23793dbe3c", "value": "T138C43849F8809F61C6D426BAF64D42AC335747B9D3EBB2069E145B3437DB86B0F3A601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781768512, "uuid": "fc25d4bf-b411-4c21-a22d-16d49c91de7b", "value": "12288:33FZub/SVFviAYtfb2ib9it6uILsYUPGC/tXvsRNn1w8p1OJb:HFZa/SVJnYtzlAtxIL9UOC/2o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781768512, "uuid": "4c25dd75-d4c2-4005-a7d3-d9429fe509a3", "value": 595788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781768512, "uuid": "cf1fa119-c11e-4411-b056-083292772d94", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781768512, "uuid": "87ef9e02-2909-401e-9436-a06b7cda1302", "value": "kaizen.arm_srv", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "587b9368-6b26-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781794786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781794786, "uuid": "aef044c4-335c-41c6-95b1-7c1111c5823f", "comment": "Malware payload (Mirai)", "value": "218b8389ba5c45f4023c50cf6db2bda3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781794786, "uuid": "369ef1eb-0000-475d-9ddc-e5535d75989f", "comment": "Malware payload (Mirai)", "value": "1a0f77f95a60c38779c95b9119817958d29a861bda94c0c42526ac4e46287d11", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781794786, "uuid": "a90bc64d-508f-471f-ac6b-8379c27d31cf", "comment": "Malware payload (Mirai)", "value": "7baf68c314aab499ac30661eedd87289215ce66c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781794786, "uuid": "4866837b-159e-4081-bfd2-998813fb0a8d", "comment": "Malware payload (Mirai)", "value": "08fc6edf5f95ca3b69a92c003afbf0d1c7b6a5a760b4442b46d23a9b9d9fda94a15e42940dc173f6554c895ad1aee166", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781794786, "uuid": "77fe9f1d-a156-4fd7-aeb4-f25cb6941cc2", "value": "T1F4543B46EB404F13C5D527BABAAF02453333A7A4D3DB7206D924AFB43B8775E4E62601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781794786, "uuid": "c56c28f2-7d4d-4d80-941e-d02f6e647163", "value": "6144:oKdzBQIV/V7AnWDyqCWaXu9iuy5XHjy3j1BmaJjTmV/GW3mZ2Yx/s:FfV/VTDyqCWaXu9iuy5XjWBBi/NmZdxk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781794786, "uuid": "0d77e391-2396-452c-b9b0-b1ab84653038", "value": 288543, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781794786, "uuid": "2bbfe169-e1f4-4afd-a9fb-0c88c21ad6f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781794786, "uuid": "62d9721a-0528-456e-ad5c-20c5d635018c", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f24259c0-6b1e-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1781791608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781791608, "uuid": "44cb71a1-2e21-464f-bd2b-7dc2af176882", "comment": "Malware payload (njrat)", "value": "7dd2c7d92de1151e7655d3976bc24421", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "proxy-aiddroneheat-top", "colour": "#CCB7F5", "exportable": true, "hide_tag": false }, { "name": "pw-6072", "colour": "#D82F60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781791608, "uuid": "58317c2f-b474-4b38-9ea3-1af441c8cf0a", "comment": "Malware payload (njrat)", "value": "1ad7863265eb6cb743f541301b8c728a93fe315c50577f18b8d26ac26de356d3", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "proxy-aiddroneheat-top", "colour": "#CCB7F5", "exportable": true, "hide_tag": false }, { "name": "pw-6072", "colour": "#D82F60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781791608, "uuid": "7c18e36d-80e9-4624-8500-30eb40f2aed0", "comment": "Malware payload (njrat)", "value": "37c163a6417d21525357c1750af66493d4ff9155", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "proxy-aiddroneheat-top", "colour": "#CCB7F5", "exportable": true, "hide_tag": false }, { "name": "pw-6072", "colour": "#D82F60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781791608, "uuid": "c16ecf2e-1c09-43b8-861e-5bc9ec2fe276", "comment": "Malware payload (njrat)", "value": "321ab747948a108bfbd3e27202adb3e7f893483732eaf42c46850d4badf7054377c648813f9e8c801eaa0fb5b4b36dd0", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "proxy-aiddroneheat-top", "colour": "#CCB7F5", "exportable": true, "hide_tag": false }, { "name": "pw-6072", "colour": "#D82F60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781791608, "uuid": "c8f41eb9-c31d-407a-8fc1-4228ef0ea7ea", "value": "T18E1733E814ABBD450F103FE95936F113099C1546EAC7108D4FD2492BEABEEC8E7ED261", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781791608, "uuid": "ed21cf4e-1873-477e-ad06-faf885f4fe95", "value": "393216:WVe/8pWhMfLUM2UvrbpJ2q+WUKkx3+ZD2VjOCbFNGdVrCk0xa:W1ISLUMRvrFYq+6k8Nbou1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781791608, "uuid": "ce103beb-688d-4b63-a720-8fbd8812c446", "value": 18850771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781791608, "uuid": "3b787efd-a83c-43a8-a2e1-ec78a6053d74", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781791608, "uuid": "c1cc2a02-7199-43c1-a748-403ff8db8f8d", "value": "cx-programmer 9.1 free download full.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b7a969e-6b2c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781797314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781797314, "uuid": "d0cad5e0-d518-4127-aa27-4fc4c23e531a", "comment": "Malware payload (Mirai)", "value": "24347657c2f20891bce6653055339c83", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781797314, "uuid": "d1e53915-6373-4c3a-abda-439a73949a61", "comment": "Malware payload (Mirai)", "value": "1b664d3019b2bf20564c8f29ecfc2d00ebf7b16246cfb281f98487ef72c87643", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781797314, "uuid": "143538de-6f48-4d80-a1b8-7ae4cb2bd48b", "comment": "Malware payload (Mirai)", "value": "c99afdf939d2e966ace21d6bd1ba58cb68f71906", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781797314, "uuid": "a99f1401-4b76-4277-8018-f294aa22c5aa", "comment": "Malware payload (Mirai)", "value": "45420fb48c81a626f291656df7bcb93d52a9220dbbb4a6f32849fb4104ee5726f93fb4337ee11df6db9a6216a8862ae6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781797314, "uuid": "8801c0cb-834c-4508-8a90-b8bdbbb6b77c", "value": "T143B33B41BCC2565AC6D5637ABA6E968C336613F8C3DF3116DD124B243B8A92F0E37B41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781797314, "uuid": "43c8789d-e861-4150-9cf9-eaef16245b82", "value": "3072:+J+XdDnuCsoYas8CNVnUuzgUF1+lNJu6yta4iT:+J+huLpfN5F1+NuDc4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781797314, "uuid": "204d227c-1c73-47bb-a1f6-3e560513717d", "value": 112552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781797314, "uuid": "d7f43eaa-c08c-4d3e-9d53-35c2aa951c4f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781797314, "uuid": "856663fb-e73d-471d-9815-59ea8298be74", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd3a115c-6b5a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781817315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781817315, "uuid": "1873264a-1a82-416d-9d57-fbf91b49e50e", "comment": "Malware payload (Mirai)", "value": "fb4f0c6e8d2a21b01eb27b65029b3409", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781817315, "uuid": "8f278b81-7609-40c7-b372-5c6c29da6a19", "comment": "Malware payload (Mirai)", "value": "1b70a50ec21ecf45f37dee063f481cb11643574fdc3e717e24812af46faacf4d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781817315, "uuid": "5fff45ec-4183-4840-88ab-518406c07d81", "comment": "Malware payload (Mirai)", "value": "cf4370e557b55fef5689d4a1e0b28d2aa43b474f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781817315, "uuid": "75f710ac-e026-4af5-ad9c-e8685ffdca41", "comment": "Malware payload (Mirai)", "value": "487af9314cb016dd8f9405ced91930233826eb4596c6236776c659ee5c3010c587273bb7325c55be84d31ebf5ecdfc6f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781817315, "uuid": "5fe3f741-9cc4-4681-8799-0a60afcfda45", "value": "T161E34B16B4C098FEC9D9C2744FAAF137D971F4191234B59F27D8AB262F8EE202B5D610", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781817315, "uuid": "79210d69-911f-4776-9c24-6e73f0044a24", "value": "3072:509k0Gv7fVzGTTBeG+6R7vb1g5ACViluLwa:2JGgvJb1G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781817315, "uuid": "d03b87a0-b72f-4976-95b7-50e136faf6a4", "value": 155816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781817315, "uuid": "d1ad08c4-9b76-4b0b-b9b7-b45bf7dbeecb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781817315, "uuid": "9e583b84-d871-428a-80b6-4e5d9703e00c", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "834dc3d1-6b58-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781816332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781816332, "uuid": "3cab7989-eca1-4c9e-bd82-c2b4c353cc14", "comment": "Malware payload (Mirai)", "value": "70fd71fb5bbde389df66fd68f67c9d05", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781816332, "uuid": "2f93c6a4-5026-4af3-b661-bae39e166601", "comment": "Malware payload (Mirai)", "value": "1ce84d2cd3299a77ef5cadf5d5364ac480edaa8237c9e3c16c43d250b521669f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781816332, "uuid": "5147f5e4-8612-4d3f-a4d1-467f192990c8", "comment": "Malware payload (Mirai)", "value": "08a9bdf35ad630cf07c9767a9c288311c268c268", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781816332, "uuid": "b6efcae6-4389-483a-8ba5-7dce02fdbe0a", "comment": "Malware payload (Mirai)", "value": "c0036137038a4b0176023e6f4358fbaa1674677d260b8350c2c8cb021baa3c7355316c8288268c12e1f9d1f1aa8e7763", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781816332, "uuid": "c13f6134-9ab4-4c87-b785-b290d2bb0e77", "value": "T179149E23D8796EE8D2209870F0F5DF781753A55182471EBABAA6C6744487E89F90C3FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781816332, "uuid": "4540bc8f-48ec-443e-8c1d-c93e802efde3", "value": "3072:+EKZKgP5xQ+/mA6FGmSqR2p4YjPbREarWEnZ5N4X2Tg7:BLYr/mK9qR2p5uXKMX28", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781816332, "uuid": "91d2b7da-ecef-4355-a261-e07bf8e49ff0", "value": 194788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781816332, "uuid": "740c84cb-dd7b-49b2-b739-3b08cab40bea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781816332, "uuid": "e271eb4b-06fc-4e25-9f24-5f48e2b9a98b", "value": "psh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5578b62-6afa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781776017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776017, "uuid": "6ac18b82-077d-4242-ad9b-a2bf22eae1fe", "comment": "Malware payload (Mirai)", "value": "dc112349e06b24470f963c32366e8ca4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776017, "uuid": "8cf5f835-0a6c-430d-a33b-875f5e43557e", "comment": "Malware payload (Mirai)", "value": "1ee372a2826bfdf39d9e670d40e2918a8fd00cfe29869fbd51f99d556b85d58d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776017, "uuid": "f0ee970d-04f3-42d1-bb94-6ff71d58eb2c", "comment": "Malware payload (Mirai)", "value": "0c68f6ab57683ff445df70a78d1c4ad47ac1c80a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776017, "uuid": "0c3766a1-77a5-49c5-b2d2-77eb1e42d4b5", "comment": "Malware payload (Mirai)", "value": "17163d848012f3941bc5f6d8e1dbe6514d9f2c18900e2b58868345ec0fa2c7e7eaa5d946351d7d1a77d64a23daa51c22", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781776017, "uuid": "027e2fb4-872d-408d-aa7d-3dbfcdeaedad", "value": "T13B630298A235E143C81E5FB8A75D11DB538A5E496002051E59E14F4FD8233B6CEEB7B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781776017, "uuid": "88918cf5-f0de-44b5-b889-bcaa67d8aae2", "value": "1536:TZP3Fnx2cyZ61qU4GY6WTecI88a7IN9jwIksjRAESmIePh8:/nIc91qU4GtWT1ENRF91dy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781776017, "uuid": "861e3751-e887-476e-876e-7ac2cf111de6", "value": 69444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781776017, "uuid": "410b0b7b-8949-4498-9b88-b636dc2703a5", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781776017, "uuid": "a2daeade-2f26-49bb-a9f3-977693f2e867", "value": "monero.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b502ba46-6ac6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781753709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781753709, "uuid": "d0c475f5-d795-4c4d-ab76-7e11646d32c0", "comment": "Malware payload (Mirai)", "value": "368d1dc4824852c8f76db1931538792a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781753709, "uuid": "1923a980-f2e9-4f75-914f-77e7c869ec94", "comment": "Malware payload (Mirai)", "value": "1f39c8540b90f72b502602ab253695380fd4ed7108209f7a84fd87e3d705fe29", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781753709, "uuid": "fb52c14c-82ed-4fe7-af4f-b9b760e328e3", "comment": "Malware payload (Mirai)", "value": "42d803d77cba5da152aaea1afb2dbda22cd5bb77", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781753709, "uuid": "9ca9009e-158a-4e6d-88bf-72d72a389510", "comment": "Malware payload (Mirai)", "value": "da0fde94f89e9e9f7ed45c030d3ce44553ee41159e4b8801a6eb4b8cfe952fffe74789635198aa75edd5da24f2b22a95", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781753709, "uuid": "f4725866-b3cf-47e6-a8ae-c3d40476cbb5", "value": "T15E846B92F2A228FCD952C930825D6523E638745943116EFB27C8EB353E16ED06F3EB51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781753709, "uuid": "d7ae29fe-167a-4263-a22c-6b1bd3b2e7a9", "value": "12288:kWgjoUTXGA7HFY3mPj0YToTdsdLO0xdZJ0:rUbbb5sTdslZJ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781753709, "uuid": "6fe1a970-d682-446a-b4eb-66df623e0220", "value": 396416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781753709, "uuid": "40d5a189-ba6c-4e33-86b4-72158a82f1b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781753709, "uuid": "5709baf4-8e20-47e0-af5e-82c6cb501cd8", "value": "data_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba262391-6b43-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781807405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781807405, "uuid": "2912049e-1ee3-4ad2-b07f-5cd9c4a459a4", "comment": "Malware payload", "value": "adf8298546c025877639ae4ba4fe8674", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781807405, "uuid": "39998d92-1729-4d65-8cb9-98c7a2a1f231", "comment": "Malware payload", "value": "1fa2150192384a7abb27ad92295aa937efca1b2ac88dc802d3a68082d61c38e9", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781807405, "uuid": "4218d754-88f1-4fd8-bec1-8afe3da948fb", "comment": "Malware payload", "value": "cd9a08720ce458d127b2380efd9a423fb015bef3", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781807405, "uuid": "aa5542ec-fe54-41e5-b8f4-6ae970d2d0ce", "comment": "Malware payload", "value": "63b3569dd2bce9694cd8e48a362cdfa111b614ee881a6df8ac387bb07d96335c0a9392f449334c4ed0ed6d49fc270b99", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781807405, "uuid": "85e4019b-9db5-4031-8c0e-15c7f0c88cfd", "value": "T12326E04AFB49D66AC4F352364D395A6161474CA28F83EB837954733C99BB9C01E0AFCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781807405, "uuid": "4a26962b-18f8-45d0-b1b9-ae8ad51e9402", "value": "98304:GXy3U+hUlgkmz4SqBkhWTUHXkXtXMVGVKi8XFZdB:PhUu/zUBkaU3wZ+t51B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781807405, "uuid": "86da4092-9130-4a4a-9bdb-6d1edde8d99e", "value": 4442243, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781807405, "uuid": "69a81714-0975-42ab-8dd1-48421c752b5f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781807405, "uuid": "5d0f452c-6fe9-4c89-a96f-951673f0c0bb", "value": "1fa2150192384a7abb27ad92295aa937efca1b2ac88dc802d3a68082d61c38e9.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "648edb06-6b26-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1781794806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781794806, "uuid": "996d6af8-8ed2-43fd-890f-789b028a5aeb", "comment": "Malware payload (NanoCore)", "value": "3b7ccb4eb2ba5f3156526ec60cc3033b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781794806, "uuid": "1048ddc0-3d19-4556-ae9d-e7f867c7d492", "comment": "Malware payload (NanoCore)", "value": "202dd2a2a83208c237fcc87f2a077792b8e66815ce36d1dcd9de32a5f3ebab5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781794806, "uuid": "46999494-f88d-4fe2-bb51-ad5ba5dcce38", "comment": "Malware payload (NanoCore)", "value": "c7c3d905ed6cc0219417d83c60a708d9b031617a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781794806, "uuid": "9f93c655-064d-4070-a840-65e5e43584f6", "comment": "Malware payload (NanoCore)", "value": "0447471f9c530fc4d6e34f8e6dfd2871957b3dae13221a425fc6a22523435b98cd3c8cb4cc39e353d419e00736d3d810", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781794806, "uuid": "318ad44d-f8d3-4f95-9116-4aef3e293384", "value": "T19B14CF6677A8492FE2DE8A7D601212529379C2E39CC3F3EE58D854B34F227E44A071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781794806, "uuid": "fafe201d-8a29-4925-be19-966709fe57bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781794806, "uuid": "9aa2e234-990b-4584-92fb-1d9db1f0812f", "value": "3072:szEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIr7wKNdlIhtRSE8KaDtyvLGVQr:sLV6Bta6dtJmakIM5eTw37ax4L2W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781794806, "uuid": "de5af19b-2e9b-4e34-b2e9-81afd0c670e0", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781794806, "uuid": "633bcda9-3437-4fa1-a980-a5d6c6963ce5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781794806, "uuid": "393d638a-5bae-4313-a138-d1d2b1cbb2b2", "value": "kimc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "499217e4-6ae6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781767273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767273, "uuid": "d641c03b-9794-4187-80f1-5b073f03388e", "comment": "Malware payload (Mirai)", "value": "d1f5be6b51b95eb9e68d44ceabb5f017", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767273, "uuid": "b9d4ad17-8e36-4a66-bdb0-08648c94c18f", "comment": "Malware payload (Mirai)", "value": "2136b936d35afdfea5a59e3a85ec8de56fdc19715e27e5fdf3bc77db9ad68434", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767273, "uuid": "ac980eae-cd1a-4828-9f54-3556e1105e16", "comment": "Malware payload (Mirai)", "value": "85e81c7a45cfcd2cd8b8ac1cf9e6b54f9f9c6551", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767273, "uuid": "a7a7bde3-7e02-4c11-a39c-911b86f0b9f4", "comment": "Malware payload (Mirai)", "value": "7a60d843b6898646b780d81b8807516975d50e9a214537ff662d696c77a852516bc9ef9fa5f44093d0ea45a97512a0b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767273, "uuid": "9f82a1da-f417-45ad-b46f-f52a2a26c135", "value": "T1B6A30A49BC829B16CAC25677FF4E4389332B17A8E3EE7203D9156B61378F51B0E36542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767273, "uuid": "d2cfda88-b9cb-4d8c-aec5-1653ae8b46e1", "value": "3072:NCCswCnOugwoFMqVjHtEB/9u/9SSQdWhorz:NvVCnO3woFFVjHuB1u/wSQdWyz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781767273, "uuid": "fa77101e-c886-48bd-ab65-ed6291eda13b", "value": 103660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781767273, "uuid": "c64d2060-d16b-4e35-beb5-32ca25e9c98d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767273, "uuid": "e54fba6b-9fe9-420c-b1c2-6d222dc0ce46", "value": "rep.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "888be0cf-6b22-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781793148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781793148, "uuid": "78ef5e10-5e21-46b3-96fc-5cbe8203caaa", "comment": "Malware payload", "value": "8f3be989a258691db33ce2b802a69329", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781793148, "uuid": "0002ff68-a9a7-4e62-9656-dbf61e694e14", "comment": "Malware payload", "value": "214f85108169067337c282b59c85bf2b488760ef61bf0e53dd073204dc0cd8fd", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781793148, "uuid": "c7cac5e6-b28a-43d6-837d-b4b1e4b12269", "comment": "Malware payload", "value": "44074f8d5cbde0b4faf2f4c1ac987208af625705", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781793148, "uuid": "c2468ee2-855e-4fb5-9270-680e5851eff7", "comment": "Malware payload", "value": "5e2694da197a717d306d8f9a7a52efa37ac9b346188c4a08fd5c0ea297c34d29e221e9dbb529b1b9df143ec562f087d4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781793148, "uuid": "935f54a0-291e-43db-9a0a-537b60d9f1d2", "value": "T1540175CF00D618226196CEB8BFA7DC146D86FFD218C24E0CA6C718E3508C9947835F36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781793148, "uuid": "1e50549a-b8a7-447c-8800-c0ab292a7129", "value": "12:hKBFKaLcLLDvTWxDrIMTWxDgTWxD6TWpdgWKy:Ar7L8WxPUxtxPfgWKy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781793148, "uuid": "8191fdd6-8d95-431e-b446-6f3c25869d22", "value": 704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781793148, "uuid": "d54295f7-8178-4ffd-a40c-c33d99bc0334", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781793148, "uuid": "1488b4b9-79c6-4a11-9c16-7cf268cfeca7", "value": "x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8bf57c0-6af9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781775647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781775647, "uuid": "b8c4907a-e1e1-480a-88ac-28b95050ed83", "comment": "Malware payload (Mirai)", "value": "e49941c29fef18a9b1c08a5537828692", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781775647, "uuid": "e4c74a0a-704c-42ce-b809-75ffa96e7fe6", "comment": "Malware payload (Mirai)", "value": "2185f2c82200c56c9457554525f0da19487f9b70a53f8ad1830488b8056fcfed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781775647, "uuid": "3374d518-f156-4411-b002-62d0e2868135", "comment": "Malware payload (Mirai)", "value": "fc078ffc8e0ef424a2faf05af64d8f423c43adcb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781775647, "uuid": "0607e827-5aed-44f5-a193-6589864f1d87", "comment": "Malware payload (Mirai)", "value": "424deccc6780b7892a3709edbe3c29cc6c7c50b426a9d1b5032a59920bc07554ffb72db2e8872a98fbab6e1abed69036", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781775647, "uuid": "dffd21df-0584-43a9-924d-5e4d096085e1", "value": "T145630213A96BC202DF8C19363CDD3A46A661CC0D376085A8F0DE564E9695FE32F2DB34", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781775647, "uuid": "45e69ac5-46b9-4bc7-9b2c-2d3ece760aca", "value": "1536:9Yg7g6eElpPt96hGbDm7qrX9S+hP44DBPgTgeRC8erZinouy8ryI:9Yg7gPAplfEqrX4fSFtN6outH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781775647, "uuid": "6c93bed4-d346-4d2b-ab65-beb1e3df6fb1", "value": 68348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781775647, "uuid": "7352678f-1d19-42fe-876b-a38df89a0215", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781775647, "uuid": "f1712595-8c47-4894-a23e-1f84db7f8652", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17c71780-6b54-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781814434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781814434, "uuid": "3facd093-0dc4-4aad-89c2-22df338777df", "comment": "Malware payload", "value": "35f1dcdad211c0ef4409bd554cfd1425", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781814434, "uuid": "0acd1d90-38da-42d7-b797-733be54ba160", "comment": "Malware payload", "value": "22620c9c6d0c2b392ee34bd4e7905b6f161bfe25ed3dc756302aeb091a994b0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781814434, "uuid": "3a183251-5dac-48c8-bbb6-14534d42da8b", "comment": "Malware payload", "value": "6ae236fa1ae78011d3dd8dcb3afc3b6a1eb467f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781814434, "uuid": "0c05be11-9324-4a3e-9a87-42587fa06d49", "comment": "Malware payload", "value": "89cdb83e927c3e1e9c3ab826803ed1877822bbac25804e1e7cbf0101000d14394095e52c55e837b7355ac367b7373e5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781814434, "uuid": "526eb42d-c142-4f4e-8f98-90497b5586da", "value": "T1C6A51206761237B2AFA0EFCCDAC55958FBD27A022454288AE441F6D707CDC3BD68BD52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781814434, "uuid": "ddac9b0b-15f7-4058-831f-ed0153a83a64", "value": "192:mO+3jvxoP3WtDmuoVInT3f1BFuyWx2Ix5uPH3rfgKDKcUBpgVOrclB+XfBJzTeiN:3TVkSb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781814434, "uuid": "3ea399e1-6807-4c46-9f79-19f062473754", "value": 2151105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781814434, "uuid": "b40acb2a-73bc-4acf-93f2-42f3c0dcab98", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781814434, "uuid": "b7b578f2-36ff-49b1-a4a3-2d71e49f86bd", "value": "Purchase Order.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e15e8697-6b1d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781791150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781791150, "uuid": "478c3881-8129-484c-8c89-25e017849c55", "comment": "Malware payload", "value": "e930b93eb75ea574d22331ea317630ed", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781791150, "uuid": "02f4468a-58e3-4c79-abe2-41d9504ee810", "comment": "Malware payload", "value": "23616a70f91cade4edc2c75af7d0ee35d5e87967422d7bec0073fe0b8c03cfef", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781791150, "uuid": "86a7b657-7083-4e91-9dab-a50d9b76f5c6", "comment": "Malware payload", "value": "8b792b0ae06f0d573e40f3c04a5cd2f16700a970", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781791150, "uuid": "8fd8ac4d-ef8e-4fba-b8cb-f9c80dff23fd", "comment": "Malware payload", "value": "6e4a47c0caefb3ddbe581527b47427ae19dd0eaa744708f9540597eb574fea344293fbf684bc0566d93919f4bf35323c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781791150, "uuid": "0d8f3f1d-f634-41a7-b82e-477b2c3f2240", "value": "T1F0C2F0F1F8ECA436369D453ABB9CA805A9CF7C2F4DAB7D2014575938421CB1DA019B3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781791150, "uuid": "cdfab2e6-89b0-4911-b59d-03aa5c22deb8", "value": "384:HVXud3s1yu7isjsKG6qkSgjkjV/A4UAcGM3JNRhQuW5r:lQsylUMkSgjkjVdUAcR3JN3i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781791150, "uuid": "b9df3a2b-6fe1-4604-b539-a4320fe14aac", "value": 25760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781791150, "uuid": "04e4ea08-cca0-4546-9e93-cfe09d6fe924", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781791150, "uuid": "d06c0154-f11a-4db6-b71c-32fa9d95b42c", "value": "x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a60fb50b-6aed-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781770435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781770435, "uuid": "6684ddd9-3e1e-45ea-a3bc-a4bda53c38a8", "comment": "Malware payload (Mirai)", "value": "d6eea1ca7c7682c29f77c6c98675f515", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781770435, "uuid": "58f92fa3-3a8e-410b-b3a8-8d007ea36011", "comment": "Malware payload (Mirai)", "value": "240c428e4ba7cb7be0c7ddd9feeab14f000a1f5438e64a92db22021b83051c43", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781770435, "uuid": "fbd4a7bb-b86b-4552-b92f-53347cbb3e11", "comment": "Malware payload (Mirai)", "value": "d300feec067edbf2b024eb9aee1af317c64ce6c2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781770435, "uuid": "65b8132e-4abb-4b88-87c1-1933a3e695b0", "comment": "Malware payload (Mirai)", "value": "a58baedd142227a2b72ee43ccf9b9a4736a8eabdb0654c66d9b2db1d93fbb0ac7e106a5851644dab19b306a1016672d9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781770435, "uuid": "f6ed19fa-95a0-4c80-8055-0d71de678460", "value": "T1A3D3854E7E218F6DF668C73447BB4E21E79D23D627E1D680D1ACC5051E6038E681FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781770435, "uuid": "a6adb2ee-1c2c-4e94-b26e-0386f4be0c5d", "value": "3072:hnRyM7s0bcs2CD+m5sYfJl4j6HcJFCp4pJ60DAICP21:FRyM7Tbczm2YR8TCsVDA1c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781770435, "uuid": "1039a979-b1bc-48a2-86f6-f25d1154c1a9", "value": 138572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781770435, "uuid": "afc716b8-9e3d-42ef-aba6-8c1fa0c9c369", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781770435, "uuid": "fcb3ea1a-f3f3-4e0e-8a0f-44468e0837d3", "value": "rep.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce24fea8-6b31-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781799708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781799708, "uuid": "d2236dd9-c15e-4cbd-a462-2b1ff2c64ebe", "comment": "Malware payload (Mirai)", "value": "2a2e9c0fff7d7efbafc185f6120193df", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781799708, "uuid": "dafec56d-7fd1-462f-a46a-dd294bd46e4e", "comment": "Malware payload (Mirai)", "value": "24ec824321b07cadefa0fc298d1bdbb0e01703e02233dd46f2f6646895b90363", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781799708, "uuid": "4d1d91d2-0eec-42d3-a590-ca553bd95c86", "comment": "Malware payload (Mirai)", "value": "2a9cd05b2bb885b11bbd36f84b6f46f501a3c6e0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781799708, "uuid": "ceb659cb-6448-49d0-80bb-ac515816b966", "comment": "Malware payload (Mirai)", "value": "4f957a88ad7e608315e60ac9c54a00f53650357874eb847dfa686135b3d769de2c3b2e572284f466f6e59dc9c2da6bed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781799708, "uuid": "dde49d00-981c-4c09-b670-ac93e1e3d21f", "value": "T113D34B17B4C190FDC4D9C1748BABB13BE977B1291238B25B2BC4AB236E89E305F1D644", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781799708, "uuid": "7940ebb0-58f4-4931-bf9c-960cfd4758c1", "value": "3072:uYYbLdut7MAE5U1jvJCbYF6X+AgaBCuT8/jZiy/h/J2:uYYbLdut7MAEi1jMNz09Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781799708, "uuid": "91ea1252-c396-4ba6-bdcc-c7baa5f31670", "value": 139368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781799708, "uuid": "a027ee30-367c-4685-b9ea-abc8993ad07f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781799708, "uuid": "3ef4806f-6f56-4e03-832a-25165e9f5e5d", "value": "main_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfa39773-6b31-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781799683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781799683, "uuid": "496284bd-1f63-40bb-ac10-f78768f5381e", "comment": "Malware payload (Mirai)", "value": "33877494f17bbb0e785c601da0eeee89", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781799683, "uuid": "22539925-6534-484e-8d48-a4d081a61727", "comment": "Malware payload (Mirai)", "value": "25160398f59901a8ecc38d178b90ef83edf040314a08a529c8eb87c093391f97", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781799683, "uuid": "f96a0323-d2fa-4307-9059-48ca0e8f7828", "comment": "Malware payload (Mirai)", "value": "067b5a3006c50545a9d2fe02d9e33d67eb2410a6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781799683, "uuid": "591e6952-84b8-4315-9cb6-6c79f1fa10d5", "comment": "Malware payload (Mirai)", "value": "7ea6ef31bae8f4c3c5a80d3b80a7a9754a3f44e4ed7fb236582cd6575c9fe376d78da799ee4f3076f2e3b211ef4fc19f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781799683, "uuid": "bf500ba6-5374-4f2f-b1b9-0aac02709ca2", "value": "T1F60489196E228F7EF668873147B74925A76C23DA27E1D644D2ACC1106F2039E641FFEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781799683, "uuid": "f8a7672f-6e6a-4b63-8ba2-220cd883997b", "value": "1536:qPISTo+4L3Ck+/rjQ1FyfS+Gg2UCzQlSCjGXLeBigS7yknPfTRDhlPmMUAkoSc:q34Lpksg2UCklSCjcqigSlNLPmMU1oSc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781799683, "uuid": "76ada4ba-16b4-41e6-b85d-b7cafa65a186", "value": 173752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781799683, "uuid": "3bc1da09-b342-45ba-b65e-a7ac7c09c6ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781799683, "uuid": "b37179d6-d1bb-4ba6-9724-2f05f0f9fdb5", "value": "main_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "523fa7bc-6ad4-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1781759557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781759557, "uuid": "d24d6558-80c4-4b8a-893b-defbfe255fc7", "comment": "Malware payload (AgentTesla)", "value": "8cddcbb5247f2c512e870670d2226518", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781759557, "uuid": "f6dcf2bb-193b-4143-898e-d12881a59e6e", "comment": "Malware payload (AgentTesla)", "value": "251d17c39b20cdd7b9ff8e17e6c6f37226a5ffc40a71ac906faf9478e21ddfe4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781759557, "uuid": "168d4ea1-e809-471c-8a91-ba466bc20c66", "comment": "Malware payload (AgentTesla)", "value": "2886842b582a8822f9495afb179363d979a3aff7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781759557, "uuid": "92962a01-f683-4cf8-8877-73baac8af718", "comment": "Malware payload (AgentTesla)", "value": "1ef232dbe232e7c0de5b49486ea52167b7ccd7dd2dd4bd066d1c8718a875c1fa086e7d5f05407ad186bfc97a19a82c21", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781759557, "uuid": "b5b069ea-198b-4028-8429-9514ad6a4ea0", "value": "T10F65338DCA1C99A81C42B33C1D34219F57F0B759D31E9A5B28FADBA2C27E63453FA444", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781759557, "uuid": "61991a1b-d479-4fd8-866f-6a0afb50adda", "value": "24576:V4Pa0otVlvhoIsWMz8IQ/4HdQYOkxq8veY0ULHK1uCS1o8gnRt/K+raJeQGB364x:mPa0obthtsNzweOks8jBbK1uCx8Uv/yy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781759557, "uuid": "f6e7caa3-4a7d-4594-88df-3a83c6e3e081", "value": 1462121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781759557, "uuid": "91fcaf6e-e412-4b9a-b3db-23a0afdd34b1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781759557, "uuid": "55452e41-b09b-4423-8a05-32fb2fa56e2a", "value": "Purchase Order - PO.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cfef176-6b5f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781819328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781819328, "uuid": "92afff25-2b5b-49bd-a180-d12b0804caaa", "comment": "Malware payload", "value": "a13dce7af6ff09aec4f29cddd21039ea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781819328, "uuid": "52a20546-6070-4b8e-bf98-08729e115ca4", "comment": "Malware payload", "value": "2650ee2002dfac874ac1335e92f3d3f552f9a6688efe1f0fd4a991ade2206b62", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781819328, "uuid": "97b0b20a-0ace-4e0d-a9ab-b5709767b8d5", "comment": "Malware payload", "value": "a7286492f15315c1af6c6bedc86f705b83d57808", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781819328, "uuid": "1728fdfc-ae31-46cf-b9b3-7e30364b46b6", "comment": "Malware payload", "value": "64b84f6709169042c7a1c1fa6c7e5586a26dbff42a22b6cd043e48c7d086d40d23e46fa82e5188ab4d282d36148b6751", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781819328, "uuid": "25a6b5bc-0e01-4104-9ef1-4f1a68faaf8d", "value": "T164E32A45FC509F26C6D221BBFB5E428D772A47ACD3EE720399255F20378A85B0E77242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781819328, "uuid": "d958cbfd-90a0-4ea2-8f28-7d638b82222e", "value": "1536:IT/hUYRCEfgLr1UMh3ipqf+Asksf+ADKtXT4yiSupfCOsjXhslAsJ+FblNzwyw+t:I1UeB2icf+4o+A8XPiS0aAAskb8upE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781819328, "uuid": "5914398b-5e49-42e6-804b-e649162aedf2", "value": 146144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781819328, "uuid": "9cf6a9da-9165-4115-8b3a-0422c4324c15", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781819328, "uuid": "7769f962-428c-4238-8dcd-c42c30ff331e", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a679bc75-6af0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781771724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781771724, "uuid": "429c61c7-7ec1-4ea6-86ac-fd5e1d898d2e", "comment": "Malware payload", "value": "424b166d8bdfb3b5c05f1a901b562723", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781771724, "uuid": "534e927d-53c3-47dc-9530-b6b24b9cfc8f", "comment": "Malware payload", "value": "267eddb64d3120cb198c33773ad81893ec896a2eefe95ff4e70ae18a97a991ab", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781771724, "uuid": "2391bfd7-2ee5-4d9e-bba2-06c70cf5372c", "comment": "Malware payload", "value": "f046a11ce7973a8a95434d65b4275f6ca5cd4b81", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781771724, "uuid": "ffe0990b-890e-47f4-b284-443413ed3273", "comment": "Malware payload", "value": "7020e078941750d2c439b2a7dfc76d9449b7fa41d8bae2369d4bcaca74ab743ea22a6020629eb24b24bd3bf0499cf699", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781771724, "uuid": "af0fee0d-e77f-4e93-b94d-2c2bcf7d024b", "value": "T128137D6956857C24AE9988371C7E2F0CB9A983E1310451EDBFCB3CF58C456DCE219B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781771724, "uuid": "7136f9c1-fdf1-4fa5-bbcf-3191399d6cd7", "value": "768:c+u9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:c+7co", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781771724, "uuid": "8cfd6a78-d280-4304-a215-e46fee619bba", "value": 45195, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781771724, "uuid": "4e267d8a-3045-4885-b6c6-7378cc468510", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781771724, "uuid": "6382c0ac-2fab-40b5-a22d-44c29ca2c1b8", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2ecc149-6b20-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781792468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781792468, "uuid": "95c785e1-c85a-4c3f-bce7-150c2291cf34", "comment": "Malware payload", "value": "c678e3b515a7bc964c2036c3dccea6bb", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781792468, "uuid": "1b384e50-ebca-4c9d-a271-bc4c905a15a1", "comment": "Malware payload", "value": "268ef382af6884d8e9ecf11d2640b4beaa6d24a78822db285100f14050e73271", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781792468, "uuid": "0e3d828b-1ed5-4d2c-b433-f61c1f3e7b1a", "comment": "Malware payload", "value": "dcd4c9db05f3d3cbc3f534974cb431ec3b607070", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781792468, "uuid": "27defca5-5d7c-4a66-acea-7eb55a160a12", "comment": "Malware payload", "value": "891f85130b26cf1710dc6f4a174df7c21ddd36af619605c372e2f7f683899eed0a2d28186f9bce2bc04bef0bf32ba88c", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781792468, "uuid": "99506e8e-6e31-4955-a821-17075540f29d", "value": "T1A8E6335CAAD012FDE6B3013CDDE117A6D989F4E20B71CACB46A887917E131E04D3979B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781792468, "uuid": "f3e1449d-194d-4e57-95be-4168dd82eabe", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781792468, "uuid": "b3c91055-1bf3-4bad-9826-cd6746dedb6e", "value": "393216:6vDr/Q7dXKK5UQ2XMCHWUjXBcuI3/PGTAI:6fUUQ2XMb8XWH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781792468, "uuid": "8960cbc2-49b2-4ccd-aee4-bbf6e86efcbf", "value": 14324959, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781792468, "uuid": "e82308be-dcfd-4ba9-baab-95511362c8fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781792468, "uuid": "73837c23-d48d-43ba-8963-70d7f51023b9", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "085e2ec1-6b1d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781790786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781790786, "uuid": "40e05a66-196a-4372-b2d9-3fe0ea367f05", "comment": "Malware payload (Mirai)", "value": "eb2077880f9574fa92192eb1b2e2c928", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781790786, "uuid": "b2681005-e395-442d-8baa-f6a7a87b21ab", "comment": "Malware payload (Mirai)", "value": "26a0ffd8b46e0e3256efa223e4e4937c85a22e9c6b87b0093d6e61b23194b791", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781790786, "uuid": "d7a96f7c-caa1-4dd6-80f7-c200c3b2cc4a", "comment": "Malware payload (Mirai)", "value": "77bef4e1183160367719db7f8983122329f4271d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781790786, "uuid": "7cbe7884-e411-48d8-8265-79f726f2405a", "comment": "Malware payload (Mirai)", "value": "3d23f4cb4fa2c16e06709cfcc4f75ed0bb8e80fe8a70e6413b018ec95d9570658575cf765d0b7ca9ef749b35e387b735", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781790786, "uuid": "0058e391-d00a-472c-8cad-0d77743e0e97", "value": "T1FE040856F9819F11D6C155BAFE1E428E33131B78E3EE72129D286B30778A87B0E3B505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781790786, "uuid": "46d16c41-630f-4b61-b2d3-50ca444cd8f7", "value": "3072:c4zR+gFnaBPpG1Co7sRLzhHtA0uIasTOPibHYVpFon80sLb9PZXa:nR+gFnaBPUtoV5tA0LaEO6EVpFobsLxB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781790786, "uuid": "92ce146d-3e7c-44e2-98be-fc45f1757e2f", "value": 178996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781790786, "uuid": "454ec80b-005c-4776-9281-471bf1001e41", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781790786, "uuid": "d039c5f2-b071-4ee3-9824-5b0fd8de5ab4", "value": "wicks.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "336a93f0-6b26-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781794724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781794724, "uuid": "250b18b2-3662-4fda-acf8-c549dcbcfc53", "comment": "Malware payload", "value": "79c17f3b5a46c3068bf7d0fe04ea4b3c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781794724, "uuid": "62007682-39f3-46ff-8ac4-043c9b963c7b", "comment": "Malware payload", "value": "286e62f0f74ba6949f9843967a0c0873f22de5816c5fbb3f6fd0cd84828b13a8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781794724, "uuid": "2eaabfb9-755f-49a4-b13c-5cb638aac17a", "comment": "Malware payload", "value": "42104589118528c793105864ad6d2095be3e76b4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781794724, "uuid": "e9ab163b-6960-4d79-8b2e-23577923e96d", "comment": "Malware payload", "value": "5ca787a8a20b65f6dbe9e53cafd0168f72339b8e5a4c5a102c2c030273ad838d321e1e9f5ed2b1050f80bb38ed2671e6", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781794724, "uuid": "ba37eb6e-9785-45fa-9489-39f16907e7ac", "value": "T16601ABD68650AD10412D9A1DA3DB56A0B421E3CF0A8A0FA97FDC1D3DFB88400B026F89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781794724, "uuid": "991f8907-713b-4f51-8597-e814953b100e", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkaWCYBpxHCb8+YC0j4CYWCvPauD:kXCKysE2hi0ziQvZohaW9pdIsGcQP7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781794724, "uuid": "b8139048-af74-493c-87b8-0c932fad1d6f", "value": 831, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781794724, "uuid": "8dc8611c-dfb6-4d25-bf7e-0158d0172d9c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781794724, "uuid": "95f19619-9f3d-4cd5-88de-e148f031a470", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "457a9e49-6b33-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781800337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781800337, "uuid": "1c06ecb1-ff53-4774-a2f0-5a010bf3db3f", "comment": "Malware payload (Mirai)", "value": "dd61f513a6067a7589055b4dc7892990", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781800337, "uuid": "4892dad9-2bab-4064-aab0-80df3bc56de3", "comment": "Malware payload (Mirai)", "value": "28f2f59919a19689be1a42b9e5a756b2ccd2c344a03783b2ab59ae170cee1f91", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781800337, "uuid": "dff2ad03-45ed-4209-abd5-ae8fe3a0fc9e", "comment": "Malware payload (Mirai)", "value": "a0a09adf883c998083b2aeb47c5def7fcf2c32f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781800337, "uuid": "32abc60a-66dc-4164-80ae-eeadf531aa9e", "comment": "Malware payload (Mirai)", "value": "f9ad4bd6bbf8eccfd657ac9144d7fc67a10912d7ef2bf508063edcf1afd58cf56799c3dd53471aec84a2f86eca165912", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781800337, "uuid": "6d4fe3ce-5e50-41a2-a27a-c023dec9c930", "value": "T187B30946A9429F11D5C631FAFBAF414933136FB8E3FA7111D9205F6023C699B0EB7612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781800337, "uuid": "11d1740f-3292-470e-88ea-fa18cbf65d13", "value": "3072:pqiy9qVvpOFnQfG/7/0NZYjYhOn1NaVF7h1ubWczgflZI04MbEPsf:pqiJKdQe/7/0NZYjWK1NaVF7h1Hczgke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781800337, "uuid": "c720fcb8-18a1-4b56-818b-23b890308eec", "value": 112656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781800337, "uuid": "9e952d70-0749-4771-8b86-2186169e1331", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781800337, "uuid": "b106b736-a483-4fe5-ae0d-7eac0fc84a1d", "value": "manji.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "170d44e9-6b16-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781787804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781787804, "uuid": "1480458a-3333-4ab4-98eb-417e21cbce31", "comment": "Malware payload", "value": "9525dfb3c0318a1036593598c341d48c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781787804, "uuid": "80b9b442-07d5-40c6-8a91-4272eafea911", "comment": "Malware payload", "value": "29547300f9532902ef805f134fd61015db8bdd774128aba7ca120a1166fe1ef6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781787804, "uuid": "f35550e7-d0be-4964-8fa5-eba97eb4da19", "comment": "Malware payload", "value": "03a0eb7961def1bc4736bf9032b029830316bda8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781787804, "uuid": "a89de4d6-e995-4565-9e7a-cd74de70d68a", "comment": "Malware payload", "value": "4f2738748a229933da4513884a8a7d883eec1fca952a8cca5e9cf40b620c60239e6245818bd612a7d7f3ff50f240eaa2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781787804, "uuid": "609c3866-63c9-4e44-9771-da4c1e9f7438", "value": "T1C7068E07AC921CB6C159A33289BB5242373CBC491B3B23D32E50B77A3EB67E45A35355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781787804, "uuid": "bc82798a-f078-4f4e-8d23-00c41fd30b8b", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781787804, "uuid": "80742222-7a84-4fe3-8457-bc609688cfaf", "value": "49152:XgvRNVQHP+9uJUq9aWmwtxxqndLurwIWCU8nKUjX/RGHSh:XQNK5p9Fx8yrwIWrUjaSh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781787804, "uuid": "e94da078-7aba-4ffc-83f1-6b9e50a8dc58", "value": 3842936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781787804, "uuid": "6b31342c-05d3-42a0-921b-e4404bbc0320", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781787804, "uuid": "1e68223d-53d5-4683-a570-c89aea9fad36", "value": "mpclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39e2587a-6abc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781749208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781749208, "uuid": "d63d3fb6-087e-47cb-a696-558bd095685f", "comment": "Malware payload", "value": "d329cc9d087b38585c0f1b1d465b047d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781749208, "uuid": "8969491f-9834-4b0c-9d7d-9648ddf1ffd6", "comment": "Malware payload", "value": "29b2bc580820f3e172803f1f4be3590b0ebd53493cdfd5bc38cdfe3a19f0bdf0", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781749208, "uuid": "110d6e4d-15ce-47f2-b171-66563632f66e", "comment": "Malware payload", "value": "3d6a374e669b56f510cf50f06f557b17e08abf05", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781749208, "uuid": "999286ad-4c23-45a8-9077-6f53ad4908a3", "comment": "Malware payload", "value": "19c555f3e10d660b80426c0e2fbf926ce94337e87e3d6aad8f5ff64606edfbe050581cec2bc5a422426d823460f39870", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781749208, "uuid": "f13278b2-7cda-41ca-b19b-2ddfdc760d48", "value": "T15C21498D6721E53824DDD534B6F24E3C9E63B29A6C12B911348635ECE0EC65437ACC3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781749208, "uuid": "cf7f7855-8597-439e-b81a-9854efec313b", "value": "24:4ud1jvF3dudpRduJinrGx1wyx1+u5C2uK6QuTzaH+2TQuTzuCXTlY27vFLlEb2mD:4uddudpRduJinrS1wO1+uA2uK6QuTu+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781749208, "uuid": "b60f5408-66f5-4e95-a686-559cf6702920", "value": 1196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781749208, "uuid": "07d99f61-61c0-4f81-90e0-5c4c6a607f8b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781749208, "uuid": "a6376a12-7d91-4d85-986c-b4e9f55c24e3", "value": "clean", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df8636b3-6aea-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1781769243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781769243, "uuid": "f186bc57-5d2a-4cba-9104-502091233b55", "comment": "Malware payload (Prometei)", "value": "9dcb41cfb7ae6a76ddec16ba8fef2b94", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781769243, "uuid": "1c81a907-d53b-48a6-b011-cff8d197c47b", "comment": "Malware payload (Prometei)", "value": "2a71b0288b8b899dfb29e57a35cda39410fa5877e65f0e801f388d10f48eadbe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781769243, "uuid": "11f6b9c0-f986-486d-a049-509eb2e3d030", "comment": "Malware payload (Prometei)", "value": "4b09ecae7869db8372bbefb40f13a7a903723af9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781769243, "uuid": "85ad13bc-fc02-48b6-b6f2-b4494289fc63", "comment": "Malware payload (Prometei)", "value": "26bf6d81e2980ab1ead9a4ef8ae59b816cdc3ac89727b223027b5b4bc59f2d6068a8a04d1a49026c39d4f6fd7dc3a44f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781769243, "uuid": "d3b5d150-e023-4b1c-b554-14fe4e40605f", "value": "T100C68C73904238D9E5A88DB4D11416526DBC388B5738A3C7BAC471F667BABE48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781769243, "uuid": "9a2b3d23-cf4f-49e5-bebd-dc97ac1665b6", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQm:cqYUQuVDt0TZEN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781769243, "uuid": "95b09121-643b-4f55-a219-52b52899ac57", "value": 12025856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781769243, "uuid": "befe65ee-3c33-49b6-aa8a-3be37d17538b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781769243, "uuid": "879eec17-395f-418d-ae25-e92b7e9f9577", "value": "2a71b0288b8b899dfb29e57a35cda39410fa5877e65f0e801f388d10f48eadbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "663ce044-6af3-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1781772905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781772905, "uuid": "0fc532df-69d1-48a3-adac-286b8c66efef", "comment": "Malware payload (NanoCore)", "value": "a70027dee75298f478c25e0c2e7203fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781772905, "uuid": "1269dd1c-e335-499e-87aa-e3b0d151ade0", "comment": "Malware payload (NanoCore)", "value": "2b2dae59b0a8be1636c89590c7d24359985c24816a5791d5a5c83036a29e431c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781772905, "uuid": "810fecc7-a21a-469b-b359-e4e570f64158", "comment": "Malware payload (NanoCore)", "value": "2863444d2e828fcb2f7654487499f0d990ff9a18", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781772905, "uuid": "bff8bacd-8322-44e0-b97c-5a53b7282058", "comment": "Malware payload (NanoCore)", "value": "f57b24018e102e02979f39ed2a5ddfb9e250e5edd3b296d914fad973bd44f3359e65f79746d39c420a523760702da2b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781772905, "uuid": "7a669239-62be-46fa-9c82-87a75312c956", "value": "T18714CF2677A84A2FE2DE85B9611211438378C2E3DDC3F3EE18D855B38B663E50A071D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781772905, "uuid": "391acd7e-24ea-4fb5-a5ef-ff6f3f5d5e70", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781772905, "uuid": "5a2ab9a2-88b6-450d-9695-17e1d6a25218", "value": "3072:MzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIfasvu1SEImfAF8V7m8CJvflRl:MLV6Bta6dtJmakIM52uvImfVqflRj0vm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781772905, "uuid": "35da3ca9-c127-45b5-9355-0bf5459b3c5a", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781772905, "uuid": "ab582c37-922d-4f1f-88ac-1a92a1cccc55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781772905, "uuid": "66e066f1-c9a6-4a73-92f3-465d22b446c2", "value": "cakhiatvsv19.cc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efe06f21-6ae6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781767552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767552, "uuid": "eaec1919-9b0c-426b-94bb-3bd1fe2f5638", "comment": "Malware payload (Mirai)", "value": "cff5bcebf3fe871d31f4945c8cb3d544", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767552, "uuid": "5b2625b4-b6ed-47cb-82d1-e8df4012bfb0", "comment": "Malware payload (Mirai)", "value": "2d9b45ae9694a47f2e624251b708a4767a73afc800c0bd873b3b06b726fe570e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767552, "uuid": "1b1a9efa-d09b-4551-a4a6-19387ddcb52e", "comment": "Malware payload (Mirai)", "value": "c474280fa5a8daa5535485165a8cfc9ba8132ccc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767552, "uuid": "ecdb48ad-b141-44a8-be22-423946b110d6", "comment": "Malware payload (Mirai)", "value": "be3e5ff030d2aee69da0f4358d2f3921e38ffa818b8f77f501147ba089263f1d52fa84e9184b1dfeba3bc0e6eb0f6d10", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767552, "uuid": "ac463690-0f88-49a8-b742-f89bd7938c11", "value": "T16393830E2E319F7CFBAD863547B74E20964933A626E1C584D06CFA011E7434E785FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767552, "uuid": "9389b56a-1986-46c1-b51e-71a755d13bf8", "value": "1536:xD/T2A1YiVfdxDm5gMOym8tS16MGKJAI9bODl2VNwcWIN61nKUnfr7CLnGskfDL:xTd1NfdxD0Rvrum2OuoKUnT7CLn5SL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781767552, "uuid": "6fee90c9-9bb8-4392-9d31-0588a767c690", "value": 96432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781767552, "uuid": "a249c8d5-d3b6-4824-86b5-c4993fed62d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767552, "uuid": "150356d1-bf27-4abf-88e0-63443cea4d4b", "value": "h0r0zx00x.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7098078f-6ae8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781768197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768197, "uuid": "8ab9e283-b94d-4b6b-aed1-071173fb618e", "comment": "Malware payload (Mirai)", "value": "d522c922650dc3aabbf916aa97bfe37b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768197, "uuid": "371ad562-faaf-49fe-90a7-cd6ffe2d47ab", "comment": "Malware payload (Mirai)", "value": "2dc06efbc2376ca89d4134423aa79c28788471c83dbcdc0be0f37d1f98616b3a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768197, "uuid": "70744ed2-12fb-4f37-b3f8-84f4461291b4", "comment": "Malware payload (Mirai)", "value": "2377f12abb0a52f55fd15db331d61a1034e94712", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768197, "uuid": "a46a79fb-79d3-4017-9a74-19ce844d8d32", "comment": "Malware payload (Mirai)", "value": "8b68504b03274f5939fe5bd5a24abf71b741522fb019ed7b077c7e5b3d341348b73406dc9a6dd2117ac8636b47a69ab7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781768197, "uuid": "d8afc6bb-85f1-406f-91ec-62390bef91bb", "value": "T11564233700D6BD7CEBD66FB305501F26AFD4058226BED33295F09C523D6AEA606468EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781768197, "uuid": "62a8cc64-860d-48fa-858b-f0b772eaa43a", "value": "6144:BkawH4nJVLIo0QRMwr2ZPSwWR+HXkFOmCq8srf3eqLvO/AlURjF:BkaI4JVLItQRfSSwWUHXkFR8sTjLJlmF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781768197, "uuid": "6c5c36f6-5e52-46e9-a486-81b0aea5f931", "value": 310848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781768197, "uuid": "82d4ebab-3633-41d2-9704-eddb21417b03", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781768197, "uuid": "442fc1b8-36fd-4d9b-8571-eeb2cd27178b", "value": "kaizen.mpsl_srv", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9a3b419-6b1f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781791996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781791996, "uuid": "e565b7c5-2d23-4250-85e4-9c7438ce75ed", "comment": "Malware payload", "value": "291fbeb8973b1f00b8217739ab8a5ad7", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "stream-pawpalace-cc", "colour": "#4912B7", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781791996, "uuid": "6e98eb8f-db2d-42c4-a22a-1ba8453006b8", "comment": "Malware payload", "value": "2df4f4c0b77671fcbadccb2189e3de9fb4fbca0052bc41ef82d58af056bd6dca", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "stream-pawpalace-cc", "colour": "#4912B7", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781791996, "uuid": "7a460100-6cb2-4c7d-b054-0fa958e79b92", "comment": "Malware payload", "value": "cfa53a09b711e5e17652cf723e0bcab5a0a456e2", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "stream-pawpalace-cc", "colour": "#4912B7", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781791996, "uuid": "126af595-b97f-4b82-a709-096cfb83f5e3", "comment": "Malware payload", "value": "fd3a29c5bdb4347b7a39c47144a775942adda5023e251a41ac8c679f206f43048170b5c66435464baab403ea1e8beca2", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "stream-pawpalace-cc", "colour": "#4912B7", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781791996, "uuid": "c2f921d3-5862-42bf-8b43-79e7bc326d8c", "value": "T1D6573369D601CF41C56FED3E84D6525AB6BB9A29097BC02B03EC96CF3CE2E8D975100D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781791996, "uuid": "da0e53fc-a445-40a2-842e-c99f8b244960", "value": "786432:Y3ZEik7xM4P8AJpAJAQDLNXBR4dcVVBIQOK/VE:EtBgNAJAQD5XBR4dciOE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781791996, "uuid": "21d9a83b-df35-4e5e-a46e-66c6e76c470a", "value": 29153573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781791996, "uuid": "bfb0780d-3a2e-4ee6-a641-5332787886bc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781791996, "uuid": "891fdf6d-c1b8-4e61-9b80-5dfa5596c9a4", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac20d14f-6ae4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781766579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766579, "uuid": "2de8d6e2-ac63-4df2-847f-1a6bd0f4d997", "comment": "Malware payload (Mirai)", "value": "07f3a47ce1fc29ab372ceb80c137a8eb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766579, "uuid": "2e1d160f-5381-481d-aaa5-17ed397529a3", "comment": "Malware payload (Mirai)", "value": "2ee71564d906dba97129e59ef51ec80e54ded529d4e1be7f966c97cffcd2d299", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766579, "uuid": "11f3c88b-6d87-4317-90f3-62d919a9dfee", "comment": "Malware payload (Mirai)", "value": "6913556c26f608eac0fa5a2e2d677f03e3984bc1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766579, "uuid": "990b3c95-6e11-4df1-8cd3-9bb6d9386250", "comment": "Malware payload (Mirai)", "value": "11de276641ded607c06440d13a05c9dda8f11521260999411a7352a65c068d5f719bac38faba6bf6f7d709317e85e400", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781766579, "uuid": "4cf227f1-1cdc-484b-bc87-4db29a92c932", "value": "T1A1043901B70C4947D1632EF02E3FA7E193AFE9D12AA4BA45354E9B8D8171D331989ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781766579, "uuid": "3486a18d-0347-46f8-b35e-cfc969ca06b8", "value": "1536:wxu3z6qoxu4HH37n6aU1lI4CSJ7ocztxOVXiOmPPAFzKIYXKmj3d+14vmvAXLrbK:ws32VsA6aUsSScztxOmAoXB37HX4IREr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781766579, "uuid": "30c770fe-d922-4b7f-99fc-3e5d546e6498", "value": 176892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781766579, "uuid": "d75fb407-2a23-4740-b06c-3b18c09939ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781766579, "uuid": "ddd16038-7872-416f-b556-1b002c9377bb", "value": "onie_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aabfc7f5-6ac8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781754551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781754551, "uuid": "e9170b4a-b132-4b31-a05e-fed29f59f134", "comment": "Malware payload (Mirai)", "value": "0a798adcdb564c5a78a6b3b80e7b4a5d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781754551, "uuid": "44cd53b8-67f9-43d9-ba9c-fd63f591e55d", "comment": "Malware payload (Mirai)", "value": "2f485c14c285244e94c7765c8630c81d499a18e7362183d9ed2ba84b78534fab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781754551, "uuid": "62999095-27f1-4a25-a4b8-c1ba023e9fd8", "comment": "Malware payload (Mirai)", "value": "7ed0a3437ff84c18cef2f4771ae3ea1df149a153", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781754551, "uuid": "55aef6c9-1871-461d-bb4d-18bdbcfa480a", "comment": "Malware payload (Mirai)", "value": "2fdf7de279e89d48a0179f609b681dcbe404f2d24bd1bbe5e42bea914a1bc9bfc16818575565eef70f5a35a0601759b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781754551, "uuid": "b944ed9c-b189-4864-bdb2-226941bc6be4", "value": "T12B144C4377224FA0D326D2714BB38B5A5AEB11821EE298D5936CCB143E207D9589FFF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781754551, "uuid": "5fb88b74-e3cf-4395-9934-aeb721bf9d52", "value": "3072:8G99NwzYJHcVL0qvaoDK3TSH1mmEXphcaOvag5HOgqqxdppqMMH:5eshcVL/AG9IOX/5uUxd6v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781754551, "uuid": "0ea5bf44-0c74-45a6-bbfe-a2ebd0fd5179", "value": 208956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781754551, "uuid": "5beb084c-f9f8-459c-a8b4-eee921b3a2b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781754551, "uuid": "095f01b6-413e-4b29-92b4-0a508e389330", "value": "data_mips-uclibc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "725aeb92-6ae6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781767341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767341, "uuid": "436ada4e-7f34-4b4d-87f0-abb54d493b45", "comment": "Malware payload (Mirai)", "value": "72f8a4828b40ccc79e70eb4f27355952", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767341, "uuid": "b5b62ea0-7496-4b0b-91da-cec1a819a25e", "comment": "Malware payload (Mirai)", "value": "2f60da5b3f17085e96ea8f9f1509f9bd240ef76580d187d51562801f00559071", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767341, "uuid": "dd861e46-09f4-461c-a397-7bc68bd10088", "comment": "Malware payload (Mirai)", "value": "3ddba94004d6450aac153cf04f18cfad9ba377a5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767341, "uuid": "6fbec5f4-2f08-4a79-bf63-5b763f67518d", "comment": "Malware payload (Mirai)", "value": "2e909baeb65053354adb70c289701797e2a7cc01961aa980c64c15262b89949dd4e11278f53807bafb8afae4dcdb7c42", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767341, "uuid": "3d5fabc0-83f5-452f-8fcc-fa37e0449203", "value": "T168F2E08FD468BAD6CF5D593A954E03D01A0876E4F60E8E9C7721A800B63EC63FEE5451", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767341, "uuid": "bcb3cd91-493b-4ef7-886b-7409276cc738", "value": "384:vjmdG8wOqA4cctMKlhNJICB0U4m7LbamNHvrRqAiMCMdwXsCWgDoFWGep8EuBI99:Sz6ALcaWb0C7TvrRbLfaC9hKiQpZWMdz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781767341, "uuid": "54e9d3f9-5539-4cce-ae5e-c019f4b9ff6b", "value": 34540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781767341, "uuid": "62f51d80-faff-4847-a354-4f62982662f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767341, "uuid": "dd851cdd-f509-440c-8247-971e3cb4f78d", "value": "h0r0zx00x.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9904c11-6af8-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781775299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781775299, "uuid": "8220df7a-09e9-440c-b820-a004f434e119", "comment": "Malware payload (ConnectWise)", "value": "b88c90db7971f61c2abbbff0df94861b", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781775299, "uuid": "7c257a22-8c43-4f94-9b54-5685b9201934", "comment": "Malware payload (ConnectWise)", "value": "2f72cf399c018e5450da7bc69e11989d01ad0bfe49d3b88f494b160011a1d393", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781775299, "uuid": "8dae783a-ba2a-4aae-9415-1092741de444", "comment": "Malware payload (ConnectWise)", "value": "0a25eaad92d829d1516eef0414fa8c587199a036", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781775299, "uuid": "3f41dabb-35f8-4e73-befc-de3427555f64", "comment": "Malware payload (ConnectWise)", "value": "7a9f29e351e3e9958e0f44b8c29a79958db585caae5028ad8b8a98ac92c2f19e3b3d1731dc23c2c5eb339f3c4b863d9f", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781775299, "uuid": "431e205d-440c-4a1c-9f9b-d959d0d4d5fb", "value": "T1AD56F111B3D695B6D1BF0638D87A46696774BC049312CBAF5394BD392E32BC04E323B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781775299, "uuid": "7fde1cfa-f89c-4070-8c02-a75fc0f25309", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781775299, "uuid": "0cb0aab9-d0c2-4019-ad94-ed39da977689", "value": "98304:KzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zlgFeFCb:KhfefPtHxcp9ym3nltDUJV/o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781775299, "uuid": "89d19ead-57f5-40ee-95c4-bc290a9b605e", "value": 6057960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781775299, "uuid": "6db291c1-b48d-4adb-a2e7-5e15fd66ae6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781775299, "uuid": "b4fd8d75-aa52-4050-a06e-23a69ae3bf65", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41f4354f-6ae2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781765542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781765542, "uuid": "19ef79f9-4927-405e-860b-2c505f462b14", "comment": "Malware payload (Mirai)", "value": "559bcdebf9e72de09de04814310c4f27", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781765542, "uuid": "423e1edb-14b9-4c24-8ec7-b55a321daab3", "comment": "Malware payload (Mirai)", "value": "2fac050f3d73d1cb50c7e08d8de6532d1367ab018aefefca17cb0fb82fbc7d76", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781765542, "uuid": "5a5095d0-124e-4f22-b79f-f82e94ad2b32", "comment": "Malware payload (Mirai)", "value": "ed04f5fe331f8ca61fcf5359a025ea1e5fb3c698", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781765542, "uuid": "d284f982-d1f8-4a25-8400-c4e755cea28d", "comment": "Malware payload (Mirai)", "value": "39c2149cee291bee73731c448c133a9f7fe2e1a3e01b3c21e590b3a3859ea39b49a1f86419c1da8ae6af43d09822ac7e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781765542, "uuid": "6ba66c08-24cc-405c-b01b-e958e3944bc0", "value": "T19A357D5AF2F370FCC067C030439BDB62A839F46911226E7B65C4DA352D66DB01B29F66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781765542, "uuid": "56f846fe-07a2-4f6e-9bee-7594ed47bc6f", "value": "12288:1/aqkaiVDRqsRYpSJ0AT7ggW16aHHxoxpmXYmyUz+J9wcsR5k:1/aqkaiVDRqsgSvT7ggWhHWxgvzGjs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781765542, "uuid": "ead1a11f-bb07-4d91-82b0-6f8d21b39405", "value": 1102944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781765542, "uuid": "58b7aebc-a562-4d05-8c5a-a847441ea862", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781765542, "uuid": "3661986a-061e-42d0-b5d5-c7129f1effcb", "value": "nova.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d9f1cf4-6b4b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781810552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781810552, "uuid": "ada8492b-795e-44f6-a754-78b0419aa9a3", "comment": "Malware payload", "value": "e455ed0a73c794cfdd460b05de48591c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781810552, "uuid": "f1920921-7bc7-4015-8462-ed53e4ca9819", "comment": "Malware payload", "value": "300942cdeac4217d156d03b1032271a6ab59f8dfa826f05bcea12f1094c5c0b1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781810552, "uuid": "f97fae15-b972-452a-b4c1-5589529f39ba", "comment": "Malware payload", "value": "2cd192f603b535a234769dffcee00506953e76b3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781810552, "uuid": "e4cbc930-73c0-4140-98b0-89c4beb2fd05", "comment": "Malware payload", "value": "acd2e01b02b790d13e2514795baa9d2095e3951afa32a0a7f305ae750e9b268db1b97f52a0343609ae93f0e8a1337b87", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781810552, "uuid": "2aa30ef1-2c57-48b5-865d-c7c66c4f6dbc", "value": "T1F47330B513653A4F9A1A74719C17E8CF12455DB6AC23B2AFF2372BCEC14D58888843B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781810552, "uuid": "b81bb034-b31f-4854-a3dd-6b73c9f2b07c", "value": "768:mud5qMHoyJtSBhn2QIUkuMeCxOFNx2W6vMHnG9XhX3vqYlOuliQzAO3H6wEZcysf:zkORM/fFqDp1WfZy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781810552, "uuid": "f842c212-5e7f-447f-81d3-1f87eff171ad", "value": 73867, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781810552, "uuid": "81809d08-7ac7-496b-b8b1-24068693ff1b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781810552, "uuid": "f7cf4e3d-f9c6-4b57-a39b-95c52a3d1662", "value": "AXINSamples_0626.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e48ca9c1-6ac7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781754219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781754219, "uuid": "c4b19333-fd77-499e-a335-862e161a2d83", "comment": "Malware payload", "value": "71a00a285d53e02dd227ed5c815d9dcb", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781754219, "uuid": "6b658160-54f9-4722-8f3f-ffb3ca6e2854", "comment": "Malware payload", "value": "310e0a630a2ddf7728bb695a98609cd8fdebe312b1332eecb987959707330118", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781754219, "uuid": "90c3b2ca-b0bb-4990-b412-b322c58d2360", "comment": "Malware payload", "value": "9b32c4a506c3c51e2260ea1484a11dfd70d86962", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781754219, "uuid": "3aaf9f0b-cb7a-4858-81b2-78c325ed5a66", "comment": "Malware payload", "value": "6fb584da815876800afdf75eb958e38359ac596b79112cfc04dc19e7c097df5a81ad437d9b81c7addbd63697410ba78a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781754219, "uuid": "75a992a1-1647-4681-8c40-d1c248cb7b57", "value": "T1EB014CCA8540AA10402A959D22D751A0B411D3CF455F4B78BF9C6D3EFF9C518B066E94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781754219, "uuid": "ed3816c4-1d98-49f1-8cb1-5324eba0e62b", "value": "24:kXCKysE2hi0ziQvZohajvkpD6UJIxuXC60F7:e9Qp+MsjcDLIAXCfF7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781754219, "uuid": "38ed7dc5-6abe-4ed0-b799-bfe35b68d565", "value": 831, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781754219, "uuid": "6f26d075-57f3-434c-95be-b25536401a44", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781754219, "uuid": "9693d64f-efbc-4398-8121-82950361551c", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32307333-6aed-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781770240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781770240, "uuid": "ac6ce29b-76c7-426d-ba9b-ba669a27bb7d", "comment": "Malware payload (Mirai)", "value": "90171ea1d086d38d37f1dcc848e8406c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781770240, "uuid": "ca8668d9-d27c-421b-bb8d-0530136e8e68", "comment": "Malware payload (Mirai)", "value": "311b86d8758847e2d58cc0ebe5cd45ae4f8a2afbfc79c6038df621bb99980084", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781770240, "uuid": "3fdc4104-8d65-4d28-a5e2-f3cc41318cf3", "comment": "Malware payload (Mirai)", "value": "04fa56b9518314071d13342e74cfeecc04b0b597", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781770240, "uuid": "2cf748aa-acd4-4ee4-9e15-45d047c8ceb1", "comment": "Malware payload (Mirai)", "value": "491daf4a65bbaf972cb9c20eaa1284597078b030c8012dfdc70a806906365352096d926b118405d2b152b58752b66ddc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781770240, "uuid": "809929cf-2f1b-417f-a25a-4bf29f0e21d2", "value": "T1E89312DCD8B0FA56DC08AE3DD3DE0390732791E2772AC691E68EDC41263883EBD49448", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781770240, "uuid": "c31bf1d6-b1cf-4b70-8826-dcb5d952ce1c", "value": "1536:Y57yy6REJ7HGEcmYTH/tmmW2FuP9OLHp3yQWuNx:Y5fnxHGEGz1mqkOFC27", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781770240, "uuid": "9dd4b013-29f5-493e-9fd9-e70a36c97f21", "value": 90516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781770240, "uuid": "d19efd1f-7459-4f4b-a2f2-a869167cf6d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781770240, "uuid": "628f5703-7810-432a-9356-dee9605b733a", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aaa3ba8-6ae6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781767355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767355, "uuid": "3f243ff0-b2ab-4992-ada6-60b9989b2748", "comment": "Malware payload (Mirai)", "value": "c72d7c7410dd2a474b47294af9850534", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767355, "uuid": "7ab88740-fbcb-4e2c-8710-895d5f085be7", "comment": "Malware payload (Mirai)", "value": "3133d0257360710b6a1cfff49a84767b32b12b4a28a83aede4725262cc96ee64", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767355, "uuid": "48bdf698-7f62-47d3-a56c-63d6994b13c5", "comment": "Malware payload (Mirai)", "value": "1f7b91d4a9730d33cb48a48b42bbe7682757fe93", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767355, "uuid": "aa406df7-95a2-49e6-8118-01040143317d", "comment": "Malware payload (Mirai)", "value": "080394cd6f29285d3f53fa6ab9c8e30ab77479c0d0c61d1dc083d42f7e84c24f664cb803f8b3d73d06c014ed71aab81f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767355, "uuid": "5d805345-d029-4703-8d65-5834ceaafe31", "value": "T192636CD6F8009EBCF95BEABA41224E09F92172405F530F2BA637FC976D630958D1BC46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767355, "uuid": "91d7c8e7-2975-43b2-b30a-92fa2ab9fbbf", "value": "1536:UTySUBaIT0AWrFHSJNGcFar/77nLhGUjakFVUzyg+gkJxEZyr8gw/3:UTq0jrFyJNGca77dGGWNSEYQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781767355, "uuid": "9f3d6dd8-1f26-4dac-8442-34bb5f9f5976", "value": 73028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781767355, "uuid": "ddeb6781-a824-4024-9eb4-5a87f3638404", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767355, "uuid": "33f0a719-547c-4835-848f-51ac2201c055", "value": "h0r0zx00x.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f176725-6afa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781775818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781775818, "uuid": "c30e3da9-af53-498d-bb50-cddfddab8c04", "comment": "Malware payload (Mirai)", "value": "fc43f706ad147213d1631af32c9414fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781775818, "uuid": "fbdbdf83-f0d6-41f5-acaf-7eafc034571a", "comment": "Malware payload (Mirai)", "value": "317193f569daa5f3a34f067180b50fa1abce704c525dfe12d1cd1154fad4c0f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781775818, "uuid": "8d867787-c601-4788-b27c-0b5c08c27ea3", "comment": "Malware payload (Mirai)", "value": "5474ae47b0fced02d2900c9474eccaf812e8d973", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781775818, "uuid": "944f0c91-8a3a-48fb-aaea-24364f09bb1b", "comment": "Malware payload (Mirai)", "value": "4ceae84b3e9d50def8dc9023908da97965459612afe7e0a2c9f180918a481f33b8f083043d5f738daf1ff05d8c413c7a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781775818, "uuid": "f6b2403f-184c-47f6-b0c4-020c39c50778", "value": "T198F38C81FB43D5F5E90A05B02067E7379B72E53A102BEF47C7A89E32AC92641D51B39C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781775818, "uuid": "030dccd4-9fa6-4da1-93d3-c6a6269e161a", "value": "3072:f0AdPzcNAaVKvIDUGdN9JVIBnabJicgSEMfSNkbkUBG7J3X4eI8rvkGG2w3k:cWbcNAaVzoUN9bYnaVrgSXfSNkb4Bdb/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781775818, "uuid": "da595be9-6516-4f8b-85e1-1bb6a6d4ed3f", "value": 161512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781775818, "uuid": "6bbc6d90-89e6-4705-a404-30b60b09ce71", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781775818, "uuid": "8372225b-2f2a-4c43-be9a-35c60aff0ef9", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30a9e024-6afb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781776251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776251, "uuid": "43c011ab-28e8-4500-8cb6-d60db6a68171", "comment": "Malware payload (Mirai)", "value": "b33d2c2d4ce0c31c11fb5d06f543d84a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776251, "uuid": "959d9349-f3bb-408d-b2cb-820b92c05267", "comment": "Malware payload (Mirai)", "value": "31806d0617664fbc77d5a3678addfbc13b49dbf9e2f1741ad6c8e7df3a93c565", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776251, "uuid": "54548850-7317-45a4-8c3e-6c654992dbf8", "comment": "Malware payload (Mirai)", "value": "0d6c6d7251eb5704e7b4d7d7d1a2b71834a51020", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776251, "uuid": "f3976512-c993-465c-a6cf-1086872646fe", "comment": "Malware payload (Mirai)", "value": "c9f427e0a788dffd7d6b2a881c7c514c1cd4c04f640aa6561545b2518526007d8386145e42c6a3689087c8d092995215", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781776251, "uuid": "a2200f0e-4ee8-4813-b6f9-bf1f6718fe30", "value": "T13EF3398A9DB51E9FC06FCE34063E831B19ED599BA2F1B366863CDD08355E24846F3C58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781776251, "uuid": "4bea0b98-40f0-42f4-a581-39c36068c136", "value": "3072:F5LfYnFnHY3fpSXawzdMrvEO/nORPWDXOMU83QEI1s4e7fdA5pkek7i5d6A:FFWY3xSq+6rP/nORPWDXbUfEI1s4ezdI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781776251, "uuid": "df759a8d-3c15-45cb-9166-f7c3e95f58c4", "value": 166648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781776251, "uuid": "5745d700-4fa2-4e5e-8301-ef61bac85b9f", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781776251, "uuid": "753412d2-3e15-4d71-8fe1-1a4a2a767fc5", "value": "monero.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6b4cd04-6b0e-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1781784690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781784690, "uuid": "2ab07dc6-f515-48f1-910c-bd5edc45f3ce", "comment": "Malware payload (DarkTortilla)", "value": "ddbbd8a4eb30636dd2a057529fdb324c", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781784690, "uuid": "c7e1c565-7ae8-4240-93ac-b2509a609f35", "comment": "Malware payload (DarkTortilla)", "value": "31e351001b4b4cfad664fcb3d0eda202cd643215611bca3123e1167f0faf3af3", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781784690, "uuid": "32ad8123-3665-456f-8585-184a6997430a", "comment": "Malware payload (DarkTortilla)", "value": "0c58a9fb411b6171edc63de5f60bbfb717d62cf4", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781784690, "uuid": "b919ab6f-6317-4ee8-ab4e-d31f50969218", "comment": "Malware payload (DarkTortilla)", "value": "46282cb6f7c8ea41088bf4ff632a6b7b3398fb8a56aef5a426233d8838fec0e22ed626a829f961e46c331a8d196961bb", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781784690, "uuid": "6eb9a7b8-b663-4f71-828d-6a566ee7ebab", "value": "T1D835D0283DC64649D53C8F79C6731B4837F1D94A9792D307BFDA30A8891EB9AC904E27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781784690, "uuid": "62574e48-b06c-4daf-978d-c98a4b43b625", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781784690, "uuid": "0ef015a2-3367-42a0-84e6-77dfa7c9efd7", "value": "24576:/XaChmlb0HsBsxpbrqKR1N9SbmRi/M9RTiRr6://CssBsTbFN9SbmRh6G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781784690, "uuid": "bfbf9336-ed8e-42d2-810c-f38abf7f6418", "value": 1141760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781784690, "uuid": "aef238b8-b338-443e-bda0-085fb2f7aecf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781784690, "uuid": "c7f95acd-bf31-487f-bf92-81813835d6ab", "value": "Cotizaci\u00f3n para pedidos nuevos___Xlsm.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f12a4c1-6b01-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1781778932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781778932, "uuid": "07f01189-4ee4-40d7-b434-4fdfe243765a", "comment": "Malware payload (Vidar)", "value": "b75882a3ef3c9b2133252325f910ecec", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781778932, "uuid": "2e9ae781-9dab-489a-a7d1-e29ac23df2ff", "comment": "Malware payload (Vidar)", "value": "32ed61fb48b4d1e3fa7928f113b30f14d81f9e093e80c0f89b33d2a887d18f77", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781778932, "uuid": "16ee7f16-2979-47ca-951c-60fe8d205f51", "comment": "Malware payload (Vidar)", "value": "f31f1d28c564c3b9747afe0b5577757437980be9", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781778932, "uuid": "5adb61f2-306b-4411-9e11-a6c88ce927b2", "comment": "Malware payload (Vidar)", "value": "1d4c79cbdb5c2640ea364724661858af1bf8771305557eb7af18288b29f2d0afc501f634775d5cc77c5275f954a0babf", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781778932, "uuid": "1170c427-d8c8-4350-931e-dd342a66c208", "value": "T181E59D03ECA55AE6C4AEA231CAB752517B35BC482B3223D36E50B7B82F776D04D75348", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781778932, "uuid": "b683fe06-8696-4578-a161-b16d3e1f233e", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781778932, "uuid": "f18302b1-0c84-4877-8d70-fcf860615503", "value": "49152:+irbTTLDCHXLH2Fsv/eWnTvM2EuhfB0VR6cWLD8GDQkG:+uwWFmnrM27w6tDHUkG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781778932, "uuid": "aee3e15a-0919-448f-932c-3c0c436609b0", "value": 3308941, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781778932, "uuid": "38e2674a-4d6b-40d4-878e-452702c317f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781778932, "uuid": "3bdef3da-9ed3-4b5d-ac16-e4b43c8addee", "value": "SetupX64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f29e535-6ae5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781766880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766880, "uuid": "9cba9599-7d5a-4705-8239-853300ce0340", "comment": "Malware payload (Mirai)", "value": "56edc0536dfb6eda1e8ba6f4fef863f4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766880, "uuid": "ad4a4514-347b-44f9-81e7-4520c25b26db", "comment": "Malware payload (Mirai)", "value": "33b4c11373a66dfb2ee83159427a9eb0ec4eedfa34bd200cb546ea401b6efd5d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766880, "uuid": "7ebda16e-a9c0-4df1-925c-8ced8003291b", "comment": "Malware payload (Mirai)", "value": "1dc4a9e48f10420cfa509fa732ef4175e7a45741", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766880, "uuid": "c8d92e6f-3795-4139-b8aa-6dc6509da61f", "comment": "Malware payload (Mirai)", "value": "ef0c9a28ec250213568e519973f6d599e25ce8128c208370d14fcf748fdfbdf3dc097a78973b59c1b60c3f6c693ffdfe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781766880, "uuid": "7e18a2cc-012e-43fa-bc3e-7e886cad28ef", "value": "T1D7145C06731C0947D1672EF42A3F27E0D3EFA9A124F4B645755F9B8A8272D321489ECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781766880, "uuid": "3a4c36d6-335b-48f2-998e-85ff1abe50ff", "value": "3072:atAPduy7oq5Xr8LSMZenhJmVb+2PALfpxI89w6vDprkcpuxm1m/p:Dx5KFV+2P4pxI8a6rhkau1/p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781766880, "uuid": "146552d4-5c4c-4b39-ae8c-d4927db653b7", "value": 207856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781766880, "uuid": "694dd410-1479-42aa-b758-0909a05fcfc7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781766880, "uuid": "adcc7602-ce7a-415d-b71f-5a67f08e986c", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32e90e90-6ab1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781744472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781744472, "uuid": "994c4737-7f5c-4f87-a22c-a6a7f8b56d6a", "comment": "Malware payload", "value": "fdecb59ff2a0a9923b3623e12a9d65c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781744472, "uuid": "d27be263-c04c-498d-8237-f188d43d852d", "comment": "Malware payload", "value": "341e45c9f082943c0dd4ffbdf5b697930e41587b20b396391cd983893fc34c06", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781744472, "uuid": "aeb6bdd5-ce17-4f9a-9434-9164d7f0b8ef", "comment": "Malware payload", "value": "6fc1b00511211541adc6962e6ef56c18c8e875f4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781744472, "uuid": "08054260-d567-469d-a77c-3bde0c0d6f92", "comment": "Malware payload", "value": "7ab7ea7f01dc1771940092c6cbcd16af4782f0d3473e75c5e88dfc45d54591e7acdcb0a510867d188ce3d8da887791db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781744472, "uuid": "f7746437-a8de-47de-9bdf-6a35d4ba0e40", "value": "T17207AD77914338E9E5A98CB4D11025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781744472, "uuid": "7d52dc09-8734-429b-99ce-7d341c4e4b6e", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQq:cqYUQuVDt0TZEd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781744472, "uuid": "2cf304ce-af23-4b35-a0e6-18193fe37a1b", "value": 17268736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781744472, "uuid": "92372199-1715-4794-ae77-505c12bfddfe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781744472, "uuid": "eef76e2e-ee40-48a0-8fd8-59ac5df675ed", "value": "341e45c9f082943c0dd4ffbdf5b697930e41587b20b396391cd983893fc34c06", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd0e17c8-6afb-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1781776594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776594, "uuid": "f719e795-1a70-4c98-8965-4898e383cc00", "comment": "Malware payload (AgentTesla)", "value": "3e8157f2aa93880e46514aeb9e0e43d5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776594, "uuid": "01c29662-64ec-4e59-8ab3-64af15f9a44a", "comment": "Malware payload (AgentTesla)", "value": "36436e163209fd79020f7ebf1379726bd8c4709d38452d6b07dc281e1f2ff1be", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776594, "uuid": "7cd8db33-f39d-400e-9631-cadf313a62d8", "comment": "Malware payload (AgentTesla)", "value": "9e2a7aa89065b3c8eff8e5f2dd5de1de46ceaeef", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776594, "uuid": "0ee8d3ce-f710-4f07-845a-85e489feeccf", "comment": "Malware payload (AgentTesla)", "value": "fe5b490f5c279e6cd434483689fa7918e8553e4c9365c5c5bd9757f5b5536fefcdb6c16f24389078597d04ea300a73f3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781776594, "uuid": "ebf093d9-e8a7-4f8d-8275-f3ec0dbe992f", "value": "T1B8E43970DA20017B4F87AB9CBCA50661C66DD325862705F0F6D98B0D900ADECF7BD66B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781776594, "uuid": "75975d90-f251-4eb9-a0ae-66ef060bab38", "value": "12288:lEv6ZqDtx04b+AAq6kTwi6Xu3fL5ONn5nx93iquI60r7whgC3fuRhR0hL7FBr1cs:lM2qDtx04Srq6kTwDXu3fL5ON5nxhiqM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781776594, "uuid": "3e15a987-0f43-442e-a79a-76e397bd86c3", "value": 670929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781776594, "uuid": "862d5422-c54c-48e9-9d0f-330de7b079b2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781776594, "uuid": "ba38e2ce-5c9a-4a2b-9fbd-c7c3dc2dc1b4", "value": "BIK1910486_20260618.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7265655-6af7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781774731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781774731, "uuid": "2a5697dc-66e5-4b53-aa16-39f476f3651f", "comment": "Malware payload (Mirai)", "value": "3026163f86ec711aeda78f5649ed42d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781774731, "uuid": "58333563-0a18-4635-ac00-5d808a6bcd81", "comment": "Malware payload (Mirai)", "value": "378803853b9a91ac36c26132bba5447f16e8b53ff0766a7dc623ea11ca3fd86c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781774731, "uuid": "a0fbbc20-24e5-408c-97ef-a61d6201e16c", "comment": "Malware payload (Mirai)", "value": "089033bad7ef7c95fdd36102ec4245eb3b9ac113", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781774731, "uuid": "b1e1cbbd-45d1-474e-9ea9-ff3aa1db8ec3", "comment": "Malware payload (Mirai)", "value": "d135cbae9dbb8b0116b60d4dbe1a5598de2804294510830ce4b1dfeb8ab9454c45eea54ea8f49afcb8174e06ea8252a1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781774731, "uuid": "a3f2a182-f14b-4a1b-b4b4-2befb10a598d", "value": "T17744C61E6F228F7DF769877547B38E34976823D627E1E580E1ACC1105E6038E542FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781774731, "uuid": "0103b38b-ad34-4a4a-8fd7-d9f7f58e5b7b", "value": "6144:1DFTV4nxlY4vQwy607YbhXJz6uGa8eFvbHg:15/wZtrfvbHg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781774731, "uuid": "1d7a4625-e142-4226-8a92-f8288d33420e", "value": 277728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781774731, "uuid": "410685f6-bd79-46cb-b853-1725f61cab54", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781774731, "uuid": "32df3dac-c168-411d-90e0-5d03b7e86249", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "791b58ea-6ae6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781767353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767353, "uuid": "40603bcd-53fc-4c42-95ae-4fd2f62c7958", "comment": "Malware payload (Mirai)", "value": "f742e1d844303f8b8e9d8f2d7f6e0724", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767353, "uuid": "56517ee5-0094-417e-8ca4-e6f71e224d70", "comment": "Malware payload (Mirai)", "value": "379b283f8153d451f5c3cd1eeae85a0d8b161cb89f878e977e31c852a5682b0b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767353, "uuid": "0f6e3462-2a13-47e1-adf8-2e1f89afe49d", "comment": "Malware payload (Mirai)", "value": "39f447611302ce9e1f3a15663eea2a19e822603b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767353, "uuid": "1485d02e-220d-4cdb-a7c8-086172ea4e13", "comment": "Malware payload (Mirai)", "value": "1d6124820087e8247468b4e358ffc8bc2c7c1729863b2a5131c6af27488ff54378fd0dd37fd79cc7b246defb5f4167a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767353, "uuid": "75fe4088-e1af-4d92-adb8-7793a4b4858a", "value": "T174E2E0221388DCB2D5C2217516366343AA47BD7896C7370DE338537C76AA2FB6DF9602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767353, "uuid": "81823767-4c02-45ae-9a7f-8ad6952cadbd", "value": "768:EjMhwC9zMg/+IXK22Wx+8hYPg6lsrC1dmzS3UCb:L9zM6+e32V8iPgasrC1dQab", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781767353, "uuid": "f325d15e-2154-4487-8786-ebf58e12fb96", "value": 31880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781767353, "uuid": "e18f93f3-51b5-4f2a-99ca-081f1527edde", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767353, "uuid": "d37faca0-333c-48d8-b703-66ad71b8e3e6", "value": "h0r0zx00x.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "755b3aca-6ae6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781767346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767346, "uuid": "f4d14e8b-f21c-43c1-9ac3-5281c4bb26f5", "comment": "Malware payload (Mirai)", "value": "56e9acf0ff212e3bbc137fe7d2624565", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767346, "uuid": "5b6d0393-f296-4fc5-99d7-ece69b5b374d", "comment": "Malware payload (Mirai)", "value": "37faa583c1b6f64c2333e39b1f0a5d174690499a45fe79727df926110d33dd55", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767346, "uuid": "00e0e419-db7a-469a-ad70-ca2687398f1f", "comment": "Malware payload (Mirai)", "value": "b8ca8e8a6cc818046ded1e9041fa08913cdd39d9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767346, "uuid": "65baaf8f-9343-4fb2-9302-43b56f4618f0", "comment": "Malware payload (Mirai)", "value": "2a6747f6022c2233133b210dc198318dcf673196c801a30b0b763cced4bd5036735e455ef5592727ebf9decfeecd7ad3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767346, "uuid": "e1fd9303-5c26-4357-8fca-ea0df6f67b83", "value": "T14AF2E1E4D4EAF173D3F15A32F9322603668C1FFCC187656761A05BE536C385B24AA24B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767346, "uuid": "b20763cc-d9bf-49b9-930d-1a04ea19bc81", "value": "768:5H5wWF30zSqcLhfVcc3nDpzlyNv+fA7ls17Xq3UINy:5SKkzqNjnDp4N4A7l074Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781767346, "uuid": "213494fc-0205-4d19-8530-f6ec4405a4fd", "value": 36292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781767346, "uuid": "21716840-ec6f-411f-8729-c705c7a6a2a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767346, "uuid": "337a3b61-1786-44f4-b9ac-30cbdedc9a27", "value": "h0r0zx00x.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ada8db79-6ae4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781766582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766582, "uuid": "c11606c5-3bbc-49c1-9847-8824fd7f93af", "comment": "Malware payload", "value": "08ddcb2143d81e5b3c57e4ba08eaa4d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766582, "uuid": "7e6d3bbe-598d-45a3-a4af-1e4d969b60bd", "comment": "Malware payload", "value": "38246439d8717c9fa44616489d2c5051a9fa9dee62842e49c9cb1dbf08a0da3a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766582, "uuid": "a569a502-f176-4ffc-a449-c1fd3af0071d", "comment": "Malware payload", "value": "1dfa981876f2882d7e4c280717afb6176cf7bdd0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766582, "uuid": "3f0e5cc5-12f8-417f-822c-b943a4bebb66", "comment": "Malware payload", "value": "821f8f557a78c9a89691ef2aace19163061ff3c2a75467cb882aac90de67257e071f945af5115413be250bc142b24780", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781766582, "uuid": "6094055c-db5b-418e-b4b2-e1f3b6d67a93", "value": "T143A35BD7F800ED7EF84AD77B4467480AB230A7910A825E366317355BED3B1981937F4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781766582, "uuid": "70b29e1a-c0d4-417e-b86b-24bb1ad5d40c", "value": "3072:LuLcX3TfcYdbKqryIvyqgDOFl32xTFOjUprc2q:scXb55yIavqFkbYwc2q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781766582, "uuid": "09cd23e1-bfe8-4472-9678-5b292de69a71", "value": 101296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781766582, "uuid": "f90aa22d-f9d1-4e49-b68e-85de1d381f32", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781766582, "uuid": "801e0cd8-7e38-4b16-b73a-f0c2ca385c21", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40b18696-6b33-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781800329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781800329, "uuid": "082f3217-b60a-4477-87a1-3841a86238c9", "comment": "Malware payload (Mirai)", "value": "baf7843cf0307919d1290cce8d7d3313", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781800329, "uuid": "d68e6921-57af-42f7-bce2-3d4b8abb4530", "comment": "Malware payload (Mirai)", "value": "38246985437283db7c645dc5a787ef49edb99001833b24794ef28094d6f3b9d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781800329, "uuid": "aeb0aaa2-ba16-49f2-a77b-99b4c5b0d372", "comment": "Malware payload (Mirai)", "value": "242ea1dfc3e9bb3ecdac23a224ecce489909e022", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781800329, "uuid": "6e6504e4-8dca-464d-85da-80987b30967a", "comment": "Malware payload (Mirai)", "value": "6551687aa13ea0e396d4436b728fa48d04437ed8222896db42382bb17bd6f0f31a698044f5fdff77c1ba3be47819be77", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781800329, "uuid": "b69ef759-0fb3-4262-84b7-d090a1a273c5", "value": "T11E83E942BD429F13C5C221F6FBAF019837266B79D6EB32429931BF9023868DB1D67611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781800329, "uuid": "5ab57798-f3e6-475e-91f4-16448d3dca4b", "value": "1536:XKDLhQ3BlLywjmConIxqPONj6uKBJw3o2zKPTfqtGgg8q+j0An+HfuPa:XKDqXjmConIxq2Z6uKGzoTfqWA+2Pa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781800329, "uuid": "cdcf9f46-4df3-4357-a35f-436b7fe67d95", "value": 87436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781800329, "uuid": "5f22f277-4fd8-4ff7-bea1-16ef7e72c168", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781800329, "uuid": "85abefba-51e3-4d27-b52d-f93d02333bec", "value": "manji.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b09d74b1-6ae8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781768305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768305, "uuid": "9c25b3ad-a2b6-455e-aeb7-abfa338c1c04", "comment": "Malware payload (Mirai)", "value": "c68f7297ea30656272bb3c8f4a0006ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768305, "uuid": "7e7a53ae-4cfc-4e07-ac86-152278405655", "comment": "Malware payload (Mirai)", "value": "3863af7dee8e58e1f0495fb8c61b3f8a5d6a4acb5ab472a52d6669f804999353", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768305, "uuid": "d4146146-f071-4be3-bd1a-0f9e04fb65e0", "comment": "Malware payload (Mirai)", "value": "89bbddad0b776285342f25e2b38913c8dd9f20c3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768305, "uuid": "90dc2f1c-ad79-4b9a-82ee-c024aebaca3c", "comment": "Malware payload (Mirai)", "value": "e04c85f388c5a86f3e6dc50ae618947d1802c54bb3afd292b1700d59278c374d853294142eceedb2a8448d605816a35c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781768305, "uuid": "021e4386-7cdb-4f18-b279-927d1a21655d", "value": "T1F744227C7DA7EF3ED59494BAAB14A0B7775264BC24482F171888BCF3173A2C1614DE18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781768305, "uuid": "c7d553fc-81df-4b28-9a53-3bc67c821e14", "value": "6144:9TvGL4PBMKg2s2KJpxiirZMmGT0E+Q3GBUiyq:tpyfQKzxvrZlE0BU9q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781768305, "uuid": "d40a9ab5-79fb-4064-9b35-3cbd7ae8c3f7", "value": 272124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781768305, "uuid": "9e70d6d4-60ae-4361-98ff-1ebfb31c35e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781768305, "uuid": "9d6bc151-cd0c-4d55-8085-4306976b415e", "value": "kaizen.arm64_srv", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fffdf4e-6b27-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781795228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781795228, "uuid": "6f8f06fd-488b-4521-80ed-32447f13cead", "comment": "Malware payload", "value": "43e944c8452afdc6c37769fb92cacebe", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781795228, "uuid": "e8fd00fc-1a0b-4388-8b76-03901aeeab2e", "comment": "Malware payload", "value": "38a146a9ddf7ebc98c7933008c221b0f23a47f57fe38db3883c8fcc794b8e0bd", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781795228, "uuid": "0753c3c2-d3a2-48b0-9a84-04092e2c9924", "comment": "Malware payload", "value": "e98ce5161f475c9027ae2e7c7dea295a205142f7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781795228, "uuid": "e341475f-30c5-4c48-88b6-e52ab32e3253", "comment": "Malware payload", "value": "22016aedf025574a683099539ab0d0a845f69297fbb9a217922b597d3db41e781f30777e77711c9544cdb755fc611f76", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781795228, "uuid": "c7892f9b-f8a6-44f9-a86f-7a7cf29df33c", "value": "T1953393C93AC5B5A04606F03F2D2FE0A7E16D4CC1BB4D9088F335B559F864728D9B97A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781795228, "uuid": "75cd85ff-c3c8-4652-a33a-af6d872b4b74", "value": "768:kcJPDsj1+t7qFGoWZJpKhnvgZAKzEB/c8fNxTBuktSX0PzVzhbI:kcJQjMtYGVMvgNzEJc8fNxVCEPz9hbI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781795228, "uuid": "145e3c53-fa30-4ff5-bd9f-34a0e72c4f92", "value": 51919, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781795228, "uuid": "42c680e6-21b7-49a4-aeca-fa2c70cad08e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781795228, "uuid": "a427af06-5274-4748-ae43-43291fc4e39b", "value": "HAKHURDACILIK M\u00fchendislik Fiyat Talebi Hk... 2000 adet 20260618_586311133_250527132701.pdf..js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b77e8ff-6ae5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781766873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766873, "uuid": "615507b0-d873-4e2c-984e-9f11f84537fc", "comment": "Malware payload", "value": "c226016437b8342040181c0be84b2c51", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766873, "uuid": "2712d379-6318-419e-b07e-7b0967bde970", "comment": "Malware payload", "value": "39931fee767a452a44947a69e1cf71e3d61b10516ed1be06f4b4fe17bcf812f1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766873, "uuid": "519bacf5-45cc-409e-a6d4-d3c9cc00230f", "comment": "Malware payload", "value": "6e587c06a1091be5eaf19be04b0d8903c74f580a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766873, "uuid": "73bec233-9a57-447b-9632-36c82626e949", "comment": "Malware payload", "value": "734baa7235f8f2163a0f069d1b95ff5aa05bdff14baefa3fa7e773150ceb99f30f5e0223785b36f7e788096924ed2a29", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781766873, "uuid": "af9e383e-e142-44c9-b680-671d140dbc9f", "value": "T18AD3964E7E218F6DF668C73047BB4A21E7A923D623E1D740D1ACD5111E6438E681FBAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781766873, "uuid": "c812bdbd-ab20-47ad-a241-f4079fbdf148", "value": "3072:XyY2ghbo3MbuD+7gXWL1L8PHY7oMzrdSr5CteIrCjyRtSdVI:XOgh+Mblx1QfYPdgOMjyREVI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781766873, "uuid": "b1aedc2a-43e3-459a-8b0f-b9277ddce682", "value": 134164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781766873, "uuid": "195c3fa9-ae98-44ba-aa7d-ed03067d0a04", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781766873, "uuid": "9198d0f3-98dd-4fd8-a05c-3fa4d781c959", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18699bf0-6abd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781749581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781749581, "uuid": "0cb65703-738a-4b00-ac9f-62f9ca466c29", "comment": "Malware payload (Mirai)", "value": "36ad34f579d6e6615955a3f92e8ee436", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781749581, "uuid": "0a4ae969-f0d4-4957-b1b7-a28784a0ae2d", "comment": "Malware payload (Mirai)", "value": "39cce18f94792754f4e55cdbd28f203aa14565f5dcc6549ba329a59b18987ed9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781749581, "uuid": "53755352-c255-4e08-a79f-14695ffbf243", "comment": "Malware payload (Mirai)", "value": "a2469233937f65e906eec921357f81ce9f201167", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781749581, "uuid": "da259852-36cf-4c04-9455-9669fedbbc9a", "comment": "Malware payload (Mirai)", "value": "d08466b2245a48034cd2cfebcc512ce9257dafc2b865dd3cb56258cdffede755a367c5e1e09fb564cd471bb3e9f09963", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781749581, "uuid": "5e00a732-f3b6-48e0-bedb-6d19f765a1eb", "value": "T1E3158D9CE78BE0E1F26340F1025EDBF65534A12A5013FAF2FF85266370727616F1A25A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781749581, "uuid": "1d5f0bd5-755e-46bb-9b04-2df84d300792", "value": "24576:JVs4/3FEIDhofhowjCvrbfohd3wePUhN:xhhofhowm0/Hw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781749581, "uuid": "6185883a-14f1-40f1-a752-14c3745b5200", "value": 902520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781749581, "uuid": "778592dc-a7f5-480d-9e0a-b446ad2d86de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781749581, "uuid": "1924aeb2-016f-48dd-9cbb-d7db08e70a79", "value": "data_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a29c024b-6adb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781762698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781762698, "uuid": "423eb8f2-4782-4f38-9a80-6cc30000166e", "comment": "Malware payload", "value": "041a1e005e4d0b9871c6654bdd12597e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "purmed-ro", "colour": "#29855E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781762698, "uuid": "6d65a580-e6ac-492a-afe7-1672800cd74e", "comment": "Malware payload", "value": "3ae7a248a76d32cde3b1e90cc75371a2e8483a3555bb2071ea4c12e9aba80804", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "purmed-ro", "colour": "#29855E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781762698, "uuid": "464d3b81-63a1-4f22-bc97-eec6c7de7622", "comment": "Malware payload", "value": "cc3b62582ae867c7a1abe3acc02f929ca4dfac28", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "purmed-ro", "colour": "#29855E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781762698, "uuid": "6a672cbb-2fab-40ce-846c-a44fdcccdda0", "comment": "Malware payload", "value": "0a2047451a810ef02633cc005fa1360fd025add634821a8d4d60569b022cc885d7cf43e5f18288bb1d9e9184fba503ee", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "purmed-ro", "colour": "#29855E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781762698, "uuid": "26feca7c-0e43-41a6-8be3-c8c32c5c70dc", "value": "T1F51402DE4D2A7B3B8DEC788611564C2E0376A71D70868CC35C1CA88ECF25659366DECB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781762698, "uuid": "5a950781-d319-4742-b786-7c40df40c7de", "value": "3072:j+RiBkpY6u/As2HaCgPOwdpIp0Hpunf/UudspHII1RjfpN/nTIj6bXDh/N9A:wAkpYn/UXgWsIeMfNdfILjLTIed/bA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781762698, "uuid": "38dedc95-4399-439e-ae6b-ab0950160086", "value": 205552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781762698, "uuid": "bec288cc-7a22-45be-8502-47f747dc3319", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781762698, "uuid": "65abe104-8d59-4836-9267-95ac9a634a61", "value": "Odours.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f60835b4-6ae6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781767562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767562, "uuid": "195bdf51-6ddc-45a1-9998-633ce1de37d8", "comment": "Malware payload (Mirai)", "value": "741908e794b5afe13f8210aa05b54d58", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767562, "uuid": "9d1ecaa1-41cd-4c81-8753-fe737ba46a50", "comment": "Malware payload (Mirai)", "value": "3afbac597480f6d6dc91c2b7dcb806cd774f31d48f2d744ba9634ed79675efde", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767562, "uuid": "942ee6cb-49f7-48b8-b726-d8ead975d260", "comment": "Malware payload (Mirai)", "value": "a5648a965e3954f145049eb4995048a1ccd8852e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767562, "uuid": "f7bfe4cc-d069-4082-a7aa-a93a28c2d079", "comment": "Malware payload (Mirai)", "value": "b6f5650865967b1feb6b3f2360d778ea88ec89e2074f6047777a628ed3b62769d4567e62ff4ad70c9ea17bc487a34949", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767562, "uuid": "0cea8f7d-8709-41c1-9674-981449843224", "value": "T1A3635C0277584E47D5621EB4293F1BE093EEED9021F4F5892A0FDB0A4236E732586F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767562, "uuid": "f369c8a4-f1de-48d5-a207-7100812fccbb", "value": "768:e3tizG3iGBYE2KQv0R23UN2mMWZSGWo/sHwg+1kkXB60vV9+BZR7soaGcFNFI6AV:CCGYKQsHMISjI9cGV9+BZloGgFIXdmI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781767562, "uuid": "4b8c89e5-3542-407d-93ad-97d53ea0b2c7", "value": 70752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781767562, "uuid": "404b2dc0-4f75-4608-8a7c-80f508bcbb5d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767562, "uuid": "7f788de0-69ae-4fb0-a2a5-f5dd92267419", "value": "h0r0zx00x.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a83504d8-6ae4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781766573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766573, "uuid": "b6dd33cf-62fa-45d3-b4e8-ae9150f8d8a6", "comment": "Malware payload (Mirai)", "value": "7601430017217aad1842ddcd76363256", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766573, "uuid": "c3d8800e-51f2-4ec6-8822-269e4d3a900b", "comment": "Malware payload (Mirai)", "value": "3b2caf41f02937acd587d957b3b31b5a644b0d39d8e12ded0ed59b3c5b265e62", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766573, "uuid": "47144190-7768-4f6c-8e4d-c63d4488040b", "comment": "Malware payload (Mirai)", "value": "a7c2994344e03b6fb8c65b3521d0881cbf8c3ed2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766573, "uuid": "6de2279d-a5ba-49c8-91f2-90fbf89ec3d4", "comment": "Malware payload (Mirai)", "value": "8c88e3c21ca0852d31fe59a32878a77549e221363bcd0a490b3ba95f585c039b6d4c97189a102724210ad2256c796383", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781766573, "uuid": "781eb45a-b3e2-4ba4-ab7c-9e72f65875cd", "value": "T1BFD36D88F283D0F6E9430574247BEF369B32F0B92526EB46F7B45B3D9C61540DA06A5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781766573, "uuid": "945956a6-97d6-40d7-97a9-53bc8714ae14", "value": "1536:1CP7L0XUMcD15xb5P2YdINvDe+zMcFLhpJPtLbP6U9jGAPSjhhRr0lADxp:K7L0jM1X5PRdI5Den6hp7biU1qj50m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781766573, "uuid": "646fe90b-3492-41a0-b366-ea7cc01bce1c", "value": 134668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781766573, "uuid": "f377443b-4d64-40d5-b969-dca799236af9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781766573, "uuid": "9bfe05a5-3fe8-4c7f-a641-e3ec612963c9", "value": "onie_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9207e389-6b6b-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1781824518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781824518, "uuid": "b10e1dff-f6ed-4c8b-a906-8009869448f0", "comment": "Malware payload (WannaCry)", "value": "7d7e02014269317c841dbb735c4df80d", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781824518, "uuid": "df0d9fae-b113-4c1c-b492-eee575cbb1ec", "comment": "Malware payload (WannaCry)", "value": "3be6209a04506315aa497599f3c1cc2c0cae30f0ea874882f413b1da39c42634", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781824518, "uuid": "4d7e6c46-59bf-4418-95f6-9f339a3f24ed", "comment": "Malware payload (WannaCry)", "value": "a9ff2ffaf5b785fd5b9e041267a532688bd19ecc", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781824518, "uuid": "cfc7eb20-62a6-4dcb-ae5c-a1d3859ab83b", "comment": "Malware payload (WannaCry)", "value": "9da825ea9aacd181fa5413b6f569b41fc4377d0282f1a1a13971092c5b3fe75c85e1b088a9ec98d678aff1edeca154c6", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781824518, "uuid": "bfae935a-4c93-4c64-9d00-11175ed13492", "value": "T1DF36231532ADC070C023923588A69B65FBB2BC185775914F7FA48F2E3F737A1D226726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781824518, "uuid": "26a4c55c-9b74-4c19-8f06-6b35025419fc", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781824518, "uuid": "83da593e-9cdb-4175-82eb-07147cfac568", "value": "49152:jnsnpEKUv9wC7n0fCum3iDimIf1X0TMnpP5li1pmsRfP9HsRj:DMpyv+afN3iOmIfyT+leR9HCj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781824518, "uuid": "c51c7531-8dd2-4d04-8a97-f1208041a4d2", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781824518, "uuid": "27bf76fb-5b86-40ef-89b4-c265c70edd00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781824518, "uuid": "a0b4aed1-6db4-421d-b690-3183f95ce7d0", "value": "3be6209a04506315aa497599f3c1cc2c0cae30f0ea874882f413b1da39c42634", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eb526bd-6aea-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781768919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768919, "uuid": "8d7113f7-0146-42df-9bbd-493bd72fd279", "comment": "Malware payload (Mirai)", "value": "010745d9629124505ddda178e711ce37", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768919, "uuid": "726aea15-3c3e-4331-8f05-fe500e023eae", "comment": "Malware payload (Mirai)", "value": "3c849720898132b3f8c93dcefd11a6c55ebbc3bb8253276a1a4d9a17672cfbe3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768919, "uuid": "5f6f8ae9-14ab-44fa-9fdc-44658a18b00c", "comment": "Malware payload (Mirai)", "value": "ebefbf2af9fe08f93b938b933be70b83e78282ad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768919, "uuid": "93c5fa1d-31fb-4390-ba02-c2a39779eeb0", "comment": "Malware payload (Mirai)", "value": "b22179cad5de9be7739d069665b7a39ff53d159f9fdab7d3cd61b595abaea53611fded7644a42175f02d8453b04a995c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781768919, "uuid": "b1d1c948-9484-4bce-a9ba-d6844418a57c", "value": "T163D3C90AAF640EFBEC6FDD3706A9074235CC645722A53B763674D918BA0A90F49F3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781768919, "uuid": "e8d65be8-e166-4799-a3a7-182aeb2904a4", "value": "1536:doU1nDDr3qFmECmF+61xXs2p6ZCz3wHjqNOf1t8zVkpXHuZ3dd7QyVOZvHk2zz63:x1DiFmsZTZpCUVYYdlQyVDZ+nQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781768919, "uuid": "c923eaf9-4cd1-4379-91a8-34b5b05bae02", "value": 140048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781768919, "uuid": "e98a3c5b-70ff-4ea1-aff2-36c398ffef27", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781768919, "uuid": "eb3e1885-1f9e-4e3a-982d-58cb7d748fac", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d08452e5-6ad8-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1781761486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781761486, "uuid": "2874a2e2-a806-43aa-bda6-c9946397539a", "comment": "Malware payload (Formbook)", "value": "49f273b1c605d717495ed437fbd3b5ef", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781761486, "uuid": "73ec9b9c-b26d-4acf-93cc-ec8f46814a56", "comment": "Malware payload (Formbook)", "value": "3d5866fc83f0bba01201b68888a75827195ec55978d19ca99e6f602a1adf8f0a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781761486, "uuid": "d0050a08-9bb7-4fcd-8754-68b5b7578fe3", "comment": "Malware payload (Formbook)", "value": "a0dcc6eda5a76076cfd4b1d0d80ced82e9bf39ba", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781761486, "uuid": "2835c608-c654-493b-8c89-1c671f433c95", "comment": "Malware payload (Formbook)", "value": "a3caec75aca769d6abab0cc7dbf3ea9ea671cff9f042a7bf8aa346089b98e95d590c4cd4e9c71781d97d458a3fbd0be0", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781761486, "uuid": "6a4a71cd-0344-46ed-b87c-282a8a335094", "value": "T1C3E2748D36C1F06842D7A47B3E2B7195F12E1C80BE48D448F7A9B1E4FDA4B2CC579688", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781761486, "uuid": "3300e540-1965-41d9-a149-fad7471e0d2b", "value": "768:kBe+usG77xs9HVhvNVyW7Rvm8q8JRqRMl9E:uNz9nlUg0G3qRx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781761486, "uuid": "d0a08188-8de6-47db-a615-5a7eb7e81ba5", "value": 32574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781761486, "uuid": "347e98c5-fbdd-4c50-a618-106916c42087", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781761486, "uuid": "d0f6f18b-599b-4f17-b9cf-42da7162ea33", "value": "RFQ Specification.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cccac71f-6ae6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781767493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767493, "uuid": "65ddaccc-c033-4ff4-a7b4-2c10d1bff319", "comment": "Malware payload (Mirai)", "value": "1686f2c86eb8a69278d9d8a53ff680cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767493, "uuid": "6cc2685e-3c28-43d9-8e7d-e32bd32b9cf9", "comment": "Malware payload (Mirai)", "value": "3e78e77a15d3c9dde980ad9fb364bae95fae9df5de2b9953530c755901acbe0a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767493, "uuid": "9af048f2-a5b0-43cc-a617-d3ff5d2f5933", "comment": "Malware payload (Mirai)", "value": "cd3945e33cba227c24371f1dcd42e120cbd0a88c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767493, "uuid": "565dcf81-de1c-4eec-9ddd-4d2cb0d43962", "comment": "Malware payload (Mirai)", "value": "d17077ee57a98987c6fe34df6a78a85d1502bb54b5d14724f9c68a48f42d74a8a12defee0ad203b33a93ffe1e9a0c11b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767493, "uuid": "2ad63164-1d25-4981-81d4-82eb94b1c3e4", "value": "T1049372097FA10FF7E8AFDC374A992B45289C641A21A83B75BD34D418F24B24F15E38B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767493, "uuid": "ad3772e0-8f39-41cd-aa22-fc535af68dad", "value": "1536:puTI2tAkoAluPsx3G5VZ5SbzMWvZAkoGZ594:pWDtxuPsx3GTWvW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781767493, "uuid": "24383122-d226-4cc2-8bae-2747ca5c08c1", "value": 96432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781767493, "uuid": "cf6e599e-8eb3-4a93-bacb-d6e3e3b3cb6f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767493, "uuid": "4444b939-0769-4048-b37e-5ae3af6d83d1", "value": "h0r0zx00x.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eb9bc07-6b2d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781797722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781797722, "uuid": "789125c8-b5df-4c7e-9cf8-46060ec179ad", "comment": "Malware payload (Mirai)", "value": "3e06f127e5ce3b6ca503451469390f4f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781797722, "uuid": "813b11a8-5465-4c7b-907b-bac8e367a836", "comment": "Malware payload (Mirai)", "value": "3ed9d6708c03617f4ccf7ef24013d756abbeecc8307b70788588fd0e96e66936", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781797722, "uuid": "7f443436-4732-4e36-b915-00b1e5b97c4e", "comment": "Malware payload (Mirai)", "value": "860a3f7d07258376ba11924f001013bf39fabbbd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781797722, "uuid": "bf16e47a-7ee6-44ad-9cb9-bbf34105126b", "comment": "Malware payload (Mirai)", "value": "921ee548343db309932474e03312d048ff322e0847cf170e51f0e12290b058e1dcdf6b11969f43b6e3c42d6a7f404e5f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781797722, "uuid": "37c89088-ca49-4930-96af-15d50e9e1703", "value": "T164B33B4AF8D0EA22C5D4667AFA9D029C331317B8D3DA7102DD14AF3533EB55E0B7A606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781797722, "uuid": "16b33c20-4f71-454f-84fa-b9dc9ebc9283", "value": "1536:wV7Qw+ULLIBuITzn06Zl+hcENn8FxxmaCYOucNRgWbRdHvwWObwgI5YSu6xb/+yd:w5N+ULs8ITz0OWcte1gybubwgXw/vEG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781797722, "uuid": "05d39a1e-0a9a-4a7a-8a5e-9a2cdc8e6920", "value": 111940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781797722, "uuid": "cc6fc4bc-d83b-4eae-a4e3-d9fcec7ff36e", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781797722, "uuid": "ffc6e793-0b2a-4eba-82ee-b9c91e43042d", "value": "monero.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8bf3aa4-6ae6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781767513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767513, "uuid": "78a22d40-8b69-485a-974a-6c77dc362517", "comment": "Malware payload (Mirai)", "value": "0ac974fa1a060064a1045719dc871b49", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767513, "uuid": "14f1b875-de6f-4d74-85e8-38b464aafd03", "comment": "Malware payload (Mirai)", "value": "3f885c101530f91afa94511a53a10b7a48661d476943069698f520f9a2ac5b53", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767513, "uuid": "066ee1da-8965-4d4c-96f5-1299036b2566", "comment": "Malware payload (Mirai)", "value": "6f3e453f25efbb75afdfb2c9e35f56f8c7c1e57a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767513, "uuid": "1a4c7afa-3cb7-47a0-90f8-3045fbedde16", "comment": "Malware payload (Mirai)", "value": "e1d21a9d8cddf793fe383cbc50b533a2a83cd4ba927eedc04796bd0bd0ef126529bdafe5aa80832bd53eaa23c93f1548", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767513, "uuid": "0e444c06-797d-4e8b-83d3-8b323cb24e36", "value": "T1CC73F881F98B40F6C5074A3050ABF63FDB31E5BA417097ADEF5E9E35DA63601920728E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767513, "uuid": "026e02e0-d94a-4f7a-ac8a-7e2eb326d5ca", "value": "1536:39jAXr8B9C2IdHpSM7mQ09Qst0iJVxfb7BUv4BFshmG8rm3u:pAK9C9dJD7mQYtnVxSQBFshb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781767513, "uuid": "1c381556-cae6-47cf-9f2d-ca204074ff4e", "value": 74512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781767513, "uuid": "6f12137d-c494-444a-b62d-7cfdb66f3b9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767513, "uuid": "90e7d0a1-cbcf-4607-a9ef-847fabe9626d", "value": "h0r0zx00x.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ddea0f6-6aea-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781769106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781769106, "uuid": "90bdc487-35ce-4214-b173-533458ca9b84", "comment": "Malware payload", "value": "466de0180ebe5b0bc7ac7b26cd3c5092", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781769106, "uuid": "44211d51-9ec6-4881-883a-034710e88c20", "comment": "Malware payload", "value": "40542ae4acd96f5b8a3e250d5ff7e52002d9f0a3dcc53c18135723f15fd15242", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781769106, "uuid": "5aeabe98-85d3-4dec-be60-d183d597b200", "comment": "Malware payload", "value": "05c6036a43613b509e96f933492a64cde45449eb", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781769106, "uuid": "ed148d31-10aa-48b7-aebc-888ba00855ae", "comment": "Malware payload", "value": "f211b48b89d90fbd2e5e2ab973a4b60d6e23b0346495b58a9dc8b22d05066b9073dd6c7d9b1d18a9221411138838e2aa", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781769106, "uuid": "5b0c2787-0cce-4bdb-bb76-6627f750e7fa", "value": "T1EA138D6956857C24AE99883B1C7E2F0CB9A983E1310851EDBFCB3CF58C496DCD219B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781769106, "uuid": "7691cd83-2975-47b6-826f-d5714c948fe5", "value": "768:Cm+b9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:v+sco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781769106, "uuid": "a4cdbeab-34c5-4331-bcd3-88fd2424dcce", "value": 45227, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781769106, "uuid": "eab0b40c-73be-4c9b-9326-79fce8a0c84f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781769106, "uuid": "d9e1f437-94e7-4802-842c-edf422e3ccea", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4a17314-6b5f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781819449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781819449, "uuid": "c5f409f6-072c-4cbe-8d37-c20c13704be2", "comment": "Malware payload (Mirai)", "value": "07c94901a05b7aabf6d720e5e93f9263", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781819449, "uuid": "ba91c5ff-0d42-4072-8386-b8fbaa7c1668", "comment": "Malware payload (Mirai)", "value": "416e254e6584d09441490b2c54c94788ae85d4231d82bff28507d8958ad34f72", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781819449, "uuid": "84baf568-8c59-42c4-806d-e24c2283888e", "comment": "Malware payload (Mirai)", "value": "5e1b671a435a45bc2a625d95a21341dd57a990a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781819449, "uuid": "a6c7772e-ecf8-41fd-8fb0-77c74a33eb2e", "comment": "Malware payload (Mirai)", "value": "9cac3d9be12eb5578d84c582642994f9eff98ea59041746b83590377df54a7c11e7cb4fc35c89f1debbd823c3c68e251", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781819449, "uuid": "d203465b-3bad-4b80-b7a7-33e705ada55b", "value": "T1B5242945FC919E13C6D522BBFA5E428C372A13B8D2EA3103DD225F25378A96F0E37641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781819449, "uuid": "24762d0d-edb9-4137-9d61-ac9fa09c2bd0", "value": "6144:tuevA36oDGVfN+GY3YLX4jY6z51KORBJ:tu8G6oDGVfNpR74L1tJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781819449, "uuid": "8ca434c9-b71e-4468-a4cd-4a22dfa8b131", "value": 213120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781819449, "uuid": "94a493e9-081b-49f5-90e8-fec2fb2d7a85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781819449, "uuid": "85f7c8c4-a991-4485-9d84-dff88a67ff54", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0aea0ee-6af6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781774425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781774425, "uuid": "f762ceda-a4ee-475e-a577-feaeb5814cd4", "comment": "Malware payload", "value": "783ed2ab5f4fb5096672e4aefcd0f979", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781774425, "uuid": "3b0fd202-981e-44fb-9a8f-913d169ecfab", "comment": "Malware payload", "value": "420d23a8e67e26779e532c6fa973a7dc9705cd9a7f1cd5dcd495a35a75008e1b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781774425, "uuid": "2f69664c-4718-4f8f-94cd-7ed6adcf8bf8", "comment": "Malware payload", "value": "6da6b5ed4b3c602f27c7ea5b603c39c81d7bd218", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781774425, "uuid": "f14b946a-5e3f-4d30-a488-80d4e75440d0", "comment": "Malware payload", "value": "97c4d14ad26100b685442df46f495e8b10bb41baa9f2f05f14a51bbf9e431d476036f05dee13227857fafe10e405b516", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781774425, "uuid": "49511654-d460-41e5-aec2-a300a9a31b22", "value": "T1BD761857B8924942C5E43A37B8BE81C433631EBA8BD712576D04FE383ABE5D90E39744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781774425, "uuid": "04017dc0-25c3-414b-b4e8-6fe52109440b", "value": "49152:D5ZpICjNCdi5LbZtGGNsUDJsGlMR6U7JBJtTp2ehSI5Eq:D5sCodi5LbZtGGNs6qJtd2eLEq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781774425, "uuid": "8fdbcc0d-3431-4053-97b1-1f1403686bad", "value": 7340216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781774425, "uuid": "f2dd3e82-8285-4729-a885-c4642b977c9b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781774425, "uuid": "4881b76c-eb47-4dbb-bac0-ceffe9738b5d", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e403d78-6b32-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781799949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781799949, "uuid": "b3f8ad6c-6c6e-4d7d-a668-ddc829454737", "comment": "Malware payload", "value": "f147f2969b534836249aee576db3c0eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781799949, "uuid": "2e234ddb-0e90-4d76-83e1-60d2da9c373b", "comment": "Malware payload", "value": "4292f1754f045411aaa957d602757ea81f005d29a3bdeb792eea3737ec97be6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781799949, "uuid": "221055f6-f315-46db-a0d6-cce80164e304", "comment": "Malware payload", "value": "a29466faee59f7933331d283b00218bf3b3c340e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781799949, "uuid": "cb8426b4-9c6f-4046-960b-32b8e7204996", "comment": "Malware payload", "value": "8ec8943909cab29312448746fd92c93710283fd23bed40ab55c0deb6e893f7382a6ffd5dc66c6e88e11aada31b23c746", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781799949, "uuid": "b0b5aa24-1992-4f45-89a3-b5962c102da9", "value": "T1B1C56C07FDB258A6C0AAA2318D7292917B71BC443B3123C7BA90BB792FB37D45974354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781799949, "uuid": "100f8c6a-e8a8-4b3f-a1cf-7387aa9564af", "value": "d203f9672085bd7924a65988545977e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781799949, "uuid": "fc6c520d-b44b-4764-9181-867d0e2aae09", "value": "24576:0d0IJ1D1sly2txdh2FoGFtQgWcvcXI8qDOILHAM4yD52ASROCaJo+x0ZNwBDT7Cl:0d0I1DGlys2FoKQBHYPFf4QL71lT7G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781799949, "uuid": "3335435c-cac9-4538-811a-5c5cb878bbae", "value": 2738368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781799949, "uuid": "476643cc-14ce-4f68-93c9-ad1fe637787b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781799949, "uuid": "540dc51d-a061-4892-a7a9-18e40c6af013", "value": "upd_helper.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ce294ad-6ad4-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1781759548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781759548, "uuid": "afcea804-58ea-41fc-9822-e5e876f2de3a", "comment": "Malware payload (AgentTesla)", "value": "39aa13e31edc12fbb2c24573575e35f0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781759548, "uuid": "1bc5dcc9-dde0-4435-9eb9-42a872c67b95", "comment": "Malware payload (AgentTesla)", "value": "448b6f8ac2a740cb13774eaca02c09ca372514fa30eddd67e1e3894ab4226cc5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781759548, "uuid": "a2023195-ca9a-4e3e-bd3d-cab0a5cb6335", "comment": "Malware payload (AgentTesla)", "value": "7db0c62230facf79126c8daecfdd87be6e659b84", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781759548, "uuid": "71073920-7dbc-48a9-b381-a971921fd7b9", "comment": "Malware payload (AgentTesla)", "value": "7fac0d5c05c52c4dedb57e24789dfcfdb42f1b9c801f437f7d041bc305d4457e7b047d5ff84c9b4a4cafb58934ab2888", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781759548, "uuid": "121f67bf-446f-46f0-8e34-6453568f9ad7", "value": "T11B65338DCA1C99A81C42B33C1D34219F57F0B759D31E9A5B28FADBA2C27E63453FA444", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781759548, "uuid": "49d34158-b2c9-4f15-953b-7729a0eb0e6c", "value": "24576:C4Pa0otVlvhoIsWMz8IQ/4HdQYOkxq8veY0ULHK1uCS1o8gnRt/K+raJeQGB364Y:pPa0obthtsNzweOks8jBbK1uCx8Uv/yH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781759548, "uuid": "675762c8-9a8f-42cd-80a0-3bda9a299bcc", "value": 1462125, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781759548, "uuid": "33160a4b-d0f3-4070-bd55-cb3e57f2ad82", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781759548, "uuid": "cc385776-6c3a-473c-b9e3-2610721e5f80", "value": "New PO for bulk order.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c912c2a9-6b31-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781799699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781799699, "uuid": "bb88cb73-a2c3-4ed5-9c9d-4e4a90a858a1", "comment": "Malware payload (Mirai)", "value": "43d87dd36020d84cfb22d929734c9dba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781799699, "uuid": "3012f666-3ca6-4fbf-bcfd-b6f70ac108d9", "comment": "Malware payload (Mirai)", "value": "44e217d312d0eca25c3d939d8597ef6952f4c1ea429a6c39470993dabf97238b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781799699, "uuid": "b62d4bea-c056-40fc-80e4-f743599d795a", "comment": "Malware payload (Mirai)", "value": "a73c25f1e9ebaa0fae9bc94d49e1b5aa0a46a2c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781799699, "uuid": "57d07dff-63ff-4ab2-8f82-1112738f14b0", "comment": "Malware payload (Mirai)", "value": "626af80c0b0c10d6776ae3a736b437ae476d691fe0cca8e390c882033c5e802e4516f7bab321a6bb38fc89c2aed7a7f7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781799699, "uuid": "c23a4c60-bbe0-406b-aab6-462a25d42cde", "value": "T1AEB35B77C8266F58D268D1B4B0B18FB92B63A915814B0FBE1AA7C2B54043DCCF6053F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781799699, "uuid": "38b1fd3a-7cd4-44bd-a784-986b0a5a749a", "value": "1536:aCVqyR/F4uZnZPmy2CwCICWCElKg8yPi5df08enlWp2kWiQbDUz/:aCVp94uD52bCI/CEsgudfEnlWkkWuz/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781799699, "uuid": "37561806-0ab5-42b1-ae96-1092a01ab5b4", "value": 117568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781799699, "uuid": "2098ca81-d9f0-4783-aa30-3958e71de354", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781799699, "uuid": "a1a7b8da-5770-41f9-bc56-a1b56e65c466", "value": "main_sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e156d405-6af2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781772682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781772682, "uuid": "dfd76844-b55b-43bb-9366-c513bbaed104", "comment": "Malware payload (Mirai)", "value": "85c5c99394ba2c7c43c1638ee7623276", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781772682, "uuid": "1d19c53a-d79d-4883-8649-9079232346d6", "comment": "Malware payload (Mirai)", "value": "451ec7fbe218fe1b0aca56ec2ceada0993c97a749140d1478f9b880a048efe65", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781772682, "uuid": "e3aebfac-ee99-462e-a80e-698fdd8b2a17", "comment": "Malware payload (Mirai)", "value": "a49a07584a159234767ba94f5a4d4115517be67d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781772682, "uuid": "dc0e62c3-6a89-4551-a5e4-c6db5bf9af2e", "comment": "Malware payload (Mirai)", "value": "1a6b37ab81aac315d86c5daf8664b7de811ef36b7bd9b645c72b9ee58971f6b05af276714fa6fccb6f423ac04491a59a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781772682, "uuid": "70757b66-9476-4479-8e78-5edf25d78148", "value": "T1C963025CC2E0A205D61A743F90167B6FCA58E88DA11175C9BEE9032F29CAB5DED353C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781772682, "uuid": "ed4b0f13-bcfb-4e89-9762-2ff7a08850b2", "value": "1536:ciNYOLXojWnlTQ2PmvSuitc9jafhXCZinouy8ryi:ciNNXoCS6Puj9jom6outh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781772682, "uuid": "51f87a78-95f4-44f3-95b6-48fe119a162d", "value": 68356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781772682, "uuid": "50855651-ef6c-4515-8e56-eeb6533d5c09", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781772682, "uuid": "6467100e-3823-4aa9-acf1-73ee83ffeed5", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36024c2a-6b34-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781800741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781800741, "uuid": "7be519fa-5377-422b-9c5a-c84a5b4f5614", "comment": "Malware payload (Mirai)", "value": "466f69915daaae6522cb1ccc63688fb3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781800741, "uuid": "f71adc02-b1bc-4e0f-b726-95f64bafc896", "comment": "Malware payload (Mirai)", "value": "45f17fa3bbaa4b5b078895b9badd7b24972a01b69ab6f9f6448314ce0f43ea4a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781800741, "uuid": "1aec1bec-2d09-4302-83d4-59eff19bbea6", "comment": "Malware payload (Mirai)", "value": "b2b1a9cb9a56e53ddc33c5a6c3db197e418334c9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781800741, "uuid": "118a5437-68f9-40fa-93d1-1dab0c566697", "comment": "Malware payload (Mirai)", "value": "c8c79e97606fa4a93fd8c43699e40cd280f123d41f5894a8c7d24277a9e58d5b070d9cac78edabfeb96829a98fd04c4b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781800741, "uuid": "dfa358cc-655c-416a-a3c7-20a16dd0cd33", "value": "T129C3C506BF114FF7D89BCD7346FA0B05258CB82B16B92B757534EC58B24A1CA1AE3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781800741, "uuid": "c3a9fcd3-98da-47f7-88e8-b87b3d5bd3a8", "value": "1536:j4w4zW/h4SZsqEznYHgiDSAPDfO4jaXbzjZjCfPNXm/iRK0UgSSWw:0xW/rZsqcYffHjarzjD+XWw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781800741, "uuid": "b8602f17-5a67-4b91-b205-993e1a246042", "value": 118300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781800741, "uuid": "0220b927-3133-43b1-be39-1c7488d37d41", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781800741, "uuid": "fa01d0fb-5a68-419d-9280-181dfc86a58b", "value": "manji.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9fcfb23-6af9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781775622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781775622, "uuid": "7145f102-fa9f-441e-8823-a4de044ff657", "comment": "Malware payload", "value": "2584735c7103b2f2f19a31bb37a13114", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781775622, "uuid": "6488b9e1-228e-4742-bbbe-1876cd5cdadc", "comment": "Malware payload", "value": "47b98c99d290618540083c6de80ffe770425eca86892ce5a450a422d6a560c0b", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781775622, "uuid": "bf60407a-c6c3-41cb-ab29-a41333fb6ae5", "comment": "Malware payload", "value": "0cab136039db75678ecfcfebe822bf8bf36bec6a", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781775622, "uuid": "ab27edda-cce3-4a27-b269-12f146c843f6", "comment": "Malware payload", "value": "9ffd649f3e539e94cf06410bf7f7046605e0e686cff608779e7f2c8700ae31a9a199265fd4459f5e5586a7ed8db3dafd", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781775622, "uuid": "a629f62f-65b1-4ec6-a024-de6176c9ffd9", "value": "T15FD55B07ECE508E9C0A9A33189B296967B35BC092F3227D32E54B3782F77AD09D35754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781775622, "uuid": "60dfe90d-0cb7-47b8-b413-8a1e1c51cf3e", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781775622, "uuid": "bbbb7b5e-eadc-4730-9820-c00d27c78c5d", "value": "49152:KBY3wXikb8U+niLsNdzJN+WT7S5eEHARn:KkrU+qsvJES", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781775622, "uuid": "f2492e02-bf20-46dc-ad64-4564e07011e5", "value": 2850672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781775622, "uuid": "32fa5560-bdaa-4808-afcb-ce9064b2c736", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781775622, "uuid": "0874bbe6-4ac5-4f05-bbe1-b8062090bd87", "value": "ojujn.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9bffe83-6b22-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1781793285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781793285, "uuid": "a138a976-8e9b-4021-a2ad-9b3405dac2ca", "comment": "Malware payload (LummaStealer)", "value": "4d976e55c47a5d72a72b90abbebbd137", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "apexdataserver4-sbs", "colour": "#C643FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-NeuraLoader", "colour": "#49C19E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "proxy-aiddroneheat-top", "colour": "#CCB7F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781793285, "uuid": "59fa63fc-6381-481d-920c-940e0cc24084", "comment": "Malware payload (LummaStealer)", "value": "48514edff1519f8be0c8a64511bf60ae8f847f90a6ac1381663c53646b77fb48", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "apexdataserver4-sbs", "colour": "#C643FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-NeuraLoader", "colour": "#49C19E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "proxy-aiddroneheat-top", "colour": "#CCB7F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781793285, "uuid": "dcc6c62a-34d4-4da6-888f-255d56fb5446", "comment": "Malware payload (LummaStealer)", "value": "92a9fbdb50864fe117ee69511f8fdd21cd905469", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "apexdataserver4-sbs", "colour": "#C643FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-NeuraLoader", "colour": "#49C19E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "proxy-aiddroneheat-top", "colour": "#CCB7F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781793285, "uuid": "6c6aa435-8691-4d1d-8f62-9bc5dd259fa7", "comment": "Malware payload (LummaStealer)", "value": "a2f76292bbf5845dd5d5d9e1813797e6f9df72bc799558f8bc1256b4be8ffd93afc7d0343cd2c4e1d29caeeca9f04a25", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "apexdataserver4-sbs", "colour": "#C643FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-NeuraLoader", "colour": "#49C19E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "proxy-aiddroneheat-top", "colour": "#CCB7F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781793285, "uuid": "059d51b3-0668-4512-b844-07ea1218f796", "value": "T1BDD56B10FEC754B6E502563258A762AF2338AD050B36DB97FA443B7EFA772D50932309", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781793285, "uuid": "1eb07462-487b-405f-a8da-1110d98d2928", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781793285, "uuid": "4f0a85ce-2dd2-4b01-ab5b-a2b88c50783e", "value": "24576:HuiErZ0La5g/LGwfpQz+pstFdd1vHjfLCJxHyTpA8OBD3iWptTwhGhVtHqHDxnaa:HeruSzHn4Xqj8UlKN3s/VS7ubQ/f9Mp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781793285, "uuid": "cb8d33c3-a68b-4984-8bf5-57e3c7075e16", "value": 2980216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781793285, "uuid": "3b09d1aa-4c54-4e0a-83af-affb1cdec206", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781793285, "uuid": "af208a7c-dafd-401c-8237-4df1ad5891cb", "value": "beb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afd4734a-6ae8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781768304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768304, "uuid": "3817ea4b-0d57-442e-882d-b919bb6b3f42", "comment": "Malware payload (Mirai)", "value": "c3b324daf55266b3f53fcc328bb9f0e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768304, "uuid": "e03f1344-c821-4956-bcb0-fc54cddfacfa", "comment": "Malware payload (Mirai)", "value": "4877b9d112947b500083b5de735fa32af342a2738982ae4015bbedcbb49db882", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768304, "uuid": "06a2db2b-79fb-46ce-b265-ffb7734800b8", "comment": "Malware payload (Mirai)", "value": "5c51277759354b0629c47b32277ff4ea9391f9bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768304, "uuid": "564d6ae7-0fed-422d-abe6-daa71f6ccf32", "comment": "Malware payload (Mirai)", "value": "b77c4ae998551d5ff5afca78f1e724287a02116ad7e3870cd5ed7dd2a36306b549e6024300ad0c1cc5df3e792836fd4b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781768304, "uuid": "dc255d4f-5ace-4470-8154-13f176e76626", "value": "T1F1D32B59F8D0CA63C6D427BBBA5D018D335257B9D2DE70029F146F202BDBE6A0A3F506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781768304, "uuid": "b46035c7-d3d7-4e38-a47c-bfa6166a2a3f", "value": "3072:eoZ5DHc1tOaBxXR+NlurW28Ft65SZ1hY8PUwAFSAQ1DFboU9GOLcHEya4P:eocW28F1TSUFdcY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781768304, "uuid": "2512fa2a-d4fb-4337-8fdf-2fb4014eb1a3", "value": 140580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781768304, "uuid": "65a87417-68cb-4653-908a-6ecfad76b805", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781768304, "uuid": "d46454bb-5b4d-4381-a68f-efea92075a0a", "value": "kaizen.arm5_srv", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab55f774-6ae4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781766578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766578, "uuid": "d22b0635-c603-4fdb-906f-2595287d64e2", "comment": "Malware payload (Mirai)", "value": "b048c9f8635fd99d1cd9560f1be96145", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766578, "uuid": "9bbece9b-c310-424d-9c0c-3e964902c832", "comment": "Malware payload (Mirai)", "value": "4954620a021add1d0fe890055afaf22d462de25f1714f7218884bf2b659502e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766578, "uuid": "151c28f2-8c8d-4d74-b98e-262b76f82627", "comment": "Malware payload (Mirai)", "value": "dbf984e2c6fba87af5bfb63231f38b410f42eff0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766578, "uuid": "c1780c22-20f7-400b-a254-54286c9fc696", "comment": "Malware payload (Mirai)", "value": "774174b27014f817a7d039b11ee946123841f4075477b2a9ed9e7876ade7199795ce95c0c60150b1319c5bce109d2c87", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781766578, "uuid": "67cbf3af-dc7a-4ff3-b291-0898aaaf277b", "value": "T13A34B40ABF510EBBD8ABDE3306E90B4128CC645722A93B757134D61CF54A64F5AE3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781766578, "uuid": "2c38ef2a-56be-4656-be46-c1b444def47c", "value": "3072:3thKCE3QoBISg068nUuyfzkSXXhmyWiBbl/P:3thKWoBgd8nPcz9hUebl/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781766578, "uuid": "95057098-ced8-4ba6-899e-54a8abef541d", "value": 234416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781766578, "uuid": "6498e1c9-1348-45dc-a9e6-bea82a7437dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781766578, "uuid": "2197b0ee-a203-4d99-ab55-104eaea05a34", "value": "onie_mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47b8339c-6b27-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781795187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781795187, "uuid": "5dbaa32e-c7a6-4f67-adac-f0ee5134f847", "comment": "Malware payload (Mirai)", "value": "fc8494dcc51afee4f2c760e94c5a6ef2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781795187, "uuid": "4455bbe8-8e78-405d-abb0-d143f760da6f", "comment": "Malware payload (Mirai)", "value": "49e2647a9afb5c699e39070053a77edf41d63951173af9e8ee1f3aea2c46c29a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781795187, "uuid": "d02ec92b-3497-42d9-a485-6d28bae7cac9", "comment": "Malware payload (Mirai)", "value": "4728a44eb27013b39c22ccc61d7007707aa88689", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781795187, "uuid": "4389c8cd-0e12-4a32-90e6-ed2dd3b7d972", "comment": "Malware payload (Mirai)", "value": "a116abfbf7ce27949b15e4ea203833de2c3769039bb5300d4fc506f32e926e8319e386b2e824617ff70c124352f90f87", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781795187, "uuid": "1e3f10c0-934f-4a60-a308-57887d8a1ebd", "value": "T171F37DC1F747D4F1D91B05B02067E7368B72E53A102BEE46D7A8AE32EC92511D61B3AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781795187, "uuid": "46b5417f-ae4a-4c15-8e56-637ad8e33565", "value": "3072:PSycLdrFl9nTDPN/dDQFXYlTice9OM0iU6Wae8hjeEKcds0CzsK1ZmGXqv:PAdrFl9nV/dqolTu9OviU6WatVws0ZY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781795187, "uuid": "cff102d7-53d3-402e-9c7a-c8dfe21aa7d5", "value": 161000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781795187, "uuid": "0a7160e8-2655-46d0-9380-8bd1bf4c174e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781795187, "uuid": "0319b45a-6c7e-4d10-b681-37d3d70d5d39", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76e233c4-6ae6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781767349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767349, "uuid": "68535b0e-f8a3-420d-af5f-495070a1311f", "comment": "Malware payload (Mirai)", "value": "850424bc83fe101971cb68283ffc7001", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767349, "uuid": "12d0b1ec-56a6-4f35-8775-b4522f0ef386", "comment": "Malware payload (Mirai)", "value": "4a563491d3cedb33adeaa472188bba1e0a08113299ad4a0ec0ec945f0a27ec65", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767349, "uuid": "92fdb8e9-82e8-43a5-a3b8-fee7144ca577", "comment": "Malware payload (Mirai)", "value": "b764bf91e7f7b1ca5e9b0031cea592b2cabf18f7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767349, "uuid": "cc5a10b5-4dc3-4c5d-befa-0ed6e7d3ff8d", "comment": "Malware payload (Mirai)", "value": "6395d76b28210880abc92a009d75c73a44313e068f7b5a78cc3305166e39f247267ba03f5a6f10de22ddb70409485a7a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767349, "uuid": "c7f77df6-18a0-4069-b94a-ff3d48b41870", "value": "T17C53AF72D86C6D90C6484278792A8E3C1723F904B6736EF5895E4FA66407EECF5093F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767349, "uuid": "b54205c1-0eea-4364-93aa-d69e38320b4d", "value": "1536:S2/kYOEVxywtRnuSUWsYZdEri0Yt8GUCShm:S2MYBXyOugYi0Yt8GU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781767349, "uuid": "8f9f1d18-0b14-4404-a3f3-46b3411acfaf", "value": 66552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781767349, "uuid": "652669e9-21cb-4177-b46a-af3a1440498e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767349, "uuid": "85da7598-377a-4a78-b9df-3e4087340d84", "value": "h0r0zx00x.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7ac88e6-6ae6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781767458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767458, "uuid": "eaa45078-55f7-4138-b75f-3f586d195c2d", "comment": "Malware payload (Mirai)", "value": "3eaf1cb2847b149eb4d6a851609da57a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767458, "uuid": "6f2b92ed-13fe-4a17-b743-4b9b76acac58", "comment": "Malware payload (Mirai)", "value": "4ac3b6a88b0f9f29748f389a46cce87bbb6072e315ab8d2bd4198efe771547d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767458, "uuid": "0a4bad14-4a5a-4311-b801-d89d9f1e95ea", "comment": "Malware payload (Mirai)", "value": "db69bb0dd13820e5076cdf671795947d72fb97d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767458, "uuid": "ee2e919e-d420-4695-a07e-e4769d80ac25", "comment": "Malware payload (Mirai)", "value": "08af4714bdde5105d5a984e725eb3e585110e56de7dec546e8a1300d10007fd9a23ac6f929d56fe89b64b6a39eb532df", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767458, "uuid": "8a3246b2-6743-4060-95bd-78163c2c8059", "value": "T18FA30849BC85AB16CAC25777FF4E4389332713A8E3EE7203DA156B21378B91B0E76541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767458, "uuid": "b25e4b8c-adb2-4334-8dcd-c3eb4bb9ff6c", "value": "3072:PaaSGm9lugMiAmyimt2R9yj9yjQjVQtMlgHc:PoBlugMiA3t2RcRyj+QtMe8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781767458, "uuid": "8e9afb57-88cb-479e-8bf2-5af170a47eda", "value": 99564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781767458, "uuid": "0990c554-0e6b-4013-9917-fb30fb3cc171", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767458, "uuid": "478667b4-7f90-49da-97ca-9c66d4cd4941", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "330c1de4-6b5a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781817057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781817057, "uuid": "98aa5b88-c0b2-40b0-9def-26117aa0c942", "comment": "Malware payload (Mirai)", "value": "3b582c33d7376d9a6ce11dffb741049b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781817057, "uuid": "3dd03a9e-c343-42ec-9d26-9bf5928eb198", "comment": "Malware payload (Mirai)", "value": "4bfef0c90b76d45dba126bd8e589b9f7aed15cab26e5cb97345daebf74c22879", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781817057, "uuid": "c586e6bb-d9c3-4969-9462-3dfe6d80dfc3", "comment": "Malware payload (Mirai)", "value": "1298900224f6812bed3669ce444465ca22a25d2d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781817057, "uuid": "17cf1f45-7091-471f-bce3-11d43069af23", "comment": "Malware payload (Mirai)", "value": "6d01d7685644bbb6a85c9cff780b36a13ff41327f2fa11b63dfe3dccf6b2a1333275ff2afeef3e82add36048c7f9f5aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781817057, "uuid": "bda1b14d-da0d-4427-83ea-102695b69dbc", "value": "T1EA14A71E6E228F7EF26C873447B78A34976933D623E1D644E1ACD1145F2029E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781817057, "uuid": "3a30039a-564e-43c3-8285-c958783fa5bb", "value": "3072:G7dKQqTb7WJEZWaHRmpdp73/dzyx8lFg60DL7:G7dKxTbCJCazp1ykFgpj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781817057, "uuid": "0c500a10-03ef-4887-a31d-65f879c5490a", "value": 197024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781817057, "uuid": "17713d78-c33c-420d-abdc-b0f4078b7c78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781817057, "uuid": "6593e55d-3a81-48f3-90ee-4db13bc219a6", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65c0352c-6b2b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781796956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781796956, "uuid": "ef2e428a-5d79-409a-9eac-d633c2f0af35", "comment": "Malware payload (Mirai)", "value": "308af3dd4eaa736fe57b5015baf6353e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781796956, "uuid": "a871842a-934d-4009-8e3c-af5c8222c6ac", "comment": "Malware payload (Mirai)", "value": "4c5575bc900ede659f2c74cd982e7ac0e0d9b8017c4c7cfac71be9340b48d5eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781796956, "uuid": "0152ac57-504c-4880-9970-f30db9f04397", "comment": "Malware payload (Mirai)", "value": "508667f36a0b43ef419ab43e2c279560ea8673fd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781796956, "uuid": "13b8b357-9371-4a5a-a504-d4c57a6865b2", "comment": "Malware payload (Mirai)", "value": "fa41cbeb89e615dadc75c0bd633d3377822ba5184df06acf3787a39bdd4016dd0d802106a1c771cab162ff35c9b01947", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781796956, "uuid": "9a74cf98-3e54-4c9c-a772-0afff3e0352d", "value": "T1A654D61F6E229F7DF3A9C77547B38E249B5823D627E1D680D1ACD1101E6038E641FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781796956, "uuid": "c62abdeb-9f5d-415a-9556-ff30253e34a4", "value": "6144:zFvgwnRhGrwBBIuk6xFe6LiCeWhe2mzafC9NQiF:z6wnvJwEFeUevDQiF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781796956, "uuid": "330819e5-b8e6-456c-a2a7-f8f4a6282fcf", "value": 279036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781796956, "uuid": "4d3f5692-1cc3-4f01-af35-832a713bb606", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781796956, "uuid": "b23902c9-8bd2-48f7-85aa-50585dac5caa", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "224acc47-6b34-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781800708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781800708, "uuid": "a6775260-da4e-427b-b711-4f19e46fe650", "comment": "Malware payload (Mirai)", "value": "fb9a5adfee2337ce84a1ea1a7adba8e8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781800708, "uuid": "aa6179de-ed3e-4779-95a8-5d8288248ead", "comment": "Malware payload (Mirai)", "value": "4ce2ad32a5f4cd83e8fd6f74a886276ecb5fe74fbdc66abf9bbf7d9973870335", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781800708, "uuid": "5a8d8bff-d912-41d5-ab16-66859b1d663f", "comment": "Malware payload (Mirai)", "value": "1e470bb0d5f2325cf95bb0d841290b0ba68583c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781800708, "uuid": "ab9e8db9-0abd-40f9-bd82-4e7cbda1095d", "comment": "Malware payload (Mirai)", "value": "0ba521e195650b6973d3ab389ce09ba07e74d0fb60269eb7dc85d52d43e101e806d3aa2a0337e2b28e7c33ff8d4a3242", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781800708, "uuid": "b8db553d-b9e7-4085-aa8e-1d8e4a45692a", "value": "T149631B07BA428BAFC14FC1F407F76A399922BDBE0A36F1E5E3A4FD865901CD05A1D614", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781800708, "uuid": "5a2e0abc-bb9d-4da4-8c8c-b4396518c129", "value": "1536:GnHkHRxHBFPSWGzIGWlGy5TGpWE7wH9OXEL9qj:mHkHvBFVGzIKytJE7wwXEcj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781800708, "uuid": "98434d7e-99af-4388-9b2f-0d6e993d7498", "value": 69624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781800708, "uuid": "0f8748f0-d2dc-40e2-9d34-7053e5a32f85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781800708, "uuid": "5bf98744-ffd7-4c76-b7dd-cb9d98c4cd4b", "value": "manji.dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02242617-6ae7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781767583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767583, "uuid": "bd313e2d-c3cf-4f1d-9ae4-579d2d87c803", "comment": "Malware payload (Mirai)", "value": "c93611f442482a83b1cb450e6ccdacf5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767583, "uuid": "becc759a-ac66-4485-9cb6-d2eb0c7789f6", "comment": "Malware payload (Mirai)", "value": "4e087c3c6caee3069fab46f7bc01ed6968f445e0ba02c041bbb8ecd5fe92c231", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767583, "uuid": "d63bb3c9-1cba-49e1-9ca5-cbc15150fdc7", "comment": "Malware payload (Mirai)", "value": "8741cf24795a100f2fd26e2afc129ef8966cd219", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767583, "uuid": "0a78a301-49ed-4e6b-b4c6-b8bdde8586c9", "comment": "Malware payload (Mirai)", "value": "4e0515b5f872d558d0e5ecaf8b783f342eefa69f259ba938deae4e0de02d74fa8681e3fc3a36e4c12627eccdb1b565b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767583, "uuid": "6a9affea-6716-4873-89d2-85b82ab1b379", "value": "T17F532B41BCD28A2AC6D423BAFA5E11DD3322B3F8D0DE3243CD144B147ACA91E5D77691", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767583, "uuid": "7d2f1adb-6fec-4dc2-9a81-19d74726077d", "value": "1536:Y78RNUiMikNQqoOKze0R05fLRsalVzNzV95myk9lphTSm:YwRNUiMikno0DVZzV756lph", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781767583, "uuid": "8058e6ba-487f-4b6b-9ddf-39c0d511bdae", "value": 63896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781767583, "uuid": "ac8e05e6-a1db-44f6-9760-a4f83deb5c34", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767583, "uuid": "14376f81-dcd4-4ed6-946f-82aa61751c31", "value": "h0r0zx00x.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19b13b85-6ae9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781768481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768481, "uuid": "4f70c5a2-4be1-4828-bb57-2b37f5f256be", "comment": "Malware payload (Mirai)", "value": "c5c750ffea5fd49e921f9ff328e09abf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768481, "uuid": "06be15a1-6092-4fbd-a997-3180ae2512af", "comment": "Malware payload (Mirai)", "value": "4e307db2f32d1e13ca1e25806bc3037efa277fd8eb68d316b41ffb7b825b4ce7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768481, "uuid": "5eda27da-2c2d-4ffb-bbed-2427d98d5f33", "comment": "Malware payload (Mirai)", "value": "2a3f46ce1f9b0f101dfbe9c969375318b0d62f58", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768481, "uuid": "832f1f95-0d52-4354-b58e-fb8f08a8deb6", "comment": "Malware payload (Mirai)", "value": "4f921b754555a4c6db9ace4222d900b960f1442cdb2b6ec34545a25d022bcb42bf52eba13cf700ba58dbe19d607a253f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781768481, "uuid": "29fee353-0474-4569-9877-6c6db298d500", "value": "T13CD49D99FE1E3D43D2C7E37CDB8547A1222B75F4D32382727A41025DE8C6AE9CBA1611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781768481, "uuid": "41f7e38e-12d2-429a-ab0d-729a789b317e", "value": "12288:VcBXDcbeEtil6nHmxw0swgWOVwsss55eWx:6dcmMHmxw0svdVwp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781768481, "uuid": "5175a390-e3b9-4a39-8738-a79a684b1966", "value": 648680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781768481, "uuid": "df366395-6736-486f-837b-4d5eed20c3e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781768481, "uuid": "e0e27e1e-d7a8-4fb5-be3a-55cfd8e74ed4", "value": "kaizen.arm64_srv", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75ab61aa-6b3b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781803854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781803854, "uuid": "b223b6bd-c1ff-42dd-b349-a3b3deedde85", "comment": "Malware payload", "value": "793e2cf75bb1293550a42064b085646f", "object_relation": "md5", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781803854, "uuid": "e2f0ad12-a0ab-43ea-b118-00d9c5c9561f", "comment": "Malware payload", "value": "4f454c5a67a466f2b861baf6b2dce78e8f0cf4c114c9fd5e1170850cc54fb692", "object_relation": "sha256", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781803854, "uuid": "ef71eba4-9f58-4865-8362-63bca16cc4c7", "comment": "Malware payload", "value": "091ddd78caba8bb1739390d19dfd06b843265e72", "object_relation": "sha1", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781803854, "uuid": "4ca29f99-9bf5-4603-8bd2-8e027db9927b", "comment": "Malware payload", "value": "86b70beb94dd5318182f3df836f71fef6daf39e357da9c3330380069dd35094fdf74eb379cf369e7dca9182c79d5daef", "object_relation": "sha3-384", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781803854, "uuid": "7dcfe124-9ba4-40c7-ac7d-5deadf1100cb", "value": "T17B94239F089B8CC69E197850A2697F281A56F96743BF2A8EC40714C683AFCF551F5FC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781803854, "uuid": "d5b1407f-f1f9-472d-b449-f687bae3892a", "value": "12288:1zyZTVjv3b9uo/z1uYzH/MJ8EklUAjo5WnVA3d8a4EQDHbS:sZTVDZuoZoOESNo0a3d8LDHbS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781803854, "uuid": "24cf2aef-9c8b-45b7-85c8-d2fcee7b16e2", "value": 446464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781803854, "uuid": "30a82fd2-dff8-4ee9-b846-c4e68bd6a17b", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781803854, "uuid": "4bbf3e0f-cc69-4c86-be67-58b9ece6131f", "value": "4f454c5a67a466f2b861baf6b2dce78e8f0cf4c114c9fd5e1170850cc54fb692", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ad700c8-6ae4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781766443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766443, "uuid": "be5fd226-26dc-4135-9a90-1aedcefab384", "comment": "Malware payload (Mirai)", "value": "cb9093bbd6cec83f8a668639a6ed9bc2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766443, "uuid": "e469ddf2-0355-4646-a48c-27ac91bbe672", "comment": "Malware payload (Mirai)", "value": "4f5306f7373a9f4dc5e2971de00ec0904e03a36f0802ec14f2560e1963162708", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766443, "uuid": "b0a8480d-db41-4423-a439-b71e92f44be4", "comment": "Malware payload (Mirai)", "value": "a1833fd3a0cb7caf5ea5bbf9c5cc942bba5d1910", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766443, "uuid": "11668085-3397-4cdc-b03c-bcfebb312806", "comment": "Malware payload (Mirai)", "value": "021ca82f57b99a74e94809649f23c03268efb910c00991f82fa6d873cd52a7b00b5253a45d4a43daf475446b3920c467", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781766443, "uuid": "0b70814a-9273-4b46-a63e-af8e8e4beefa", "value": "T110242846EB408B03C0D21779BA9F534633339B64E3DB730A9928ABB43F8775E4E66505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781766443, "uuid": "9dacc93b-296b-4d17-9fe1-e5116c0effa2", "value": "6144:Y6JIigwvbwlza/+1t9AxFNzN5wa4RpCizo8/aj2L/KltqmmwkG71HC:DIZ8bwlza69AxFNz0aWpCizjl/zmmVG4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781766443, "uuid": "0a5594f3-cffb-4cb2-b0e8-452fba833495", "value": 211827, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781766443, "uuid": "afdfd0bf-4a4c-4dae-bc0a-c62880c2d796", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781766443, "uuid": "9cc3e3a9-f376-497e-83d3-037a744a2822", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "049d4726-6b44-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781807530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781807530, "uuid": "902e339e-63cd-42c8-ac85-ca24a849b541", "comment": "Malware payload", "value": "ae84db59a3bbc07c1798d756a4d7b606", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781807530, "uuid": "a5d6762e-ae33-4936-8996-64809e15c834", "comment": "Malware payload", "value": "4faa33c803fe381f06eede339ce81b908146d1a42acb64476019e9dcd08b0405", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781807530, "uuid": "10f638f5-a93e-4aef-a923-fddb24a747b2", "comment": "Malware payload", "value": "aad06ec9f2dfed29340691a5687877347bd2ea21", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781807530, "uuid": "a8b87955-6cef-44d0-b138-9e2214f5cf10", "comment": "Malware payload", "value": "aec9b2b38e75758692f8e40002a2eacd1c82ee0d360ec6aec8bfb22bde7d5a22ebd71967a1bb19343054bb2dd512cc4c", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781807530, "uuid": "e93f9911-857c-45b9-b13c-a7a885a7ee88", "value": "T171115268ADBBE912F1F5C3B1DA51661FCA28C6E80185279AB70C5903448D3B267CE359", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781807530, "uuid": "05b90275-6efc-416f-a3cb-1c6c0dc74c10", "value": "24:9hGQvZvvNv3KyAcxm1V7f83JR8p5M2Gtn:9zdvEN8r1Jn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781807530, "uuid": "f114dbf0-6ec1-43a8-a243-e1634b2a9ca4", "value": 861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781807530, "uuid": "23b11a3e-8772-4b75-ba1e-3384819b3eaa", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781807530, "uuid": "4e5b1dec-ddac-48f7-9fb9-357720003819", "value": "Rechnung_GENERAL.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6791cfa-6ac3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781752450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781752450, "uuid": "0b5f417f-a867-465b-b88f-8fc2f1c61b0c", "comment": "Malware payload (Mirai)", "value": "081d8c7e0238b86a1cd9615f3d9ed847", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781752450, "uuid": "a92f35f0-31c7-4275-aec5-ca353b07ad16", "comment": "Malware payload (Mirai)", "value": "519fb98ae9fcf8325f4c0a065793f1e3eaf39c8a574b69af005f7bf0abdca466", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781752450, "uuid": "838d7e2a-8365-4afa-88fc-422320355281", "comment": "Malware payload (Mirai)", "value": "a0c4d3261c0af60b70a9d3678c7e4afb6f332d45", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781752450, "uuid": "e6dc1feb-c7c3-4f74-a971-9c48ae6ed719", "comment": "Malware payload (Mirai)", "value": "ead1a49025b52b9df2068280409c384d56564c17b294f3011dd547485ab05620011be420e5d2c7a480c0da21c0aa1ac6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781752450, "uuid": "1b2cb10f-634e-4a5e-88b8-a9e40bc3087e", "value": "T153149D23E8746DD8D660D4B4B0F19FB81B53A611414B1EBE3AE7C6749097E88F60C3B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781752450, "uuid": "712417f3-be76-45ff-a20a-c323c3c1728c", "value": "3072:PqVIO261u+7T/m79iXNUMF1q8LV29XtWt1C25HsM86U:ibf/m8dUMF1fkYtl5Nq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781752450, "uuid": "ee6e545e-973c-4d92-8e98-8821214ff87f", "value": 194436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781752450, "uuid": "71c1dfaf-e791-4df5-9f09-a288dcd21134", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781752450, "uuid": "d80b97dd-a314-4e1a-8d8a-499acf5285c9", "value": "psh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f217d83f-6af6-11f1-a769-42010a9c0008", "comment": "Malware payload (DDoSAgent)", "timestamp": 1781774428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781774428, "uuid": "22b49ea3-d5ce-4623-9cd1-0e746ada2ff7", "comment": "Malware payload (DDoSAgent)", "value": "f85083d26b104f1c8cccc19eb4fb6fd0", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781774428, "uuid": "a66c5fbd-011d-40f9-b11f-a6c40dec2eff", "comment": "Malware payload (DDoSAgent)", "value": "51ec621328e95c6956cec61c67c937f8d2b74793fe4e35d090c3a8df6d302f23", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781774428, "uuid": "6843ae0a-7b7a-4d87-89fe-2c6056a31c20", "comment": "Malware payload (DDoSAgent)", "value": "f6594c5bea56ec7be77dcbd8f785789deb052d47", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781774428, "uuid": "145dad6c-ca93-4520-a8af-fb48842740ae", "comment": "Malware payload (DDoSAgent)", "value": "5f52ca92cdad38f676d54be5e57474bbe44506932601fc0bfcfdcb4a0460a5b40605e1227c42d07e6104b4cefd874681", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781774428, "uuid": "3727f157-5156-46e4-8160-5fbfdfa1dcd5", "value": "T1B9860805ADC53BE6C42C5E7444EACA5522B06D140AF24A3A26A4FFEDBC762757F078CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781774428, "uuid": "33b08354-17bb-44ae-8901-f56c38674baf", "value": "49152:iDLGNBC7CRCQJjWOg0CQBWibh+4wC7IE17Il8Zw7GgS5E8:hELQBL3ImDy7joE8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781774428, "uuid": "3309b493-e4b8-434c-983d-72fd20bf25f6", "value": 8126679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781774428, "uuid": "f27d40fe-5e0f-49ee-b803-f06f781a7490", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781774428, "uuid": "3f13f11b-0c26-456a-80e7-040bb1041db7", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f0b59ff-6b0f-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1781784972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781784972, "uuid": "778ca8f0-3122-4517-8275-28ead33f6106", "comment": "Malware payload (WannaCry)", "value": "ba6db8364d225e7a21edca29225bfa6d", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781784972, "uuid": "9fb5d47a-9f71-4f72-92a2-e97dd0a271ce", "comment": "Malware payload (WannaCry)", "value": "5343c0e1d08a99621f359ce2fb767cefe45016305393b2c01421625b9c9cf253", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781784972, "uuid": "fd4280a3-9b93-476f-8cae-d348ff65e675", "comment": "Malware payload (WannaCry)", "value": "f794e86846cdbaf9ad57026be299732d491dc6a7", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781784972, "uuid": "990886a6-14e7-4dd7-8ad1-c41d1453c744", "comment": "Malware payload (WannaCry)", "value": "6ef91c84161ef781103bf5b54644a457bce074bc47becd55b25524b514e6155f7e20f2f1459535dd79cde542bcd1780e", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781784972, "uuid": "23a2344d-5c14-42e9-8b29-f069dd4e9d23", "value": "T1623623A630DC80B4D5036234D8B78F21E67ABC39217A9A4FAF904E751F23792E719753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781784972, "uuid": "83b1468f-d92b-450a-8f8c-4d5a9bbfaa19", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781784972, "uuid": "6b47ffc8-13ba-4ca5-9acf-8a118cec4356", "value": "24576:jbLgBbLguriIf3MSirYbcMNgef0QeQjG/D8kIqRYoAd:jnsnp3MSPbcBVQej/1I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781784972, "uuid": "d80daf25-999a-48a9-9603-a0f2360f1a1b", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781784972, "uuid": "7128d9c1-5da1-4c2a-b115-28d6647ca6db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781784972, "uuid": "0f9c6fd6-d15e-48cd-be4f-5606d2039871", "value": "5343c0e1d08a99621f359ce2fb767cefe45016305393b2c01421625b9c9cf253", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f61f4b96-6af7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781774864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781774864, "uuid": "02e1ba8d-876d-43a0-b9e4-1b19019716dd", "comment": "Malware payload", "value": "9c4c007920fa7e04debce6904158b636", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781774864, "uuid": "d668ab80-b25f-44c1-b9c3-5248fec2989e", "comment": "Malware payload", "value": "535754da389348f85c04619063425f745b1e15e73f7edc2edbccdb101c11fecb", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781774864, "uuid": "6c68835f-6d37-4cdd-9f4f-9e85038699b8", "comment": "Malware payload", "value": "2014da2ca6b8337f4e175f35692ab6bf69e4b5e9", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781774864, "uuid": "a79f01ae-5386-4afb-985b-d8d518e0c56e", "comment": "Malware payload", "value": "70c1b64269f05af9b6382eeea5827cf44813e65697c79ed178900b6e13d6b20d75d7902ea6f1e6358ff8f2c2da4b7492", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781774864, "uuid": "8061e3d2-6aa0-4e41-b080-9cafdcba9a56", "value": "T173E092DB50D68825B08A49B6FEAED80419C6FE420C811D1895C718E3904CD483562B23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781774864, "uuid": "229e5aed-faff-4ac4-ab31-c9f9e1966626", "value": "6:hoWbRGPZr3d7KafTcL3nTPDWToTa9jwOlbhgkhjy:hKBFKaLcLLDvTWpdgW2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781774864, "uuid": "80c517c3-ce2c-44ff-a36e-9565a21fe959", "value": 352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781774864, "uuid": "6da50fed-ea37-4179-a7dc-b58c9f3d5b08", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781774864, "uuid": "68a0029c-8315-4d81-b8bb-7a5d4f91c477", "value": "x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30871f62-6b2d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781797725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781797725, "uuid": "9f468f41-8a22-41ef-aa1b-37223fa16093", "comment": "Malware payload (Mirai)", "value": "bfe9bc1fb31d67e51ae6a5a8e635e947", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781797725, "uuid": "48fe605b-1c5e-496c-87c9-8b3e18f4c34c", "comment": "Malware payload (Mirai)", "value": "5367c83dccdeac0f475b6db8bac21b1c20d0ba1eddd5872d2edde3a4758dae09", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781797725, "uuid": "8c5039df-8851-4484-bded-a3021f155eb1", "comment": "Malware payload (Mirai)", "value": "52eec0f6d55df2190cd6e6d31df75132803eb52f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781797725, "uuid": "d2e77fb3-9ac3-4e4e-a4d1-321125e13778", "comment": "Malware payload (Mirai)", "value": "6592f21a32906a3d0303c0fa414ed7347b18ccea0df49baf87dad5a457f0d47a36fd7e01e991f95266472d0de37d0aac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781797725, "uuid": "6416d8e4-aa89-4d14-8535-503b0b385bd9", "value": "T169B32A49F8D0DB66D6E5267AFB9D029C33130778D3D93202DE14AF3532EB55E0A3A906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781797725, "uuid": "40e16227-eb69-4f42-87e3-09715f57623b", "value": "1536:qBwXHiTxLwTshj8NTzbctdzbNVHzJEZ54giPO+2QtKnkbOJwnokU6MRf9kv0L2uw:q6iTBjcctfcTiPXjmJwnokU1R9dyeW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781797725, "uuid": "34422fa6-08f9-4790-bb36-df4ab063a7a7", "value": 116032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781797725, "uuid": "daeee6d3-ebcf-4cfd-923e-3491437c0247", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781797725, "uuid": "40e0aa6d-abfa-4152-a8f8-61acc20a46df", "value": "monero.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7331e284-6b12-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781786241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781786241, "uuid": "c44b3c8f-cce2-4a79-8885-408f951ef3db", "comment": "Malware payload", "value": "0075ff5cc76cf245d6db5a374ee7591c", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781786241, "uuid": "aed4ebf4-7d46-47d8-9dc1-5ff0b07f224e", "comment": "Malware payload", "value": "540da969ed2a0d828e208c99f3afb4b0763a7076144e1b9edd6ca9c7db0dbeae", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781786241, "uuid": "d342354e-647e-4e9c-9ac5-557c9fc315a7", "comment": "Malware payload", "value": "c10c5d68ecff2174110e914417d931a12850c5ac", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781786241, "uuid": "c8fa509f-97c1-4fd3-af43-0d76abcdb61f", "comment": "Malware payload", "value": "07d5c4fc7ccb5c4ef5b82fe980e3442affa492d042fffb4ea6c80a6a73ce2a72c11708d8382f7350e6cf0a77cc121289", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781786241, "uuid": "ca3b61b9-6a38-490c-a9cd-ad66d1289962", "value": "T104C423709DF52DEBD623EDFA158D6A4AC8AF083C12BD16FB385407E20B6CA57931065C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781786241, "uuid": "bdb8550c-55e1-4c56-9136-cbc96672dedc", "value": "12288:89uorXTkUWYO1krc6hAP+LHUmLQ4MV4it+86QiTuZWvIajp:guoUUWPercyLHUmLQ424iIQxZaIad", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781786241, "uuid": "4507cd76-2e8e-48dd-86bd-886345ba8035", "value": 553193, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781786241, "uuid": "7698efe5-1ec3-482f-962a-a957694589d2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781786241, "uuid": "7b4aabf0-8478-42f2-8653-5205bc962b1e", "value": "Animoca Brands Funding Discussion Agenda.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b66782e-6ae6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781767357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767357, "uuid": "379dca39-b660-4b19-bfc3-be3fec663377", "comment": "Malware payload (Mirai)", "value": "62550c7655845e6297ed5f8af98a8ad2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767357, "uuid": "e4f58485-321b-4929-a209-67e6624a2da8", "comment": "Malware payload (Mirai)", "value": "5444c400158cce2e3fdfaad2b59ccf88af9f34c7aac3c5c30c35d183d472df4c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767357, "uuid": "2a131d85-0529-4f2a-bd28-446876dc92be", "comment": "Malware payload (Mirai)", "value": "d3f8736ceb24ca92cef0a17b691d4db1df0e8b5c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767357, "uuid": "d31804f6-d3fe-4853-b024-f80aca05893f", "comment": "Malware payload (Mirai)", "value": "fb799875df37702b748945a58e0c900ed5a9facbc9959f13a5c126976dfacf1cfc9ca94e23a1365178c15b52113db319", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767357, "uuid": "c59ac358-b9bb-45d8-b261-6bd553e44798", "value": "T1344302B19181E3C2E6633E72D6B01523B702E62822DBF8229A74A5D157F364727BD113", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767357, "uuid": "47e5a6f1-44fd-4a11-a461-adb9658855e4", "value": "1536:8JBXFe6EJXDB+TsKkd4aoSsPM0N0UOJXwBWgCs:8JBXFe7JFJ9noSsDrOJwvP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781767357, "uuid": "18860895-6f63-45cf-a1eb-2b90fabc6d75", "value": 56024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781767357, "uuid": "6fddb550-06c0-4ebc-a74f-80b0244d1cce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767357, "uuid": "ddb30fc2-e7df-4474-a687-5fd105819ea6", "value": "h0r0zx00x.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54c21aae-6b58-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781816254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781816254, "uuid": "57d12955-dba6-4c09-aacf-05e7b91389d5", "comment": "Malware payload (Mirai)", "value": "313f7331034b905f140be94a5d810f60", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781816254, "uuid": "12a1b809-a6d7-4b35-9a8c-fe4d1b21ad4f", "comment": "Malware payload (Mirai)", "value": "546f245757744807745ed6c71b526e27125e636c2b9f98dd3040fef71167fde7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781816254, "uuid": "5d6835ec-aa8d-488d-be67-26ba609db938", "comment": "Malware payload (Mirai)", "value": "399c87f0348b18d65b11a42dbf768c0aa1d41724", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781816254, "uuid": "128f2494-6c87-4cba-896b-3ef577bc13f4", "comment": "Malware payload (Mirai)", "value": "15a950cbb578a24e0ba3bd539d28bb31afba5fb73ed13e831b4eb62818ff51d4ef060c1537147d6738265839ea362e57", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781816254, "uuid": "60c724ba-3170-416d-91d1-5480eaf7cc5d", "value": "T186242A46B8819F15C5D016BEFA1D118E332717B8E2DE7212DD206F757B8A86F0E3BA11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781816254, "uuid": "d34d4851-814a-47b0-8771-e63068776656", "value": "6144:nEW1NR0/rJrUJvVCXIGUa7If55TqEJlY:EWBAJadCXDUaER5TnHY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781816254, "uuid": "27587430-81b3-40d3-a9be-77c5c5c1a207", "value": 225660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781816254, "uuid": "37786924-1a64-4865-bfad-8a48b53fb5c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781816254, "uuid": "b0fcb568-6489-48f5-9360-13d37d23c448", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d24e03b-6ade-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1781763924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781763924, "uuid": "c7de6509-a432-4d89-b7eb-d4a5656fc981", "comment": "Malware payload (PureHVNC)", "value": "c865dd8377686174bc5bad3e13b15430", "object_relation": "md5", "Tag": [ { "name": "2-27-62-123", "colour": "#EE0D0B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781763924, "uuid": "1a5f5f1b-19b8-48c6-948b-32173bf15d5d", "comment": "Malware payload (PureHVNC)", "value": "5494ee3791297169a150b56bbeed16f5106d96f13a7c53c672d0fb2354b22dca", "object_relation": "sha256", "Tag": [ { "name": "2-27-62-123", "colour": "#EE0D0B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781763924, "uuid": "21581d28-89f2-4462-9a37-f54055ba8c58", "comment": "Malware payload (PureHVNC)", "value": "a870b4097023ce1aab1aea756d784f1757575237", "object_relation": "sha1", "Tag": [ { "name": "2-27-62-123", "colour": "#EE0D0B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781763924, "uuid": "177febb1-3134-49e6-b82a-9c362d2c9d96", "comment": "Malware payload (PureHVNC)", "value": "4346ecd832fef2f90845e41e81bd65529e554228143bacb6ebba653e87318b7ac39dfe202e4d7f444a459a99fa53228a", "object_relation": "sha3-384", "Tag": [ { "name": "2-27-62-123", "colour": "#EE0D0B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781763924, "uuid": "4cef899e-1726-471e-b5cd-6a8a81c9facd", "value": "T1FAF4BE4A77968E21D2880232C1DB5A0183F0654B7677E70E798523DB79033FAEE4B797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781763924, "uuid": "dacb80dc-251a-4827-bcc2-b8886f291249", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781763924, "uuid": "c9330eb1-6a70-4c83-ab5d-bd0655c978fd", "value": "12288:9tEQVwb8cZYHmasgvKo1Wh1hfEkoMmFlpq5IKlRE2h/sXVJSXpGMDEA:6bfZLbgyoyck0FlDi/2bSXfEA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781763924, "uuid": "2e2c67a0-f72b-48b4-b82e-12dec80bdd8e", "value": 785408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781763924, "uuid": "266904e8-74bc-444f-99cb-98b30295d91c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781763924, "uuid": "a4d427a3-5f5a-431c-ab10-e5a381c7edc6", "value": "5494ee3791297169a150b56bbeed16f5106d96f13a7c53c672d0fb2354b22dca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db300201-6b20-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781792428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781792428, "uuid": "04c685ec-b670-4939-8f43-10212fdb5c17", "comment": "Malware payload", "value": "0aad96ad91d333f2eb7a0236e11f3a88", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-NeuraLoader", "colour": "#49C19E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "proxy-aiddroneheat-top", "colour": "#CCB7F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781792428, "uuid": "a4e92de7-9adb-42c7-b05e-794b8f4a99c2", "comment": "Malware payload", "value": "550e46e0f77909d9043facbad4d1ac3a666e0a16b327937905fdb7198297efac", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-NeuraLoader", "colour": "#49C19E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "proxy-aiddroneheat-top", "colour": "#CCB7F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781792428, "uuid": "8c91f965-29ff-4541-bfa1-bbdbe88619ab", "comment": "Malware payload", "value": "6de1d6117a5ed47acbe21123fef2bfd01c2850e9", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-NeuraLoader", "colour": "#49C19E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "proxy-aiddroneheat-top", "colour": "#CCB7F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781792428, "uuid": "97feee49-b989-437a-97c2-04170c666751", "comment": "Malware payload", "value": "8b238281a8601aec8a5b9219b8f07beae98333135b29184aefa883bf25208e32a495000ac232a585335c8e44e9ae4b51", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-NeuraLoader", "colour": "#49C19E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "proxy-aiddroneheat-top", "colour": "#CCB7F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781792428, "uuid": "c27d3d30-b67b-4bca-82b6-6e95defafb51", "value": "T18485231B46E894ABF67C477244B30043A421BC7546A502FF26C5F4AA2F33BF5B93275A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781792428, "uuid": "2c0df6e4-b7b7-4a75-b1f0-bd6bb3550ffe", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781792428, "uuid": "983cbd25-404d-42ea-9370-b8aa36e9ee89", "value": "49152:WHpMAIRo2EuepaZQR9b5Ewl9ZMgNycn0ZDob+tcP:ujIRND69FvZpNyvZeMc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781792428, "uuid": "02fd734e-7d06-4c4b-9dd8-909c88abe60a", "value": 1847296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781792428, "uuid": "346df4bb-220c-42a8-95ef-dfec20496b2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781792428, "uuid": "3e2e0651-895e-46c9-9d5b-7276dded7333", "value": "BnrEJxahvs2oFp43h_lJxf3B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54bc40ca-6b2d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781797786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781797786, "uuid": "bcd3d8f9-9bd3-47d9-b246-413e1f106593", "comment": "Malware payload", "value": "60cc321d9ea0d76463220a7baefba3eb", "object_relation": "md5", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781797786, "uuid": "2ee93115-f838-4051-adc0-c376ccf83901", "comment": "Malware payload", "value": "55b19432e3ebeaaca12640b84151a96f50d9f2933c69ee41a4d3cf38c04b45f5", "object_relation": "sha256", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781797786, "uuid": "e14fd41a-7431-4e4e-9f28-765e83fedfeb", "comment": "Malware payload", "value": "c36347aa2a9fc5f201d8125ddc5898f66b184893", "object_relation": "sha1", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781797786, "uuid": "e4c3270e-ddc1-4759-9f97-c6878e648410", "comment": "Malware payload", "value": "e270eef4ffc81b3709c1095b6fb11dab70186323a5092d8cce3650eb008dce59e308abde07236cacc7732fdf634f314f", "object_relation": "sha3-384", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781797786, "uuid": "56b48d06-39a1-4e5c-b148-91d800b600e7", "value": "T12F86334892D418A7E897623C9AA3D156E3D2F9221B31CDEF2391532D2F73790483D7AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781797786, "uuid": "bac2c6b2-d645-44cb-875d-b2ccea7950fe", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781797786, "uuid": "eb566f7b-af9c-4c93-b397-b2db8dd89475", "value": "196608:yLKPSyZlvrsW4gXyTntTFqq8N3tTHsGXqr3pXFSFE7E:yLKayZlvrGtZq5XTHsGXqD7SN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781797786, "uuid": "6344a83e-a4a5-40d8-95ff-592686dea03a", "value": 8532978, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781797786, "uuid": "4cb4678b-fbee-44e4-b274-afd54af1b0de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781797786, "uuid": "a3b7c254-d74b-4936-a8ef-483c4b367ece", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25a0ba26-6ac5-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1781753039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781753039, "uuid": "21bb7186-0bd1-41e8-9ad6-7d0d8795187d", "comment": "Malware payload (RemcosRAT)", "value": "b6df392f1da02608153087fe008cc768", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781753039, "uuid": "4fa11a78-6d55-4413-aa0b-8214615a925c", "comment": "Malware payload (RemcosRAT)", "value": "55b7a6784ddc32e821ee316af79742b575af1d38a9cf305a15bce157bc240f07", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781753039, "uuid": "1dba1f36-0196-4b64-b376-d003178ecfe5", "comment": "Malware payload (RemcosRAT)", "value": "486ef354929a861edc55eed4608fcdd3262e38f8", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781753039, "uuid": "fde21a3e-1eb3-4d1e-aaa8-45b021920775", "comment": "Malware payload (RemcosRAT)", "value": "7eb8a15fa33a68048ad977410bcd6ee81ac9c300d055f11af4320dd41a0997532b3e246e620a97140b0612789631aa66", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781753039, "uuid": "07da4499-0ecd-4ccb-89f5-aaff7f66d7bd", "value": "T1F9232A31CAC507768E4307BDEE8516B4C5BA8A78402380BDFA6D731E540257CBF7E66A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781753039, "uuid": "30a405de-6375-41dc-81e0-7902a29eaf13", "value": "768:GI8BnyKntAAtseZ/Rkc0559Giw0jR8VSGPbgr4Nanbc7T58rADF08EijMUWngVWT:GLYmZpx0Y4jaVSSs0so73u8RwUWqWTf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781753039, "uuid": "3b20ee4c-eb63-48e1-9e04-a29392d004ee", "value": 45947, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781753039, "uuid": "d9f5e9f8-7406-4ff6-9ed7-d9db48cf89cf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781753039, "uuid": "bb637c5c-e2dc-4825-bd0c-efee08ce4986", "value": "Dissyllabic.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cc63b5a-6aee-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781770661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781770661, "uuid": "b2493b1a-21f0-402e-832f-a3557744817f", "comment": "Malware payload (Mirai)", "value": "88bc54747fd738a53d7a1bcf25d596d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781770661, "uuid": "2de490c8-1fa2-4ead-b6ef-1b3c131fef9e", "comment": "Malware payload (Mirai)", "value": "55b7e3c8f04e3ba7d9bef0b8cc7d605ba57d1c0aa2220e332c5f3602314f3f56", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781770661, "uuid": "c2801a37-1991-4e2f-ba6a-ac4a6e719ae3", "comment": "Malware payload (Mirai)", "value": "eb20b957eb16fc6c8338caebebf859e36c100071", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781770661, "uuid": "ad5b92c0-71fa-49fc-8b47-c893999ecce7", "comment": "Malware payload (Mirai)", "value": "ce232331547d355816d2b1252b52ef8b533dd7ae5db5cb6d64a7eec515e19df26f63e0c314aeccf49b4ae3f299e38d73", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781770661, "uuid": "3a5488eb-b7b5-45bc-af18-516328cfd9a3", "value": "T1C023F1A157E4BE34CDE08834F25ECA1959AA8F25D2B931D7B0680FEC234B5259FF2305", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781770661, "uuid": "46f9032b-36a7-41c5-9fc3-7c93198b3edb", "value": "768:mUyRCrCudkHVDtGprjHzcI16A9ldf/gtlfae4pvNt/KX6ynkbTrbX+n5s3UozO:DYYUf2rjHAIpjyt/4pvNKXJEzO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781770661, "uuid": "b2e904dc-f754-48f1-9f2a-1e4907649935", "value": 46140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781770661, "uuid": "4fdfe24e-60e9-4b95-bdcf-7d326b1b99b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781770661, "uuid": "b6f6fcd7-db6d-4e68-8360-98728f86c170", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9c44dcb-6ae4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781766575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766575, "uuid": "0bde114c-7fbf-42fc-b6ee-1effa57b61e9", "comment": "Malware payload (Mirai)", "value": "d0b4f449d3527e121ea589106f795c91", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766575, "uuid": "a6e2d0ba-3968-47bb-ba4f-c47be3993bff", "comment": "Malware payload (Mirai)", "value": "563a8eafe796aab1e5b6222ab81e22cc84103be6dc3b1e60633de656ea7befe1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766575, "uuid": "b931b9b7-f565-4193-abcc-e54324955e41", "comment": "Malware payload (Mirai)", "value": "d49fcbcf55d44dfc9f0af82ead324c77b544f15e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766575, "uuid": "877569d0-8b73-4cb9-b7a3-537bc1c856a3", "comment": "Malware payload (Mirai)", "value": "10c53e7558934df044fe502f2516137c2ca40fe145bc0e7bff5a21e91972e712895a8a0f32c03d8737d0ad75aac988b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781766575, "uuid": "19ad7263-66ce-4fb2-bbc8-7d162533ceb9", "value": "T1A134951E7E228F7EF6A8873447B78A60975933D616E1D584F1ACC3181E2025E641FFB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781766575, "uuid": "f59de509-95d8-4bfc-a88d-82fe4c5cf904", "value": "3072:TXhyNHcd5I9qXHP/NxMWORS0RcJdeUUKm7f4ma4EN6zRF:TXkNHcrI9qXHP1SWOgHel7da4k6r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781766575, "uuid": "f9642890-fa6b-4f42-b614-13d3b8573267", "value": 232496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781766575, "uuid": "a0003b77-9a01-4bec-9071-7ab58b31f92b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781766575, "uuid": "f46187a9-b40b-4d22-87f1-eed83d54b08f", "value": "onie_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4211cac-6b12-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781786376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781786376, "uuid": "e1dd1cad-fb6d-4d74-84d0-b1917df7ec4b", "comment": "Malware payload", "value": "13557e48d64dbce89086b1077e5c087e", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781786376, "uuid": "f5938bd6-b4aa-4541-9678-36d9258e6895", "comment": "Malware payload", "value": "56a90f247ccffb63543d99a659f9517edde587f6e85752c82a9919e325de3ee5", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781786376, "uuid": "faa20250-79fe-41e9-ad74-a70286bb69c7", "comment": "Malware payload", "value": "e687448d520cb3475b576a3fcd4c43fc018053c1", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781786376, "uuid": "a70f7c66-f8c8-43cf-99ca-fa8f686d1135", "comment": "Malware payload", "value": "b2d22d9e28138d8a2a17ff2bc9640d1b9347ffa755c709718c3a7af70f875d1ea620ffb6012d4f8d2e9f31f6097d0221", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781786376, "uuid": "6d82fa56-3ec0-4277-8630-99b6bac02ee8", "value": "T148936D6F851EC657EB30E6AB17DA918375008D9A2065DF52B4FF8B3A7204C0972E472F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781786376, "uuid": "b80000d2-4200-4c6c-a3de-ce2057bc9623", "value": "1536:cWGsLhC8GbhS0Ih0aac70BXw2Rx+Jgmx0+o20pc1+g1v:cMLhC8MyWW70Jw5ipc1+gh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781786376, "uuid": "bfdc8be1-a80f-43fd-b630-4e048d0b801a", "value": 94489, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781786376, "uuid": "7f1523b2-c674-4b39-8540-d1e3792cace5", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781786376, "uuid": "96001140-1f4a-4233-92bc-6f97e39c88b9", "value": "Shadows of BlackwoodHotel.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73e1a615-6ae6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781767344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767344, "uuid": "ff306bb3-0deb-4eaa-a59f-b2d27c5fe093", "comment": "Malware payload (Mirai)", "value": "9c94e0683b3b251b01cfd5e2a8dbea58", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767344, "uuid": "b0bb1f12-ffc0-4071-a8eb-1c476fa70449", "comment": "Malware payload (Mirai)", "value": "56b26ae369e3451b7ee985714d0ddcb1f5c334d6b59e546a8c1ed945c65fb7d5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767344, "uuid": "368c3a5c-1fef-4887-88bd-8a9062c09dc1", "comment": "Malware payload (Mirai)", "value": "f92cbe1177ba70086dd297f597513f5e631948f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767344, "uuid": "a240e354-2797-4327-9e00-29d3afe32fa8", "comment": "Malware payload (Mirai)", "value": "2894a31b12e863df91302ccbdacb4dcc5332804792aaeaf1e33e1ac52ebba4ae3176208761482c56dd140f78321c4f30", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767344, "uuid": "e04ec847-0c9b-447c-92f7-e52e452f1a70", "value": "T1E1735B25B83A2E23C0D8B07A52B78315B2E6274E34B4CA1D7D760F8EFF146A06567177", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767344, "uuid": "14db1a43-11d8-42ee-8e57-afefd8ad1fbb", "value": "1536:2Ax/EaSwlGoc4HtfHtEZ9izwJ2SRIV8aWJA:7cJA/Fc2PVH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781767344, "uuid": "91cf6c5a-90ef-4608-a865-c64eb2f13f2d", "value": 74760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781767344, "uuid": "1fe78d0b-4c80-4901-9e39-478b9ba83e04", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767344, "uuid": "ec9bf33b-c87a-42aa-9435-9414d60dc378", "value": "h0r0zx00x.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40fe58f6-6b34-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781800759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781800759, "uuid": "29176d43-2631-4426-926b-31cd18a5bbf4", "comment": "Malware payload (Mirai)", "value": "500f6b9862dc80175546b7049d5678fa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781800759, "uuid": "08aa6f9a-ff68-4ba3-99fc-73c52961622c", "comment": "Malware payload (Mirai)", "value": "572f3ca77c884256df5208b52079c4cf61d8bbdfceafc7bc516e9db2f770e362", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781800759, "uuid": "02267939-5432-4732-8379-a810b344cc5f", "comment": "Malware payload (Mirai)", "value": "c2d773c9611ef17e58de4120d822ff0235f9c3d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781800759, "uuid": "ef0e623d-b030-4e7f-8eb3-aedd3db6e3b6", "comment": "Malware payload (Mirai)", "value": "6abd4b2f486dcd1a114d9d408f9a30516859124d8fd7e7557ff42ede7d89ba2e83d480550d47a92aa1ecbd70c3e8c425", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781800759, "uuid": "0a76a28b-d3d6-41ee-82db-e8b8ecc62f77", "value": "T1C6733923EA16AF46D14761F0A9F64E740F12FC2A8D671EFAA564EDE881439DCF1043B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781800759, "uuid": "c7a8d8ff-c5cf-485d-91bc-04d44152dfb2", "value": "1536:epwtq/0FORx0SFXSRAJjnixAXNMffKM2HX7c+Gr0IKCSWUf1QKh:epv0QRxJsq/XSfCMKjGr0IKU8qU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781800759, "uuid": "f248a3da-487a-4501-a807-83740541b2da", "value": 79300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781800759, "uuid": "137813f0-2df7-4470-b0b0-ccd110ed4b85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781800759, "uuid": "a1a0b91b-3358-44b2-9904-d3e65b5268d3", "value": "manji.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5749ba58-6af8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781775027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781775027, "uuid": "06419ec0-29f4-4513-99a2-187faf61bba4", "comment": "Malware payload (Mirai)", "value": "dd47d3f802e7453f894c085accbf7076", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781775027, "uuid": "34f6e784-e7da-40f2-91de-5032868a85c2", "comment": "Malware payload (Mirai)", "value": "5757972a5d4c7dfd0531dcdf25f4cbe2e5df979463a87a8bb7e1276870091461", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781775027, "uuid": "826e9ea3-880d-4673-9199-162b5b24fad9", "comment": "Malware payload (Mirai)", "value": "6058363d311a7a5c1d2ed3f98a8aaeb059de7edc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781775027, "uuid": "43d2e29a-f76e-4eb8-8a35-7d749cc47374", "comment": "Malware payload (Mirai)", "value": "b87f1c812d2ab3519260a4cab1e370d4fcc544a7a6aea85f9cfff8568e203d607a83512bb7606ab2a448b5a4afa858e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781775027, "uuid": "38d1c801-b9c8-480c-b750-d6cbdf0ed029", "value": "T18A8302BBE6834195E06DF034C724A2027D3D2BE256D2FF25153AA106FA517E168376CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781775027, "uuid": "0ed31552-4789-4fdd-8eb9-40888901ef24", "value": "1536:ZwjCPfATh40W1BD6+cinCo7YGbeTmiT//qOUdcGK82Ax679WaDwqj+C7OVJuZ:ejCQd406F6TEYGbZiGdxK8S79WdVQZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781775027, "uuid": "0742ff59-5aae-42c7-b994-44a1d70762b4", "value": 87860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781775027, "uuid": "ebf74225-0dee-4125-87e3-a9abce59db76", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781775027, "uuid": "90399dc5-3a91-4b59-9c1e-fbc4b9d8c5c6", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6320544e-6ae9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781768604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768604, "uuid": "4b638a6b-6251-424f-84a1-c659777e2040", "comment": "Malware payload (Mirai)", "value": "6cc0ce5ce62527a125b5dd35a0bbb201", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768604, "uuid": "5373d6b0-910d-4386-b0cd-75ed83bd52d4", "comment": "Malware payload (Mirai)", "value": "58f93ca0ee0c08ee4e34a537b32fd462b06cd20ced26c68cbef9376a27e24b29", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768604, "uuid": "313e7ac2-aa49-4969-a4a3-5da1aa200ece", "comment": "Malware payload (Mirai)", "value": "0b4f032fadb5dd97197e9a8d2c4fedd0df8fb758", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768604, "uuid": "ed698e70-ef83-4003-a64a-de139e6ede8e", "comment": "Malware payload (Mirai)", "value": "6b67fcf31ca6343672b036e37bef61cf4871f91a31b1162130690dff22fbcf24316c857d38ef090f09fb218ee29f65d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781768604, "uuid": "c9ba1e75-281d-4691-b4bc-b358c9c6cc6a", "value": "T10E142A87F800EDBEF80BD37608538905B130B79658925B3773577B6FAC3A0951527E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781768604, "uuid": "ee85d4d4-6d4d-46b3-af03-385298952c48", "value": "3072:fq3cZ+o8mjdz9A5OqySOpc3O1/xqtNICbqTVcVXjbi0LmggXSmY4uJ:fAhNySkc3IxzlTVALmgDmC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781768604, "uuid": "2b4ac60c-6935-41d2-8a25-b7b5b782e9d7", "value": 193760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781768604, "uuid": "209413c7-e638-424a-b991-02023c558e17", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781768604, "uuid": "6408e21d-932b-41e0-ad72-28f714d6f32e", "value": "onie_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "567af205-6ad4-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1781759564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781759564, "uuid": "5b05bb6e-9605-4ed5-9bea-372ddeefd232", "comment": "Malware payload (AgentTesla)", "value": "b89d524f30d67b824888b8b0f5a4a2e0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781759564, "uuid": "f8b403b7-e675-45c6-89b7-b3fd783f9200", "comment": "Malware payload (AgentTesla)", "value": "597a70be6838e1c5fa82e405481a825204e4a75798beb2b0d02de069bd9d5d0a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781759564, "uuid": "0be2aaa6-fa81-40bc-8520-655b8f057490", "comment": "Malware payload (AgentTesla)", "value": "64898ed9f3717db5c0b57633ae49aec80eeb5b7d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781759564, "uuid": "cdb056f1-5fec-43df-9f9b-86ae2c332297", "comment": "Malware payload (AgentTesla)", "value": "43664072b318689112b17e66057ede60490c3fa2037b4b007c6818835e01c85ae0041171fb9f36a320335eac6d689343", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781759564, "uuid": "680d0734-b186-4845-8e7c-ba62fedae7f1", "value": "T19365338DCA1C99A81C42B33C1D34219F57F0B759D31E9A5B28FADBA2C27E63453FA444", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781759564, "uuid": "decbb060-b759-4cb5-bfa5-cad0672aaff7", "value": "24576:q4Pa0otVlvhoIsWMz8IQ/4HdQYOkxq8veY0ULHK1uCS1o8gnRt/K+raJeQGB364c:hPa0obthtsNzweOks8jBbK1uCx8Uv/y7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781759564, "uuid": "454a0d10-e755-435f-b459-2cc30d933f69", "value": 1462137, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781759564, "uuid": "8a2805cc-c302-465c-869e-c759ec3aebe2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781759564, "uuid": "c3da8f08-fbe7-44de-96df-9c00fea024d1", "value": "Purchase Order No. 25-26266.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99ed369a-6b2c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781797473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781797473, "uuid": "e843c698-ba5a-4120-a5da-e87e0facb061", "comment": "Malware payload", "value": "3d31f4c940465750af6496ba4b96a427", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781797473, "uuid": "0e46e20d-0c8d-46e1-b610-320837072fd1", "comment": "Malware payload", "value": "59d181abf742f564d5b94f4e433edc983774308bddd0ceb6f4e7caf42601ed12", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781797473, "uuid": "f4ed15d5-067a-485e-bd23-96440887857c", "comment": "Malware payload", "value": "a08c4183a77d15d4b9df0a887a52ff5e3e1b7e01", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781797473, "uuid": "f501a21f-0ff9-44f8-b2d6-8d51ea64b5a8", "comment": "Malware payload", "value": "54cf626de2d089cc632c3e429ccf2ea4a16a2c2973a6452e2f5eb11783e646c9493ce236bb3c998737cadf1264a28217", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781797473, "uuid": "c67481b4-fce3-4444-b78c-6147c4c0cf7b", "value": "T164F57B47EC9218FAC069A23189B646937B75BC061F3667D32EA0B3393F766D15D34328", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781797473, "uuid": "42c8e9d7-c641-4708-9748-d064cefcbffb", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781797473, "uuid": "2ed4f916-770f-4fe2-ac87-38905b6e31b3", "value": "49152:BGNVeUtQHborljTlA45h/EiSZFpM1dVVt3weUYxgLHd/P:BaQbyHlpZEFPidzueKF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781797473, "uuid": "34532557-ad83-49db-b816-846219aa360a", "value": 3342704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781797473, "uuid": "3d00646c-e036-4d99-9056-e5a66bc7f60a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781797473, "uuid": "ed7e5f06-59f1-43b4-b03d-efdc4b413324", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1551824-6b29-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781796277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781796277, "uuid": "c2759eb8-c42d-4b5f-b17e-35a334aa46fa", "comment": "Malware payload (Mirai)", "value": "1913b5a5ba56fd63292fec78bad4fb0e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781796277, "uuid": "717d6272-8270-4643-8638-5ed86760fe88", "comment": "Malware payload (Mirai)", "value": "5ac51bac7018c766350db3ca8ef588296aa0f67df65fa42740cf33f94bcfdfa8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781796277, "uuid": "8b871fbb-9ac2-41f7-804b-0c8d06a0bc14", "comment": "Malware payload (Mirai)", "value": "f15bfd245c36cae0808b0eef7bf945849091dddd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781796277, "uuid": "9a4380eb-a196-4b79-9ccc-9c86eacabd03", "comment": "Malware payload (Mirai)", "value": "242396cfd90c94601a97c84e32b0514d0d0ce092a517ada05126ca2af8f76acf326d1398fe6e64ee793784c60e150727", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781796277, "uuid": "3a25dcf2-f6b1-45c1-b2e3-ca62521e8bf7", "value": "T1F683023053416527E9C668337B156C8B8A4BF96988FD7BA3070D1BC06EE2217E47B8D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781796277, "uuid": "984d21e0-a151-44ff-84a9-218d979ba442", "value": "1536:TKtCp4i0517B/Wawi9q650h9Gd/oo6fvPH3P9Q6bV3scl9Jj9ZALF:qo4lB/ry66he/EfnHlhNscpjLALF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781796277, "uuid": "a81b3788-c999-4ae4-81fd-7ff461cdd197", "value": 85116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781796277, "uuid": "0962bc48-af2b-4ca8-a80a-0d313bd77d23", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781796277, "uuid": "2e73726e-ca4e-467c-aad7-e691d11c4a58", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "862edbde-6af3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781772958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781772958, "uuid": "cbc10302-fb5e-4e83-9621-99333ecab754", "comment": "Malware payload (Mirai)", "value": "77b6274771ebcd8717da027d00556a06", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781772958, "uuid": "d5ad7beb-8649-470c-8ad4-d2e41dfed5da", "comment": "Malware payload (Mirai)", "value": "5b1f952f45d7f797fe4d06e8a8e85df87c33d6c7b8445ef6891dcd9eb5b9c31b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781772958, "uuid": "2d46897e-b54f-4570-9d5a-a9dc56fe3c0e", "comment": "Malware payload (Mirai)", "value": "64e7412becab39f398f0b5712777e8427188688d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781772958, "uuid": "1243e2a8-4a66-4a20-919f-fa327e843b9b", "comment": "Malware payload (Mirai)", "value": "1a7a686a56ac5e244010cc079b428facb90a9f9a59e6c9ce3b1cbf1dfa31aefe58b3e94023db3d54183d1dbe864c3b38", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781772958, "uuid": "6f31da6f-3169-4899-a6f3-2e2313dac51d", "value": "T1F6B33A42BD82565BC6D5637BB96E5A8C336613F8C3DB3116CC124B243B9A92F0E37B41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781772958, "uuid": "0be619f2-5293-490e-a01a-20fe8e645035", "value": "3072:EABtL52d9R+DUn6shHnU7dWwaII+7PLV06caCB++7:7tL8Qk/hpWI+7PJ04CBz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781772958, "uuid": "8bdf6e9a-9941-4d6b-a35b-3ca2cb23100f", "value": 110316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781772958, "uuid": "7c59a40c-cba0-4202-a940-d5b009913096", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781772958, "uuid": "ec260e84-25e6-45a1-8f60-fdba0b9e56e5", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3b20b10-6b0d-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1781784282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781784282, "uuid": "eba9a2d4-4063-431d-af9d-040a7c684b64", "comment": "Malware payload (XWorm)", "value": "dcdb718a0e5576f3b63d3ee7d1e31bd1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781784282, "uuid": "a3e2030b-0caf-4ccf-8951-29f2cc05bb39", "comment": "Malware payload (XWorm)", "value": "5b24980d605b28c0863016aa90f67ccad03fc86f872896b031aa28f7e6e6072b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781784282, "uuid": "024e1180-4025-4e57-b7e1-deb9887ab724", "comment": "Malware payload (XWorm)", "value": "f3b60626ce790c40cbd95fe0d3d4a90c439e1d8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781784282, "uuid": "d8932371-5558-42fb-a6ad-89d09fafa921", "comment": "Malware payload (XWorm)", "value": "3a0fa803e21894534f7d605e0a8bb3d189d6a90cc8bd2825544daf479b7913b8501de4bc86bc020650a5449726c8287d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781784282, "uuid": "382d31f4-4fa2-4c22-b4ea-775cfa9895ac", "value": "T13405F1291E873B59D67E0FB8C022085827F0D8579396E76A3FFD40F1AEA3B94CD16452", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781784282, "uuid": "ef884290-2198-49eb-9577-19ac6c83adea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781784282, "uuid": "0ea3bb97-cff7-4784-b4e1-a9a377996f61", "value": "12288:SSEA2RHIEIGWGWK6cvyKy+H3vYUTuHSSjPCfpZqEW5laLk0on:oIECGQ+H/JTL6CfpVWaLk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781784282, "uuid": "aa8616e0-8125-4fa6-a990-ad94da4da19d", "value": 869376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781784282, "uuid": "0e5f8f76-1e12-4087-8d30-b6f4981d9e06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781784282, "uuid": "dd19f4b1-4fe5-489f-96b3-5a630c5f054d", "value": "WINDSOR COTIZACION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e0733fd-6ae2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781765536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781765536, "uuid": "ec35d67e-3a58-4121-a94b-4c2759e42e81", "comment": "Malware payload (Mirai)", "value": "6bf637c8e1daabb725df467a00398bb9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781765536, "uuid": "658c6b0d-604e-43d9-b86c-d7df6aa7a46f", "comment": "Malware payload (Mirai)", "value": "5c38955efb937bd3f6b088defabf4b244dd90e154da4d1f77f64e79a4b4e4a4b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781765536, "uuid": "40c487e0-b85d-49ee-83a1-1473e6858707", "comment": "Malware payload (Mirai)", "value": "b49a4a1abade994e581242d48d67099592ed67bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781765536, "uuid": "b75eaa04-96bd-4c69-9f45-c115a965ac64", "comment": "Malware payload (Mirai)", "value": "adb872fbd7ef00c9fed46d82f250a71bce5c241eae21fe1914f5e8c34106ef1806075afb4884a4df2ac0e852d9649055", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781765536, "uuid": "3a71982c-79ed-4b00-8e03-171883003b0e", "value": "T150C34B45FA43CEF7D40719F021F7AA3A9A30FD3948B2D485EB507EE1C6569C6A60632C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781765536, "uuid": "eeedb553-846a-4dec-9941-938e775e8b54", "value": "1536:qCWCirNAlThjqOA5VoHPO/YKzmV2WJQTQi2e0H+p9Q3Uqgw/Tga7dg:qCZi+PgYOouJ2e0H+p3qgw/0KK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781765536, "uuid": "862bf7fb-66bb-4c15-bf5a-2619e8c4c28b", "value": 129764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781765536, "uuid": "c9f95571-446a-4c92-844e-0863b393b47b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781765536, "uuid": "8a362e52-ce9b-46f3-9b30-2e8bf88c7cd8", "value": "nova.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33461054-6ae4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781766377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766377, "uuid": "a15e27dd-144e-408d-9cc1-2892a97f10c0", "comment": "Malware payload (Mirai)", "value": "b6a39988c191f0c8ad1e9fe5d370baf9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766377, "uuid": "42093dfc-be62-4f3b-8851-053c1351075c", "comment": "Malware payload (Mirai)", "value": "5d8e6bf3bbc2f239bcb06d1363db19edff1f4ae99beb7bde9757fb6b548b470e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766377, "uuid": "7ed05bc2-bb25-4a5f-ab67-6573550c5103", "comment": "Malware payload (Mirai)", "value": "98c1da4cf0a4105fb9a8e690eadd97c8fc2f181d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766377, "uuid": "cb02f77e-addb-4ee0-9c08-8e759677d561", "comment": "Malware payload (Mirai)", "value": "9227be646b28ba2a3a2eca21089ca383d6f73740494f71e1d2ffd805f6afbb2ce653e13394931129e47c05f5c296cd59", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781766377, "uuid": "1917daf3-d0d4-42d5-83cc-bd54e73e5bda", "value": "T133C3BECBB64B5550C42106F11BC79F8E3F5362258D6FE8EB2C0EA33B25765DB090A792", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781766377, "uuid": "59b58e07-a139-41c1-b289-7f0c8d366436", "value": "1536:ilrNjZpHkJ3HiRTEmYC0iPqIKHZrpMfCFV3BsEdLQrcrDD9+gCxa/LWs:i3/YHQS5tMfCmEdLRn9+gTq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781766377, "uuid": "26801cd4-f1dc-413b-b66d-6543b9fa2429", "value": 124084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781766377, "uuid": "725df744-a12d-4130-ac66-816e0483158d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781766377, "uuid": "19b691c1-a0fb-4b28-9b28-5216e3a9b930", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d522bd1-6b34-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781800753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781800753, "uuid": "1d6a8bbb-2b6a-4f5f-8fb3-49a55c02ba2c", "comment": "Malware payload (Mirai)", "value": "89a3a07aea20d7ce9a5c4e27338b086e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781800753, "uuid": "7f770c1d-d0fa-4be5-a7c1-634920616e3d", "comment": "Malware payload (Mirai)", "value": "5e3b83a206c43cb929d24a24f8e826d45d3d3f970e3ba3df0305b3c8570f98a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781800753, "uuid": "45924ace-e357-4409-a49d-ef2f618192d4", "comment": "Malware payload (Mirai)", "value": "1e7ad504643c074b1b55f0f8389722b3c77dd339", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781800753, "uuid": "5c076e19-9569-4155-83d5-075765213813", "comment": "Malware payload (Mirai)", "value": "a302a8e9de15eda2bc3c47b3ebae2a51be7595a11591dfc2f0fe1f109343e56832a1f6f598a88b68665510c393417244", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781800753, "uuid": "04bcf617-103b-4323-98b9-ff9e41533083", "value": "T15493080377094F03D06718F426BB1BF187AABD6118F9A284751EFEC99271EF26146F89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781800753, "uuid": "77189586-cb1a-47a3-8029-5518f5b47520", "value": "1536:GLM+0jysRh/6Yw6So8TS2W9z8w/3fxDo7qq0xeVq7QZlnrsevVhOw:GOPRIYEXK8gfreVq74rDYw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781800753, "uuid": "10daa283-3406-40ea-affb-3b3fd09aec4a", "value": 88812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781800753, "uuid": "51c418f9-9ae3-4261-bfa3-0dacff4164e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781800753, "uuid": "862b8f47-788a-4a6c-a447-7b5e084d8627", "value": "manji.ppc440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a27b9997-6b5b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781817673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781817673, "uuid": "9c737978-099c-4802-9cd7-0a47cafc4220", "comment": "Malware payload (Mirai)", "value": "e05fbf5e2446935933e00c932791443a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781817673, "uuid": "2815c1d3-1287-4876-981b-ba3f53aeaabe", "comment": "Malware payload (Mirai)", "value": "5e6d01f4c14b629f29469089956043622a815ffef918b9f0a99d39c0f13e934e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781817673, "uuid": "4b5626b4-db5f-483e-b45a-8297f8e87e9c", "comment": "Malware payload (Mirai)", "value": "31a67ab279f6739ed66347c47c91129c842fe8f0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781817673, "uuid": "2e9034b3-4b7d-468c-9119-f11de0a8303f", "comment": "Malware payload (Mirai)", "value": "a8472f3c6cbe3050a1276eed6372389c45726230af2c20afc4df5c7f783dc3cbb94f3c06199416e0530d6f68e8b57726", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781817673, "uuid": "9fc4b9e1-36b9-4bba-951b-fff4ae4f55a2", "value": "T174F30956B8819B15D5D215BEFF0E128E33231B7CE3DE73129D245B307B8A8AB0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781817673, "uuid": "87e5a01f-2dba-4151-93e0-db6affaced42", "value": "3072:b/okz24JnNOUqDSFcfg9ayNjOh6uxZMpHNwSsxS5URNl:bZz2/RscfAaydOh1MFDKS547", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781817673, "uuid": "859ff8ab-3a26-4968-9b0d-cd3199e04dfc", "value": 159772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781817673, "uuid": "cb9762b5-9064-436f-aed1-a8b3f4ae3f05", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781817673, "uuid": "dc64a65a-84f3-45e9-986f-ef3f856e516a", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79208733-6ade-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781763917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781763917, "uuid": "ade1837b-97a4-4177-bb03-a0a57177a71c", "comment": "Malware payload", "value": "8d46f7d3a2c0bb97c766ffd17e583df3", "object_relation": "md5", "Tag": [ { "name": "2-27-62-123", "colour": "#EE0D0B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781763917, "uuid": "600634c2-96f8-4375-8841-3fe0850dfffe", "comment": "Malware payload", "value": "5e8ac004c548e67e706f7293b5547144f8d66c8d38f28f05bd1ff6c6766819e8", "object_relation": "sha256", "Tag": [ { "name": "2-27-62-123", "colour": "#EE0D0B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781763917, "uuid": "07e0af9f-01e6-4b88-a9a3-42b8a7bcddfd", "comment": "Malware payload", "value": "7f4bb7e323d9f19e729f430aa67ba0678cc56cf5", "object_relation": "sha1", "Tag": [ { "name": "2-27-62-123", "colour": "#EE0D0B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781763917, "uuid": "620b72c0-8af2-418a-a949-f82a310478f8", "comment": "Malware payload", "value": "280f559b4996c7459e72a609721a2b6411a6d3035cdfe2516b66889b8c80efb4ee3dc879408c51999be2be1f95f6eafb", "object_relation": "sha3-384", "Tag": [ { "name": "2-27-62-123", "colour": "#EE0D0B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781763917, "uuid": "ac54bca3-3a42-4e05-bd74-4d11e74e125e", "value": "T15B84238B97164203EACF023884B39AB5A3B0D0155EB1E60ED9FA50F76E707DD2985379", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781763917, "uuid": "1db57c0c-acd1-4005-ac9d-6108f035fb77", "value": "1536:AT8jx2MmORavgXOHithDeIUVQsS3miXXSBpiFOIgVejPzAx06c0MCAj/lcmuN7m/:aex2Qw4veQsQi/iFuedlmlAZxP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781763917, "uuid": "b856140b-e089-4b5b-b830-3040d9a911f7", "value": 378368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781763917, "uuid": "281dde49-bd54-46bf-b698-5763e4e1d785", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781763917, "uuid": "a3f0816d-a0bc-4497-9297-e42c532ee204", "value": "5e8ac004c548e67e706f7293b5547144f8d66c8d38f28f05bd1ff6c6766819e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cd791ad-6ada-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1781762071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781762071, "uuid": "1319b879-0f12-43f7-91ec-22627f222a2b", "comment": "Malware payload (GuLoader)", "value": "4b27440dc8cb57d6b77632e6520af4c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781762071, "uuid": "100674fd-eb95-430c-9d70-96d986a652ec", "comment": "Malware payload (GuLoader)", "value": "5e9db5d3315b40d2918de07c2ef6fb1228125d200194ea8e8879495acf07d545", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781762071, "uuid": "afdf599b-6d0d-42d0-978b-321ac5175f22", "comment": "Malware payload (GuLoader)", "value": "f3ef3854aa7f344c46587b63c93c97d4bf63b9e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781762071, "uuid": "7e5ccdb2-826b-4126-9970-aac340197ed9", "comment": "Malware payload (GuLoader)", "value": "6a2368b1f5e5d151a060cb67a12ad69738761c8c1aa8d5452e5b9f34fb3d4e3ac3c4c7782ae976ddd7f9f13aca56b5f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781762071, "uuid": "6529fa4f-4ae9-47a6-b238-ee9895322e44", "value": "T1EA250181AA50C176D9A602B0DBEBFDF41167BC1FF8A1194B3AE1BEDA3D72160441718F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781762071, "uuid": "a4de31be-af84-4209-b70f-cd222361d8a0", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781762071, "uuid": "15c7d5cb-701a-445c-8ea2-a21d7a0d03d3", "value": "24576:tn3ClvMI4qfv4Qv3K5ItTpT3KfSa2o1HOWfVvc:t3Cxhfv4Qv3qIzrKfz2o1uW90", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781762071, "uuid": "522c214a-b446-499a-9f9d-bd36ed66a8ea", "value": 965053, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781762071, "uuid": "92781fc5-a6d6-4951-82e8-c114ae641c76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781762071, "uuid": "6715de65-9238-4d20-9354-892aaca385f9", "value": "PO BCF2026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5fb2cdc-6b0a-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1781782917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781782917, "uuid": "14719650-02ee-47b3-b039-c174562d5e92", "comment": "Malware payload (ValleyRAT)", "value": "bdebbdd73647ed8e823dfc35237c9654", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781782917, "uuid": "3d89fa9d-26f1-4a48-8d96-590ae4511fa6", "comment": "Malware payload (ValleyRAT)", "value": "5f63a3d786af6fe7edc91b6c9f2734eff3e0959302c2717f1268764ac13a89f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781782917, "uuid": "84c242fa-1fd9-4f69-b109-39fa8d8e00a5", "comment": "Malware payload (ValleyRAT)", "value": "f5c59d04a67e4c56c576438908472c9f07169f69", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781782917, "uuid": "95086f13-4b4d-41e0-89f0-a78ad87a453c", "comment": "Malware payload (ValleyRAT)", "value": "a36259f49baa6a1ff59ed58c42b89fb55e5e6fb293051a344b7b75ef5434a4e15b3ded41f00d4392346a61b2a7496b21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781782917, "uuid": "19a460df-0e77-41ff-839d-af8a2196b717", "value": "T13195229D6A4450F2C57452F58D0805B8A2BEFD1F3E203925BA38AB212C77786DFB8375", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781782917, "uuid": "e844d0d6-9160-4187-bd3a-99103621c231", "value": "b352331f1815c3aef5e75c650559b8d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781782917, "uuid": "500b3041-f76a-4781-91f3-66d9227891c9", "value": "24576:sBT3IdwagHtoI7Wtgu/917dYl4R0KuGk2XGA+t:sBT3IdwagH6I7Wtgi7dYlkkMl+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781782917, "uuid": "e5db13a4-f6a5-49c4-8d52-87dfb1663d5a", "value": 1986048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781782917, "uuid": "18628f60-91b9-49d8-9822-e0131e8dece5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781782917, "uuid": "d512b48b-887e-4018-962f-c74ee1225d19", "value": "2026.6.17\u88c1\u5458\u540d\u5355\u53ca\u8865\u507f\u65b9\u6848pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ecbe859-6ae2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781765537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781765537, "uuid": "265882af-d590-44ab-8ae4-622903774799", "comment": "Malware payload (Mirai)", "value": "f35011059ff44acbf9291b95ae47c8eb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781765537, "uuid": "bc64ecc4-a1c1-4038-9e57-6a353333f5f1", "comment": "Malware payload (Mirai)", "value": "5f9a00e04b461563c5886b7e7b5b555ab7667ec58adafd1325ca3bfb6e29f844", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781765537, "uuid": "045ad894-7449-4689-80e2-44f9c6c68431", "comment": "Malware payload (Mirai)", "value": "f1b2fcf036b0ce3e1e311c14a06f9ed15f5eae8e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781765537, "uuid": "7712dd56-15d6-4d1a-8c0e-cec1615690a4", "comment": "Malware payload (Mirai)", "value": "55be999bb1f60fa60cdb27fbb46b2b779107875d25edac13ae2173fc7e0845a3fc9d2d1a23165da0bc14366396fc0b39", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781765537, "uuid": "db4de2c8-b725-47f1-97ff-6b1616a19742", "value": "T1C414C81A6F228F6EF269867047F34E30975836D727E1D684E2ACD5101F202DE645FBE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781765537, "uuid": "b7007a20-384a-4082-889e-a30ee8a01507", "value": "3072:WyboGFljNi+yjV3k9Xvns32F7qmK3uJ/scQ:WybDsZE/s3u76U/nQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781765537, "uuid": "efbeacc8-cd55-4a81-bf93-0b0e0a48ff41", "value": 200108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781765537, "uuid": "26eb7622-7f74-4e0b-85ed-84e76d0df0b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781765537, "uuid": "5e1acde0-c035-4a22-bcae-677b1cdd7eab", "value": "nova.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "770e4789-6af6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781774221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781774221, "uuid": "b5455737-6cf4-4382-aca4-f4e71e9abc06", "comment": "Malware payload", "value": "82e88a7c84f36516a2637e6e90421f28", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781774221, "uuid": "2d58d122-a5e9-4fbd-9656-1f1a362b7c9a", "comment": "Malware payload", "value": "60089b8b41676b36533a66b5cd648ace8a1e704a09764c6fcdbb04f9588c8b29", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781774221, "uuid": "3c810920-c33d-4a77-aad8-844f12bb6a31", "comment": "Malware payload", "value": "f9e1a4549404df87eb853e899873da1cc0b93b18", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781774221, "uuid": "ca9a49c6-db63-4f5b-a5f5-732822c3b9fc", "comment": "Malware payload", "value": "088a325f7295251cddc2dfaf5d4b8456aa0e73e103b641c7737aabb05de404b86130ac8889a8b3db4ae5f25ffe90b4ae", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781774221, "uuid": "bca7699c-7fbe-44c2-8e0b-713f2832c70f", "value": "T137311EDF40152A7A0213DA8DB3E23548B04C99EB1C9BD7959A480FFD828C6CCB266BD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781774221, "uuid": "aadf55a9-92b8-418e-98d3-bfe21b50c0ef", "value": "12:UI6qb6RD5NwL6NwgxTGni6naZ0czGIu6+HRZL6ZDLVXxbE76bEvp1b612l5Nql1p:+Dt4B0qysHvtNdj2W7Fch", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781774221, "uuid": "f8e2a4d3-2d23-4c8c-9381-57e394f85333", "value": 1584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781774221, "uuid": "c1fab10d-61a1-4cc3-9c58-d015f7714c02", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781774221, "uuid": "36f8f242-02b9-42d8-90e3-a2eb1cad0ebb", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2294672b-6b2d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781797702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781797702, "uuid": "324ebea2-1f4d-4d20-8b41-4f749b570f9a", "comment": "Malware payload (Mirai)", "value": "dbcef07419b472fb641743d5ecaf948f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781797702, "uuid": "c3a748a5-c01f-4d65-90a6-801d767dad98", "comment": "Malware payload (Mirai)", "value": "606632c141c6b730ace7cb72d7a14850d40a3a8d44d3b4dbd5ac438119e06dc6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781797702, "uuid": "c94ac036-cc55-4a4f-a820-9da19b12b6d3", "comment": "Malware payload (Mirai)", "value": "375ef75677b568b613b1999499950829166f59a5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781797702, "uuid": "e0a367fd-bbb8-425b-9efd-d39c85e04dd2", "comment": "Malware payload (Mirai)", "value": "adcf2b780d5524d4c42b11960fe31c8dca5a3900097b40ce58fe9ce2f7a5817fa120d5261302f6e4c3bcb8f1a36b5e2a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781797702, "uuid": "ccb7de24-df59-4bfe-b834-ecbfc3151c1f", "value": "T19E53022D7EC2FDF0E16E5730C181DD2DCAD2C36E46BE2D66A80E50C598520161B7F66B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781797702, "uuid": "f5f3fe3f-39b4-4531-8ac4-e958a9a5df6a", "value": "1536:7y7KPE2M01eN5JaKdgdhxXK7sKlY8E0LI+0I:7y7Kckyzea4Kl9dLUI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781797702, "uuid": "2880ae30-e97b-4c71-b4ea-4bcbe69ad67e", "value": 61248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781797702, "uuid": "4026cfde-0251-4b85-8846-92fad8280354", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781797702, "uuid": "0fcb53e2-c885-459d-8d1e-370bb59fc805", "value": "monero.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9dea268-6aa8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781740806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781740806, "uuid": "10557f57-a44d-4d03-85bd-f385eb7beb83", "comment": "Malware payload", "value": "d677b371a882496bbb8b5d8b03c876f4", "object_relation": "md5", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781740806, "uuid": "9b643dd7-c703-47ff-a3dd-5b427d89a4f6", "comment": "Malware payload", "value": "60750c0099468e2efb627d18ad2188da23c6c8caf83b7e29941020113094851b", "object_relation": "sha256", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781740806, "uuid": "5c40b7e8-9839-4753-90be-faf60761a29f", "comment": "Malware payload", "value": "e8e0ecfaab55316783214c15fa08ed419b2f958b", "object_relation": "sha1", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781740806, "uuid": "f131db46-be98-4675-bf7c-14388e3a084a", "comment": "Malware payload", "value": "e0688233e0eaa6648b7b03a7487c800e5e468bd7e7d3d06617129e117edba9fe388bb27e500bfc0332a174c513e06b65", "object_relation": "sha3-384", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781740806, "uuid": "5b217ad9-a56e-40af-b12b-8f5bea76bd6c", "value": "T101A1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781740806, "uuid": "bb0b5d3d-2de6-4226-9cd2-f45dd370f0e8", "value": "96:YRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:YRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781740806, "uuid": "0eea590e-1bf6-4074-988f-7eba53d13754", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781740806, "uuid": "db0f14da-44c4-49ec-82b1-0af2916e382b", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781740806, "uuid": "f8c524dd-ecef-4f7f-a86d-2694e7ae68f5", "value": "60750c0099468e2efb627d18ad2188da23c6c8caf83b7e29941020113094851b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a52ebfff-6ae4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781766568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766568, "uuid": "ed76afb2-ed7b-48da-991d-5b3f30cc23fe", "comment": "Malware payload (Mirai)", "value": "b634381eb560eb3955ea690eabef8968", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766568, "uuid": "28e028d2-bf12-40a3-8e5f-9eefae2d9cc6", "comment": "Malware payload (Mirai)", "value": "60dccbc1670713941fa36e789b986ab8709931d9271792b24ee85f169fd96334", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766568, "uuid": "1aa94d18-6611-48cf-b4a6-9ee8fdfe111e", "comment": "Malware payload (Mirai)", "value": "e43e09802f8fb274719a623ff17c5ab6f7e039b4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766568, "uuid": "6a66c2ad-ba52-4b4a-aada-c4e7fbf2bc3e", "comment": "Malware payload (Mirai)", "value": "992c48635ad08b080c67cb82990879f8e47305174d15c449a113b2357680341014ec0a9f37737340103156029d515862", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781766568, "uuid": "f8a7b993-2719-4957-a19b-5b76b2146cde", "value": "T1AE110C8F23B4D3A2394D8EA5F77A821D7E4CCAC579FECD80EDB5546854C950010A4B6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781766568, "uuid": "a2e8dcff-1f8f-451b-a994-4960fd42f0fa", "value": "24:3J3zh4/HNNIXhNJ3xKqMGFsNBNIXNhY+kpgbp4MHA:Zh4/H0hN/1MGFsNBNIXN/kpgbp4Mg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781766568, "uuid": "6d4dd496-15a6-4bea-80bc-bf86763f37de", "value": 883, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781766568, "uuid": "115684d5-5f7b-4822-9735-f0319597cdd9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781766568, "uuid": "92445f3a-7919-42fd-9268-b7c1a549f591", "value": "heromc.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7863a7d5-6ae6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781767352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767352, "uuid": "50e93a4f-aa71-4c9a-aeca-a78baf45d3ff", "comment": "Malware payload (Mirai)", "value": "f1ff1b764acf5baca3eccfec60456705", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767352, "uuid": "84cc1b63-d63a-46f1-b7e0-bb4397beabe9", "comment": "Malware payload (Mirai)", "value": "621432b864b202bdfb742848cb73e5592e881cc154f9082a8fe7055901ef7fe7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767352, "uuid": "8dfceea7-db8a-40e5-81c8-bc6c77ee332a", "comment": "Malware payload (Mirai)", "value": "0f670b0c832873d19a3b5bd01dd16df22be81399", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767352, "uuid": "abaf6646-8212-4e9f-b385-063358dbe244", "comment": "Malware payload (Mirai)", "value": "13894e8ee2766ffa1d0e2adf56253fbeb9859269fe336af1dfd064924ccabced8af953e30266e7edb138441da5d489c1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767352, "uuid": "3728635f-5411-4912-abad-d5cb37c188e4", "value": "T1B3D2E196F2984D61EEEF0BF39D5DD7C16FC456543683A4A122017F84A1A03918F1B58B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767352, "uuid": "6c2f1642-dac5-4a28-9b57-1d71ec07ed34", "value": "768:OZfgTPgrhhNIfV8sKtbdFsxnLXsrtdxxXqwXGD4uVcqgw0RTWXh:OZjrhAmsKtxFoidxxTq4u+qgw01WXh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781767352, "uuid": "2ac1e8a9-a9e3-40b2-b817-b8733800a213", "value": 30744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781767352, "uuid": "9e5607d4-0228-4309-8dde-b74de5717b06", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767352, "uuid": "fd462726-9cd8-4583-a8f4-2f85ff0c37a6", "value": "h0r0zx00x.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "970c7353-6ae5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781766973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766973, "uuid": "f82d415b-dfac-4b09-a76b-0d2d71fddf36", "comment": "Malware payload (Mirai)", "value": "3adaa21d731f66c5bc85be481e707831", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766973, "uuid": "18fa3258-de61-4e4c-beb4-ba44b488cfb6", "comment": "Malware payload (Mirai)", "value": "62299499a07e8b7e94108124ff23eaa6763177b78fd9e43f057573b315abc035", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766973, "uuid": "227c33a0-d080-44a8-aa31-fc421700729e", "comment": "Malware payload (Mirai)", "value": "a4d1d383fe41c47980476bee5608205379bf0e2d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766973, "uuid": "a329b10f-e968-4323-9a3c-639e2af88d7a", "comment": "Malware payload (Mirai)", "value": "1140bccaf8ae4351f89028935bf46c26283e5c4fb412e2237fbb472b20cabff893cb23831d792e889fe40114df618a8c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781766973, "uuid": "a0b6dbc6-f951-4cfd-8d60-1fc98716eedd", "value": "T168149D63D4786ED8D66498B4F4F08E781B43A51582472EBF76E6C9748087E8DF90C3B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781766973, "uuid": "01681808-414a-4495-a349-fa1306f7f44d", "value": "3072:+v+fGTVLryTWFX/mA8bYMc4yL9Q5sEBskWn1ilmcXR7:helJ/mre4yLCC9n2mcB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781766973, "uuid": "f6b8880b-c05a-454e-aa8d-81799a4e9775", "value": 191428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781766973, "uuid": "04931368-6536-4d83-ba27-86d92417d353", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781766973, "uuid": "a71a70ae-a183-4459-918a-ace570747aaf", "value": "psh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d79123f-6b31-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781799438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781799438, "uuid": "e20e2765-e078-475e-8ac3-a75ca91e2507", "comment": "Malware payload (Mirai)", "value": "346ceeb34d80e4c71a7eeb717e8d6f3d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781799438, "uuid": "f7d5feb3-3e4c-4719-888c-bc6c69dcdd31", "comment": "Malware payload (Mirai)", "value": "625640bd9ab1a4afcf15dad80d525d8359799e97d25dcce5ddaeda71eb48dd60", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781799438, "uuid": "7e20373b-30c4-413f-8795-a91169ef8e6b", "comment": "Malware payload (Mirai)", "value": "cd18c908c278a7d14c018def7a28fa1b9c762c88", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781799438, "uuid": "0ae64cba-5ddd-4841-94fd-668a4528d582", "comment": "Malware payload (Mirai)", "value": "b6b857c225e6a70cd6d6a0695bcc71c596201a2ed8a4530bde4fb1b7fca3e8675ce5a6668477288c78ca18e4025ed189", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781799438, "uuid": "f909f7b9-f7c2-46c4-b5be-1e4a92551059", "value": "T1DDD31945F8504F23CAD522BBFB5E428D772A17A8D2EF72039C256F20378695B0E7B146", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781799438, "uuid": "65507bec-de48-4b08-89c5-99b25e70496b", "value": "1536:Z/wMY28Ly4z0vTRGca8bA5ur4V4Z/1TQr24k2sVnOIUISjBKwIuAYlkmwywsYlID:Z/1r7LUn8bj4Md424kpKfI0Db", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781799438, "uuid": "d980a5d1-d767-4669-aa68-77d174071864", "value": 133920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781799438, "uuid": "7808caf8-a8d2-480e-8a77-d62ed73c897b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781799438, "uuid": "617a763a-33db-4ade-aeb3-a37c1dcc4f72", "value": "main_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5ee84bb-6ae4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781766569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766569, "uuid": "c13fcabb-598e-41a3-9bd2-855dc43ddf3a", "comment": "Malware payload (Mirai)", "value": "0cce62d7a9952fa81a63c244bce1c4b2", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766569, "uuid": "493c184f-fa4f-4787-b311-f92598ab93fb", "comment": "Malware payload (Mirai)", "value": "62912430d658771b5a6b8254fe64602a667bad564a6de0dc0a9fe987a6d97730", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766569, "uuid": "e5db6946-f023-4563-a533-43c4d8fe07ef", "comment": "Malware payload (Mirai)", "value": "cbd6fa26c8dddc8e00e6aeb658b58480e7826d4e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766569, "uuid": "76015f2c-df95-42d3-8277-40d06484706c", "comment": "Malware payload (Mirai)", "value": "93b56a08cb51ba9fb5c1e9163cb37ce5667d0c8d8b2f522a7df4c51c401d74bba94126a3b9cf9089438aa9dfc22ac9e7", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781766569, "uuid": "7443960c-ba1a-4460-8658-10a447c11027", "value": "T13D11D7CF22B0A37510888EA1E67A87196C4CCFC539DDCE889DBD14B666C9D10E165F4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781766569, "uuid": "dc562a12-cd2f-4cad-84e8-eec8982d783a", "value": "24:0hoVHNNIXhnJ3xKm8GFsnBNIXnhYa0pghp4Mxv:0hoVH0hn/P8GFsnBNIXnV0pghp4Mp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781766569, "uuid": "0197d87a-b728-4cc7-9c9e-87f990ae7249", "value": 958, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781766569, "uuid": "fedc080c-def8-4317-843f-c8bae872e728", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781766569, "uuid": "9b44cdbb-e241-4e49-a0d0-b9a904fab816", "value": "tranphuonglinh.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a73dedc4-6af0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781771725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781771725, "uuid": "d08084bb-f0da-40f4-bbdc-f200a98c6e4e", "comment": "Malware payload", "value": "5a2fb836a7a240a3174e2e9050d17298", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781771725, "uuid": "4fa3068d-79db-4ac8-ab23-7003653860d6", "comment": "Malware payload", "value": "638b05004a5a465f1b81cf03247c3797ffbf0241171d472340254085659b000d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781771725, "uuid": "2d83cfed-9c54-4766-a076-d451ef4fccea", "comment": "Malware payload", "value": "089be155825165fbacc3743533b6383e5eb812c1", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781771725, "uuid": "f249731e-bf65-434a-993d-1d739b083fdb", "comment": "Malware payload", "value": "34f55f3e485c68a0e81a655e6646afe6db9bdb342d1c3acb4924a2aef35a94451216d97ad1f126b6cf892965d4a13022", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781771725, "uuid": "1e120385-2fe6-4e50-9e33-bf1cf4b013b2", "value": "T1C6136D6566913C28AE9998371D7E1F0CBDAA83E23104A1DDBFCB3CF18C55A9CD21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781771725, "uuid": "3e3f5df9-5594-4c39-8852-f1a62c154841", "value": "768:DCXRWNGxVX9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:DulxOco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781771725, "uuid": "2c1e3f67-364a-491e-8914-74cac6ddc892", "value": 45203, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781771725, "uuid": "9a2649f8-3a9f-444c-b571-75860cc51ca5", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781771725, "uuid": "a32211d5-1540-4147-a230-9c7391e108a5", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09844d7d-6b02-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781779191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781779191, "uuid": "344d543b-1abb-4628-a87d-3e9e48b9b6c4", "comment": "Malware payload", "value": "59de41d26e1b54cddd0fbad3cb357d75", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781779191, "uuid": "df2b1205-f86e-4e54-8555-5a96105053ae", "comment": "Malware payload", "value": "63ac6f81355d2fbc833c95e7173526f7192fa9bfa3c0e77747d924b89851b683", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781779191, "uuid": "555f29d1-6c71-4c54-a7bb-714ed8f9b662", "comment": "Malware payload", "value": "2822dd2f881a0950c7404db59ddd683842b0ef5d", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781779191, "uuid": "7d44c24f-a0c9-44cd-8e22-67f3620e6448", "comment": "Malware payload", "value": "6a722dafe271333666b14c2750fe4b8bc1e8d6fc65bb2cc8ed69bb4c950626c8e60a6feae8ed1e7fb52eeba6a6d099ff", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781779191, "uuid": "a610d16a-5872-4451-9713-2c550ae45509", "value": "T1545108017A87BF07E546BAD3450E2507BB09029E78B2491366E135C42A0F86605EB2DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781779191, "uuid": "5a6a958d-700d-4d4c-adcf-fdc7473c35d4", "value": "48:ZSqXcSxwO6UDDJykzmZSo6oLTGDuMs8xbuPqqU4nAr1btJZit:ZSs2U3JVzm6OmTfxKPQtpbXZit", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781779191, "uuid": "8c70bc11-1ef0-45b9-a350-a9882c8ec782", "value": 2489, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781779191, "uuid": "06c6d593-49c5-43d4-8264-d0afac57c613", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781779191, "uuid": "a6f14d3f-a6f2-4b68-8544-5ae15ba66e54", "value": "Ninja.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d71a0a6-6b2b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781796888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781796888, "uuid": "fbbc434d-cd02-4f73-ad87-f225def5e560", "comment": "Malware payload (Mirai)", "value": "834cc7982d3fd0f19c7d2a9f6278b654", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781796888, "uuid": "dacab755-ff97-4e90-b104-da3215b4dbe0", "comment": "Malware payload (Mirai)", "value": "65e2aaa97ba2aa3ee8b23c2b29bf429e1aa4ad2f632d2843313b86801fd8a2d9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781796888, "uuid": "98e9f625-2855-45b0-b975-3ac2ea78db11", "comment": "Malware payload (Mirai)", "value": "dde31737dc429f0ec058e2f98def57698a0c8315", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781796888, "uuid": "f78e47c4-3946-409d-9b21-bb91b4b9f6a1", "comment": "Malware payload (Mirai)", "value": "4531ae8e7b42dee68fc4e7049de884067ef9604c03b29e2cb7200be62b4c03c3ecd27a3f5292b95607101d36edb19dc3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781796888, "uuid": "5b9c853e-6230-42bc-a37c-bfac22857b87", "value": "T1DC8312F006468E5BC746B8784EDE1349BF612B19BA06F1CA6C91FE035CB9B70BE14174", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781796888, "uuid": "1a9f1564-15dd-4ef7-9150-cb64af3576f8", "value": "1536:tqoyZYk1W1P/BBFcqmsNvGpKxrSY3aIQBHJqP6NDIed61ODMVJuY:tgqk1dsYKQYCBHJfjAVQY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781796888, "uuid": "c7b9a1af-3754-4dd3-8c49-796f96401d6b", "value": 88236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781796888, "uuid": "7d66f176-3950-4083-8d28-85844cc8adf6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781796888, "uuid": "dc8bb295-0cf5-48a4-83a4-fa2f3f6c8e29", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6e9ee15-6ae6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781767456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767456, "uuid": "4b6f4004-cd77-45a1-8ec3-09ff55185505", "comment": "Malware payload (Mirai)", "value": "d8324f553a62e387101c4ca2f00d9f96", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767456, "uuid": "4912ce34-0b5d-4027-942c-a268f5ebdab1", "comment": "Malware payload (Mirai)", "value": "669d311967eb7abe0f2b1a8155f5f90d8042b657c97943d9b448da8a62595bc7", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767456, "uuid": "878e2175-1821-4a43-881b-20df5f9d6ea2", "comment": "Malware payload (Mirai)", "value": "28c0344ebd66a837787a7fe034a74626797dd78c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767456, "uuid": "fada107b-2270-4c4e-8dc2-8bcf3c92a870", "comment": "Malware payload (Mirai)", "value": "86bd5bf747edd8c501dd4b03c39e11ac101b3a0ab28a92e17bafa9dd49117ee418e0e041759870c4e6d03e7357211a95", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767456, "uuid": "dd749284-36ac-4f74-9b50-9aed07d643d0", "value": "T14C41DBDD30EF24B65D02BE42B15188D4F549F2EBB8969F44FC448EB1C597AB6302CB84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767456, "uuid": "bcf34870-5146-4563-81bc-774ba124456f", "value": "12:973PpZSG7MvNIsV0LKucaSrbiL97iXWZ9M9VyRpKbwinuQpZSFNIstLKuavD9jX/:Jp8pNI3K3pP2RpKs6p8FNImKuAyRpKGU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781767456, "uuid": "40504f43-d300-47cf-806a-e7fcebc3f872", "value": 1905, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781767456, "uuid": "c817be6f-6f49-4d43-be04-c63ef6f28903", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767456, "uuid": "4e47a6c1-bd06-4208-b6d9-a9342e84075f", "value": "womp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29e9fe2b-6b34-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781800721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781800721, "uuid": "68da5626-ec0a-4e75-a5e9-d2aa46fccfbc", "comment": "Malware payload (Mirai)", "value": "e3c08f24134ad6d5d6680bbe0106928a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781800721, "uuid": "f3c1ffe0-069c-4087-82b8-6e5776906570", "comment": "Malware payload (Mirai)", "value": "67124368933b6bc2cb826465d84fc3e67d80c64f431871b9ef5cf4eb51121019", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781800721, "uuid": "05ea5b10-bc12-463a-baea-4259cda8c83f", "comment": "Malware payload (Mirai)", "value": "728a751521e4c6ed8ac80824c046b55ac075765e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781800721, "uuid": "4b58f570-570c-4474-a683-b44d697b34e1", "comment": "Malware payload (Mirai)", "value": "88e2cb3a75891c9cdbba215938f57cb81909af9e1f340152869b07ec5e7613a48f1a9c7904791a5a978e78b97c70a523", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781800721, "uuid": "e26853f8-170b-4062-943d-5b8ad58afea3", "value": "T12173F842BA87CAF3D41704F041F7B63F8E31FD3A493285A9EB65BDA2DA235C16116358", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781800721, "uuid": "2afa3984-2af5-48bf-936c-a11776fbecdc", "value": "1536:cfGl11IuDxOIX9GtkxBP4nIjn3DC3wPrCWD8ZM6iwHvbi3aGiE3uM+dA:YGl16uDx1XPBP4nIj3rPXQZM6i2ji3XD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781800721, "uuid": "d72f9efc-75d5-4732-a1a1-dcb2688e5e46", "value": 80392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781800721, "uuid": "2b66cf1d-29db-4da1-b164-8252e2945669", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781800721, "uuid": "6a985814-c2d8-4153-b14e-a08be5f5d2eb", "value": "manji.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f047797-6af3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781772866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781772866, "uuid": "947d83fb-c5c5-437e-9d6c-37b1bb4fdd35", "comment": "Malware payload (Mirai)", "value": "0878785ee1225884579772955215bfa1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781772866, "uuid": "62b720c3-f3b8-44ab-ae64-2e2c5cf0c8e0", "comment": "Malware payload (Mirai)", "value": "678ddc6daa1084481e88866d07076a1424e5e0ac106c87ecf51971484185823a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781772866, "uuid": "112b3df3-9759-4854-a363-3e5676327eef", "comment": "Malware payload (Mirai)", "value": "a8dfd37de9c5999d48c794422aa9fc562d8f7d96", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781772866, "uuid": "393dce02-eb8b-4a22-beb1-caed308d543f", "comment": "Malware payload (Mirai)", "value": "e60c28cb38c2d97f9044bffbcd64c9fa6274e1d5d0d487707c3b77e242340250b99a277cacf38053377e80de92eee52c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781772866, "uuid": "7a4c2c9e-7eef-4c97-a7be-38336a37e2f1", "value": "T1CC23F1A6258695D3C5F34739CB28C7CE23817F39F8A230E603301E9AD5D942AD5F5B92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781772866, "uuid": "0afa731b-6ce9-49aa-ad72-53aae5e3fedc", "value": "768:zmItdcfco9JoUVQbbVLP+xY2MgJ0vu3VtdlC+HXhzt4LrA2gLfas3UozF:iIzcfFoU0SygJ0m31lC+wLEjXzF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781772866, "uuid": "38321f59-f124-45bc-bf6c-d58e29c5bc18", "value": 46132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781772866, "uuid": "189cbfa5-0264-4fb1-98c3-4b533a330587", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781772866, "uuid": "aa32e5cb-de39-4ccc-bb1c-d7974478855b", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "729c1a8d-6b20-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781792253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781792253, "uuid": "c96047e2-19ac-4a00-8e7d-8eb1735449ba", "comment": "Malware payload", "value": "8ddbb0c287e3a3cc82f6a7210b63721e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781792253, "uuid": "54ece0cb-9964-4ac9-b640-5c068e593d03", "comment": "Malware payload", "value": "69fc532c3a846f346f4e800b743c1a341bd73f2bab0cfd94d88a0a34a39446b3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781792253, "uuid": "1365d9ab-1252-4c41-9aab-a3f3093e9a91", "comment": "Malware payload", "value": "594dd24d35316398f6e02d391868ace9e9e16d39", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781792253, "uuid": "e8988143-37b7-4dce-8e07-ad6022b56756", "comment": "Malware payload", "value": "63da17f88c41e2239d23a25848542355cbc4fa892bab93b1c5ed51e094cadb4559b6ca07aaa8b2242f1a5e6ee2e3b7a6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781792253, "uuid": "c78aa856-56b2-4ddb-b8b8-e42560ee8614", "value": "T14016FB3CD994412DE1B3E618C99A041FF9533E4B613CD90B60DA1B4F1EA3986BBD236D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781792253, "uuid": "91c6e680-819f-47df-83eb-e8ef4ebfdefb", "value": "3072:RyAskpEPxIsF/vy3+pzm2lk2usgrhX+8xgDrknv8xzlIlvnwTZdGomqccepPEMQX:EXhF/vVC2l3g5+7gkH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781792253, "uuid": "f4cc972b-ae8a-453d-8ea3-759abf44ad70", "value": 4268234, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781792253, "uuid": "2af72e14-bf03-4b77-a99c-63be05baf9c9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781792253, "uuid": "da5fcbef-2c7c-4824-8d71-fe589c3cf954", "value": "RFQ 63200-CO ENERPAC.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "299a76d2-6afb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781776239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776239, "uuid": "710d920a-88af-4740-a8e8-814cac2e3dd5", "comment": "Malware payload (Mirai)", "value": "4b03a90909b07ae90b1dee299cda0e42", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776239, "uuid": "b15b3f5c-0e7a-43f8-b7b9-08558786ef32", "comment": "Malware payload (Mirai)", "value": "6b56bdd93570cc8a4aecc1af28a41bcdce070ccdb7b60978c1026c99518d4c8c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776239, "uuid": "c4cef43d-fc5f-4df0-a962-3e0c37c59f52", "comment": "Malware payload (Mirai)", "value": "24337416a71a119dd15043a3c30b30fbc15fc8e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776239, "uuid": "e9c56479-a8b1-40a6-ae34-0b1251e6a32c", "comment": "Malware payload (Mirai)", "value": "72f22e970ea23fe1178faa97df4e759ea0fbccc6c34719b300b873bafdc0136ba1e22fa24b8637ae8596f26d73cccd3e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781776239, "uuid": "ccfd0307-2224-43c0-b8a4-6412cf63d1d4", "value": "T12CB32A49F8D0DB66D6E5267AFB9D029C33130778D3D93202DE14AF3532EB55E0A3A906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781776239, "uuid": "e3ce347d-4771-4cb8-be4a-92d8155f7519", "value": "1536:CBw0HiTxLwTsZj8NTzbFtdzbNVHHJEJ54hSnO+28FKnkbORw3IkU6Mpn9k/0L2++:CniTB7cFtfAeSnX3+Rw3IkU1B9diek", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781776239, "uuid": "a9ce4ca9-e017-4d90-81a5-e4e521f46d01", "value": 116032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781776239, "uuid": "b7cc2bcb-791f-4a2a-bf3a-6ee3e5bd6b39", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781776239, "uuid": "38c0ca03-b86b-47e2-b1ad-2d40b12e8a2a", "value": "monero.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94bdbd87-6b27-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781795316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781795316, "uuid": "0f14bb96-e850-4ab8-9ae8-1c31fcae6f1c", "comment": "Malware payload (Mirai)", "value": "41fa4a721cadbe2a03f09c06896c3933", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781795316, "uuid": "04a2ed43-55d9-468c-8b4e-12501adf3d48", "comment": "Malware payload (Mirai)", "value": "6b73b07a7cd121c2c7699a3041286cfed782aedb5b8b3a027110044af79e6c95", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781795316, "uuid": "8aee5e44-ae0c-47da-8628-3a1147e56292", "comment": "Malware payload (Mirai)", "value": "ac87535c4c506ebfffe9681a6746ba160aa84b57", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781795316, "uuid": "6fdc81d5-6ad1-429d-a0db-3ec92b1e6f3d", "comment": "Malware payload (Mirai)", "value": "c96bc7ca5df4ccf7213ab1d9267098f6f6495a7c86db3c271380ecbd587c700a4ca98df1ad81659d6082ec4c15cce5c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781795316, "uuid": "2698c8c1-08d7-41d4-aa37-dc358328d83d", "value": "T110149E63D8796E98D66498B0B0F1DF7C2B13B51082571EBB6AE6C9744087E8CF50C7B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781795316, "uuid": "1ae47418-e940-4aaf-9048-129430a02270", "value": "3072:3Bu6LjhY+AC/mQCZGjkeO7K3/3iMadpWKD+6tKasHl7:04P/mjCkewKv00KDhKas1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781795316, "uuid": "198d1737-e7af-48e3-b922-aba9dc070e93", "value": 193284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781795316, "uuid": "552597ba-cb35-461c-90e0-ad6b2e45e31f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781795316, "uuid": "4cee0ce1-ccb3-4d95-b2cc-01969a15ec91", "value": "psh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52ae0030-6abe-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781750108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781750108, "uuid": "e43c6f6c-44f3-43d3-becb-de49d3e43189", "comment": "Malware payload (Mirai)", "value": "b7efcba536de76a7371ffa48b0ae2ce5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781750108, "uuid": "f4cf3b2a-cfb5-4d7c-85a0-ccfd368a65b5", "comment": "Malware payload (Mirai)", "value": "6c8b07323c87fb95dc454a8246904d88de6f87612334b4f28457a688234c7463", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781750108, "uuid": "ca1bb9f0-589c-44de-9422-39331096b4ec", "comment": "Malware payload (Mirai)", "value": "4ac1be1fe4de12fcce7d1a7041df31655f4b64ea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781750108, "uuid": "002ffd64-2768-4c90-9361-bba488beb4c5", "comment": "Malware payload (Mirai)", "value": "7912d97da4c27236a791156d54a3f5931168b9ef6658f41daaecd659267fe33d2ce961db9488a398b5756bfb5eea5f99", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781750108, "uuid": "d642303b-0c70-4fd3-8fee-c59b911d26c3", "value": "T13AE47D9DFE4E3C42E2D7E2789A4987E1631B71E0D32391A37982034CD5C6DD9CBB1A25", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781750108, "uuid": "f387c89e-8eb7-4f5a-b263-7adb1de4658c", "value": "12288:9MgAM3dmecP0MLcwmKomrGAmpD2uoYTk6FkX3VcNmWw5DOKMgSq:igdkecPN5omrGA0D2uUVw53g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781750108, "uuid": "55141d4d-b4b1-4b46-9ddc-c7ea1f1bd8ae", "value": 680624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781750108, "uuid": "259fdaa6-9862-4a8f-b9bb-01fe5b81f6db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781750108, "uuid": "43cb2d1e-08d7-432c-a610-09ba25fe84fa", "value": "data_aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62571230-6ae9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781768603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768603, "uuid": "f2390949-db5d-4834-88ee-c9a8883e638d", "comment": "Malware payload (Mirai)", "value": "df59828409e86f7b2156bbfaab40ccb3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768603, "uuid": "60bd4562-8adb-4d64-91e6-1f2e98e6813f", "comment": "Malware payload (Mirai)", "value": "6ce88307b3be7be5edc3884ced5ce5d999eb35f793337c444f0ad389f52a7d17", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768603, "uuid": "5d0ab566-782a-403a-aac6-ff7ee12d1d40", "comment": "Malware payload (Mirai)", "value": "9e501de57894677a8384d3de6efed433d794f3f2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768603, "uuid": "e1b5d469-c459-4310-95bc-942be44a748f", "comment": "Malware payload (Mirai)", "value": "302399b1808f175a3aee5a2b7a243830f721d08f1a007998c35dcddc9078fd9c57243434baec6102fcc899d65c9226cf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781768603, "uuid": "dda5f0e5-c90b-4ae8-8395-e0823fcaaaf6", "value": "T10A340A46FA418F13C0C62779BA9F82453333A75497E77306B928AFB83B8679D4E27501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781768603, "uuid": "a59d8bda-65be-482b-9d32-b0939283e7e7", "value": "6144:kjbOpRnOGSpEu5aemE1qL3fgkwlnjOrEJbIM/R7fdZ985:k+MpEu5aTE1qL34/BZJbd/Bs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781768603, "uuid": "22706740-83cb-451d-a960-a4057d847a6d", "value": 235227, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781768603, "uuid": "4c1898b4-abde-42e8-920b-7d1102944c47", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781768603, "uuid": "c6f2169c-110b-4d6a-b2f2-d850456348fd", "value": "onie_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2f86847-6af6-11f1-a769-42010a9c0008", "comment": "Malware payload (DDoSAgent)", "timestamp": 1781774429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781774429, "uuid": "f7f50c50-9f1d-42af-92a9-cb749d9c4d5d", "comment": "Malware payload (DDoSAgent)", "value": "fd1609721051626703f699a522a409f0", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781774429, "uuid": "cdd72fd7-33d8-4a55-918e-4d23dadbc84d", "comment": "Malware payload (DDoSAgent)", "value": "6ed03d637f68b9388e85f526930bad0d4a8142a4bf932f827a4339d8d97eb589", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781774429, "uuid": "071f60a5-62a7-4758-9f2a-35d18c560d7a", "comment": "Malware payload (DDoSAgent)", "value": "4543568236ce8305465ca818b67fcceea6b1941f", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781774429, "uuid": "7ff10480-51e7-49b0-a279-d01fa41afc87", "comment": "Malware payload (DDoSAgent)", "value": "0246bfcc477ff0220fdde1d683920b8c6e14d92ca402f514fd8a05f6145a6eb57ecbb359911004fdfcd82abd93240c5e", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781774429, "uuid": "a0a108c0-8ff1-4b1a-89ff-281e227d6a54", "value": "T1C4864A137A29EB0FC62821300DB2CAD42B6A1C9642D79117B745F309F9F21BD59AECF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781774429, "uuid": "05d53853-b1f2-4b9b-b4f1-a208bf82f98a", "value": "49152:9Mj7vwMKDQ16MHDx5Mx1htHo5TQ427VsbgnGP4EP6zgHYzr7FW6XYrGia5pp0Zkq:LtWAnRiQ0kcP+rSi6N7nUjEB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781774429, "uuid": "6982ab71-e36c-4461-bb26-e98f2432da0f", "value": 8126679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781774429, "uuid": "1135d580-a732-49c7-a86f-16a7f1d83637", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781774429, "uuid": "1b50ea90-911a-40b2-a710-109572045fa3", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cae48f5-6b35-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781801343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781801343, "uuid": "2f06561f-de46-4a38-b278-404d86641014", "comment": "Malware payload", "value": "6891e63fefc27dcad859174fa6328df0", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781801343, "uuid": "8db51cb8-3cd6-491d-8985-3fbc6df825fd", "comment": "Malware payload", "value": "6f732fbbcbce8f4af84d65d6f016113819e3de4616e1b644b3d4c2086fdabe09", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781801343, "uuid": "964b9c2c-5945-423c-b8c0-5fe8f70800e5", "comment": "Malware payload", "value": "1d5193ce65e0753acaed36e2bc66adeda5314709", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781801343, "uuid": "e224d839-9163-4a8e-8df5-f64e165564a6", "comment": "Malware payload", "value": "d95cff3067b18a5988531ab8f34274049ddcea2fc3fdbe831ab864e39c221c277e166283b2a7bd86929c8809a7cb288f", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781801343, "uuid": "bf3b883e-8d30-4aa2-8dbb-80da8e7821d8", "value": "T12DF207683D16B02465F2EB766AD7C401FE2B2577131A2494B2DCD2C01FB89E8CB6DDD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781801343, "uuid": "46d4e590-ede9-43b7-a022-6a030882287a", "value": "768:MK+qg8SST4G5FNupJa+cdjaK6FoJ1SQfjF:MK+qtSST4yFNuHaLdjaxcbjF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781801343, "uuid": "89bf5723-7ac9-41c8-9c5b-e4c55b0398d9", "value": 36736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781801343, "uuid": "e066cce5-f49b-42bb-b750-e8edbb05077d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781801343, "uuid": "3b815161-25e2-47dd-b3d0-2007afb1b0f9", "value": "agent_1781054578.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edc3699d-6aff-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1781778286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781778286, "uuid": "7ea18d5b-efe9-4f56-bc62-757c87c79ba3", "comment": "Malware payload (RemusStealer)", "value": "b0ed4cd5396628ade9644b908b91dd91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781778286, "uuid": "625806c4-3123-42c5-9cb7-d10111e4a189", "comment": "Malware payload (RemusStealer)", "value": "6fb3f831f161451c0f01c37feaedcbd1d9f9354262d9e4c36a22a96937e0d9af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781778286, "uuid": "41703f76-7f12-415d-8ca9-47b9182302c7", "comment": "Malware payload (RemusStealer)", "value": "28df64d3ba8018d99bb3adfc71a99700863d1766", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781778286, "uuid": "4647e8d0-97a9-4b32-9240-940e51226d20", "comment": "Malware payload (RemusStealer)", "value": "37bdb40bf73e24a6052a6801229378b3db8468b122b363f2a70394797c79e0c2600a19fe76b02a40fcd2c2f3975ac862", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781778286, "uuid": "01244445-078c-4136-b323-bf1308d94805", "value": "T12AC54B17ECE149E9C49AA33189B79286BB35BC051F3223D32E90B7782E727D05D36758", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781778286, "uuid": "de83704b-87a9-4122-97f3-6cb5269a667a", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781778286, "uuid": "b594d3db-cc91-41fe-98ef-d87c72feef42", "value": "24576:p9aQUSccGOAZpiMW5djQQNdTiS+jmPj6s2qsYF/bR5A4ikvAoBele5I92KbNcjbS:p9azNceZpih5lJfmgvnoH/2tq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781778286, "uuid": "35aa2e89-4273-4538-add4-a1e45945ef14", "value": 2572144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781778286, "uuid": "dec29c80-99f9-4952-ae08-f7416d7ccdc0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781778286, "uuid": "2c97971e-9f91-4662-865a-b9b1ef6736f1", "value": "Mod Menu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "353d4702-6afb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781776258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776258, "uuid": "b5aa5f74-62a7-417e-a4a0-7f476e748543", "comment": "Malware payload (Mirai)", "value": "177eda9eef1fdfbdd509ac46679b1d21", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776258, "uuid": "f8f669e4-b099-4c15-a015-3aaf8de2cb14", "comment": "Malware payload (Mirai)", "value": "70179624c8c1870bbc6875478f9f949478777e6be4cccb4d5ca7a9194e6a7ed0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776258, "uuid": "4916ce19-6186-49b7-9991-778301efc475", "comment": "Malware payload (Mirai)", "value": "7d4e5bf3dd2536482a3bc6ae017deb4f6a1d60b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776258, "uuid": "2908cd69-0496-4a8f-a1c4-9a689e4a67c6", "comment": "Malware payload (Mirai)", "value": "cb37af86aefe8cc3dcfa2d096f62e4de5071095e57928dcd410813eab2a63e4822bc4dc2577a9c744d8d7e39cc762626", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781776258, "uuid": "96c73fb2-dd81-4515-ab22-dbffd6677cdd", "value": "T11CB36A2EFB82E1B0F0B29131505AD7779F36D9314252881BFB463E30E8B52C5D699B2D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781776258, "uuid": "88e118a3-b339-4148-88bd-af4699c24a88", "value": "1536:1rAjQY5QYcEpcQ466xdh2WBEEcRdVzdrhY257tbnzPGbCra4N8qZP1SMRaLMEiRp:1rAzDcEpcQydh2WK9HnzGa8qjS8aLMe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781776258, "uuid": "1592476e-a4aa-46ef-be96-6e78eef07860", "value": 116028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781776258, "uuid": "56c33454-5783-46b9-bdd3-726c571a5635", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781776258, "uuid": "30ea8e79-f1d1-4e76-9fae-b17d638ad8f7", "value": "monero.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bbb68c4-6afb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781776215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776215, "uuid": "7f07553d-fadb-4e0f-a70a-8e0da83af94a", "comment": "Malware payload (Mirai)", "value": "c50dc7a62efb15415935f02b0a56b2d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776215, "uuid": "8037a5f1-cc3e-477a-83ea-331995be2240", "comment": "Malware payload (Mirai)", "value": "708794a457d9bfd170b4e32a5dcf3373d4acbee2cbc5ec967709923c45a3d33a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776215, "uuid": "804f3873-98c1-467c-a3d1-697f33575d74", "comment": "Malware payload (Mirai)", "value": "36424660ffce137b111017636e2a2384dc3f7fe3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776215, "uuid": "7e150e7d-36c5-4058-bee2-1409ecacec5a", "comment": "Malware payload (Mirai)", "value": "f57bd097f76fafd9e02dfc03cf00433826ec174c5ad8cf45a5aa2a3151bb545ed4113438baea546b9dd63238cad4f7e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781776215, "uuid": "b5e2bd09-3a50-4d08-a601-22abcef8d6ea", "value": "T11FD37C01FB580553D0D65EB44B3B077AD32C89935CB4F20C290ABB2A27739FB95D6B86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781776215, "uuid": "a4a3987d-594a-4cbe-a229-83ba356ab6d0", "value": "3072:gvaE4sOc9hz/eyn4DpdUyyyO9/MGnv16u2ciDo+k:5K9hz/74D/UdpKGnv16u2ci0V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781776215, "uuid": "beb7801c-6083-4bd7-942d-39bc50d2bbe1", "value": 132412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781776215, "uuid": "fa373e45-1d89-4f44-9afb-2b3fbc3624e6", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781776215, "uuid": "458d8625-30cb-477f-b3df-ed787c345fc3", "value": "monero.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e0ee62a-6b3c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781804217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781804217, "uuid": "b551e9f0-c90d-4e84-8a87-5ab22a85d8b9", "comment": "Malware payload (Mirai)", "value": "8ebc1bb94b660e8b6f7193480db7d319", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781804217, "uuid": "388e6560-123c-48d7-ba5d-5e365c321273", "comment": "Malware payload (Mirai)", "value": "71d7b6ff45a4cc89d4b1491f9e7db7411a7658b41053df5e74da17b5075947f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781804217, "uuid": "be21eb23-c347-47d7-9949-1188bd94268b", "comment": "Malware payload (Mirai)", "value": "68de0ff3030bbd968ac085945b9a10363a29776d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781804217, "uuid": "ba4bf561-33a2-4d5a-9126-d4b7e9f33bf1", "comment": "Malware payload (Mirai)", "value": "bdf973657b1e882a6269cdea0f672b34aac9ab3cca194e2894d202dd89a2b05d3c1d5deefd5c8f9836ade1d46ed99be4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781804217, "uuid": "08bfce6e-aca2-4691-8373-230c3a24145d", "value": "T19263028381AC8A5CD52940F025EB7E4744C38EAC495EC232FAAC175B2AF5FB1A50B957", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781804217, "uuid": "3744f085-00de-492d-9553-84a8c37b2a59", "value": "1536:jJsuvmvT/AjmpQxC4PZRyo33SHNI3WRnFlJfSNOBwQkukJAnouy8ry8:1bs/Ajmp+em3WTrSOCQwooutz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781804217, "uuid": "0ffdc163-b668-408f-8ca5-ebf1851478c1", "value": 68572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781804217, "uuid": "30025f68-97a9-4392-80e0-f6941e72c3d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781804217, "uuid": "b052d402-ec1f-4da8-9257-e870393b586c", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "240f412d-6b55-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781814884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781814884, "uuid": "4ff7425d-c738-4cff-b376-085dda4a6521", "comment": "Malware payload", "value": "3da225a00271a91c1d054b9f5ee45b0d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781814884, "uuid": "901d45da-3d18-42d2-832b-571edbfbbf82", "comment": "Malware payload", "value": "71f0dfc67018dd72f64ea4590eca2c43de4dd4acf7b29d2bad470ac6022a27a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781814884, "uuid": "8851855c-6550-4e5d-a82b-34ad96cc5608", "comment": "Malware payload", "value": "7aad317db124694beaac3a1ad1351b854de62738", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781814884, "uuid": "a9240574-dddc-4326-bcfb-5c0843166a3e", "comment": "Malware payload", "value": "5c55a6914667f3602706a2b854f41c4835992003bb110ea3e08639d5b68c1f2262025ac0f89c49b9877cc30918cb2040", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781814884, "uuid": "bf7a3be6-040d-4eb4-9c77-eb53dfff2a65", "value": "T184C3F745A9418B11D4DB31FAFB9F429933536FB8D3F97201D9209F6123CA99B0FB2612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781814884, "uuid": "ccd31b85-455b-4caf-b333-5ac4487bf69a", "value": "3072:xC6ka+xjz+vydU2hYTHpaBKJBGfriAQfyAV2KnmfH:xYa0dUqYHpaBKJBGfrJnAgKnmfH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781814884, "uuid": "4d372aed-1e7e-42e6-85f5-147abeb22932", "value": 125664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781814884, "uuid": "4c33a9a8-cfee-4f9b-93b7-fd969a9fdaf1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781814884, "uuid": "1b1d9f20-a699-479f-a0f6-421273a1cc86", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16363c90-6b2c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781797252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781797252, "uuid": "c6290fbc-f1ba-4df3-a2a0-52c27707224b", "comment": "Malware payload (Mirai)", "value": "db69618daa3cabdeb57beee28f8e8c66", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781797252, "uuid": "317faf3f-b16b-4f89-98b8-9b4ddb85c205", "comment": "Malware payload (Mirai)", "value": "720c93aa7895a26e1c71609b4a17e3930ff1a4a435a035124bfb603b19d95d5b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781797252, "uuid": "74a351a8-bab6-4ccd-9fce-a0e600a3902e", "comment": "Malware payload (Mirai)", "value": "f51bde0f2b16b7568a0b0a10e6a02eee588afebf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781797252, "uuid": "777409e9-ffc4-4395-8462-89e3162071ea", "comment": "Malware payload (Mirai)", "value": "e6190b148731ad2a5646980a8e24b7b0dd6c0f205e1dc2e6dd096769c8d1043601178cac77efd676e0d3b0eb9b215cd9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781797252, "uuid": "27ea04ac-d9c2-4cba-ae9e-4ff2ba598aec", "value": "T13923F2936623A8D0F49C48F4D138CC1B3ADB155DFAEEFE071D4D1964A9C1026E3F2A96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781797252, "uuid": "4476235c-6cb7-4d18-a0f5-35bd9cb02be6", "value": "768:oIBj/YlQlbgYmRhOCyDk9NgplvVcJxzkihNfQv3ceANnv3ENX2I/sBs3Uozu:oG/Y2TmR7Yk9ET4zThyfceA1/IX2wzu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781797252, "uuid": "5428b104-9ab0-4f26-90aa-35e39de58446", "value": 46464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781797252, "uuid": "f4887ef8-c7fb-4d2f-9e81-8400e108f43f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781797252, "uuid": "31b52f9a-6394-4422-8263-da5978fd0224", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ea710d3-6b06-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781780999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781780999, "uuid": "41984076-d2d7-4ae3-82e1-3ea5d9edaf2f", "comment": "Malware payload", "value": "56c44d02f91a47b0620d615b5062e211", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781780999, "uuid": "c4a5de97-78ba-4ddb-9e7c-7e9b73717d24", "comment": "Malware payload", "value": "728064505b2229fcf28688292722a204e3098618692718eb64fb1707d70ed279", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781780999, "uuid": "cc44bd9a-54e2-447b-b932-23c4d409a59c", "comment": "Malware payload", "value": "08a7b0e604328a0c981e12528abbd0f3a496944e", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781780999, "uuid": "8d9e7775-09d6-4594-880e-36237ecc7536", "comment": "Malware payload", "value": "08db64898f6037cd1c55cf16eaed44eb63571a415021dd9f2adc78c5e0a5809fd3cee91b77c04ac9e3fff2b8606d5f82", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781780999, "uuid": "da7d1fbd-e0e5-4379-af23-a2eb83ea9b44", "value": "T1D4A4F150F295CB2AEB995E7A4BD3D6D60312BD735E0A410F7282770E5EF33862807D29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781780999, "uuid": "182049c0-497d-4ed3-bfe3-abd90bd7ad8f", "value": "6144:CZ+RwPONXoRjZ7SezmfDlavx+W/WGyhuYd20md8iDa88AE+gTzTpZBjdtEENRQ+Z:t5E03lf0nszxdVFQUk7PTE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781780999, "uuid": "50218460-91d5-48f1-8b42-511ea4a5e970", "value": 473600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781780999, "uuid": "545aa0a9-b2df-4e60-be7c-bd217520b329", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781780999, "uuid": "0bf0cabc-f4ba-4641-a532-7ee81aabc45b", "value": "PURCHASE ORDER.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "835d9066-6b02-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781779396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781779396, "uuid": "2c5bd2ba-14b0-48c3-9a83-8de9e9fa5082", "comment": "Malware payload", "value": "1183dadd1e6845897dfa41680b194820", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781779396, "uuid": "72c83374-3688-42aa-a104-dae5938561a5", "comment": "Malware payload", "value": "72cb750a86b5756d3b6be614b6942e1bf9732c7d7a27b35ab8e8f769e6eb53c1", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781779396, "uuid": "ef1bd4e8-dab9-408c-973c-fb258784a94d", "comment": "Malware payload", "value": "70e5767b066734e34a5b2142e7b31cac8d753132", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781779396, "uuid": "629f2b64-ee0d-4987-a5ac-eb92d2445443", "comment": "Malware payload", "value": "c77776882ba2ce50964be919c1372dcdb7dd51dcadc5e6e70379cb0b43c55da0d0ac9545793b77209284961bd2b289e5", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781779396, "uuid": "c92e0443-3eba-44a9-832c-7460aeaa8d90", "value": "T1EF31F03D1BE6632CD2B6C67958759321F9A2F907FA028E8F01C045888C24224B9D4F2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781779396, "uuid": "f88f9cac-86dc-4c82-b151-befffd928b70", "value": "24:8+cCC298qCDJ8C5bK2a00WO7ABW5+/CW/xdHASBqNI+EwLqs7wLq+jxExOgmO:8+x/8qCDNbbTzdHhBghqs4q+t45", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781779396, "uuid": "e7847990-c72f-4d48-bd86-a79f110bd11f", "value": 1506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781779396, "uuid": "65ab7895-66d2-4217-9dec-f2cb9014457d", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781779396, "uuid": "3a2da521-c016-4e35-a0bc-a6e8e1a0737a", "value": "\u4ed8\u6b3e\u78ba\u8a8d\u55ae.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b55fe52d-6ae8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781768313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768313, "uuid": "8946bfec-b9d2-4770-bbc4-dfb6c0f2aa47", "comment": "Malware payload (Mirai)", "value": "f7288bf026d03d134e155feea0aad2b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768313, "uuid": "47b411d4-8bd4-44b1-9f50-88d03d94bf26", "comment": "Malware payload (Mirai)", "value": "72dce7b1ce1d93bd3fb564cb922c2a08a0898fc49c9c636ae1e051f9d53ef35e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768313, "uuid": "0a8be9dd-ef96-4e0f-a91c-873e7d1de09a", "comment": "Malware payload (Mirai)", "value": "dbfdc31d5db107f87517509d00658a124a59b096", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768313, "uuid": "a83db8be-41b2-4038-9be0-328a241ef7c5", "comment": "Malware payload (Mirai)", "value": "45a4078a6325342a8402c31de06d30d061bad8f12d82feea118460a244704b89a759377571b2acd6167f892f9af7e87e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781768313, "uuid": "720c7149-5afa-498b-877b-f12bfb66ed09", "value": "T1BDC3AECBF64B5950C82146F11BC79F8E3F5362148D6FE8E72C0EA63B15BA5CB0906792", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781768313, "uuid": "989d4f84-19e2-4d79-905c-4af2d1a99937", "value": "1536:BztsdqpKCSW7MWeFjAsnJMa9zqIVc/Z3bem3Jb8nmYCzwds3lB1lgk8Gxx/LWP:BcRxjlnJMMz0BremZBYCzwGf1lgUq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781768313, "uuid": "1d125237-0026-4144-95ff-498ede0fc1fa", "value": 124084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781768313, "uuid": "e15d0e18-c4a8-48ad-ac09-f8c8a393e301", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781768313, "uuid": "a7378312-33f5-4489-9741-3b656634cc08", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c15a75e6-6afd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781777352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781777352, "uuid": "2a908346-7d26-468c-8f96-c421c5823726", "comment": "Malware payload", "value": "9b048234f8386f8c6fd54d379b9dd62c", "object_relation": "md5", "Tag": [ { "name": "ADB", "colour": "#8CA410", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781777352, "uuid": "8cc2704c-6e8c-4cc1-8d48-dd06fe154cb3", "comment": "Malware payload", "value": "74a454573ffdfce5b21ebb1e26d924515e8fc793c7acbdbc3120b67c009836ba", "object_relation": "sha256", "Tag": [ { "name": "ADB", "colour": "#8CA410", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781777352, "uuid": "2befe9db-2b8f-43e9-b6aa-e9b85bf2f00d", "comment": "Malware payload", "value": "c2cb6b628eb36cc5d9be82b64d2625e72d061d61", "object_relation": "sha1", "Tag": [ { "name": "ADB", "colour": "#8CA410", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781777352, "uuid": "189e6600-e100-4a41-b82c-98d1cba5d937", "comment": "Malware payload", "value": "b65ba246f4de21cd6d2d760fbfdbc9933f5b0e71d4eed59537e047f58809683ecbe015b86196faa8193be5eb185e933e", "object_relation": "sha3-384", "Tag": [ { "name": "ADB", "colour": "#8CA410", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781777352, "uuid": "8dbd3006-2ad4-4861-90d2-496d7259cfab", "value": "T1432159DD041351822E1DCF18705A821969C9CDEFB1E49517E74D8AF161CDE09FF21BAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781777352, "uuid": "a2393df1-b41a-48a0-aaca-be6753fcf6fc", "value": "12:3J3TX273QTX2H1vKQTX2rNI7qaAQTX24QKqMHQTX2JWEQTX23vlGJQTX2djHQTX0:3J3z740NIbKKoPevkQ6WXCsjh2WKHR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781777352, "uuid": "f96f9f50-a48d-43f4-9646-f126576bcc8f", "value": 1162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781777352, "uuid": "f9f637bf-1c6b-42f1-9056-a38fe50efa3c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781777352, "uuid": "7faf3162-6735-4bd9-b011-910d7c46d404", "value": "1781776626_adb_c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baed6086-6ae8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781768322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768322, "uuid": "55a8a6ac-43c6-4c96-a179-761abd30d5c1", "comment": "Malware payload (Mirai)", "value": "55c8a9aad67c93c3520e8d3cbc873004", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768322, "uuid": "112e7701-2f18-4aeb-84da-43539c67ab85", "comment": "Malware payload (Mirai)", "value": "7509dfad16215f74ccd2d87f915df829e38a413232568b35d04d7ecc01975664", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768322, "uuid": "f72db447-1cac-4264-8869-e9f8959bceda", "comment": "Malware payload (Mirai)", "value": "ab8740633853bf5c1843f91fe4cf88b3d43d9fe9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768322, "uuid": "c6c0d384-cb79-422a-abc7-dbe9782d14e0", "comment": "Malware payload (Mirai)", "value": "5fd633950e6b662baa2045c4ee987c81e45485292d44bc708d3452485a69f6e390a343cc52fef603aaba20882564214f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781768322, "uuid": "5ff2a532-f413-49e1-9b3e-200f3ff34592", "value": "T186E47C6377218F98E360D27005F38B655AA4215307F291C6E3BCD620BB50A6D6C6FFE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781768322, "uuid": "7c33c227-27b2-4067-a9fe-fa9d5badd78c", "value": "12288:FFFzIEN49pjNfCTYYJRwQ0f0HNgmpf/GqWGo5aKbz8phgHKAzZ:TF749pjNfzYXwQ0f4N/GZGpKbq2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781768322, "uuid": "c9bd428a-7429-41f9-a79e-d4a5fa5baf5d", "value": 717692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781768322, "uuid": "27b914e6-2965-4602-9acd-f0cbdbeb8d49", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781768322, "uuid": "e2c204b0-763d-4ba2-8464-cc13064c23f4", "value": "kaizen.mips_srv", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a45c68e9-6afa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781776015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776015, "uuid": "cf613237-fcaf-485d-8088-ffce7ca57aaf", "comment": "Malware payload (Mirai)", "value": "bee6318a5ba7a2309bec103974d1ddcc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776015, "uuid": "31eb43e8-2d55-4e6c-8ddc-dc5304ac0c88", "comment": "Malware payload (Mirai)", "value": "75840c34a947026be88aa933265e0f6a84564ac77278eb210b0814ad3eafbea6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776015, "uuid": "dc9c01a3-809a-4c13-a759-686f45c294af", "comment": "Malware payload (Mirai)", "value": "dbaccf53bea9211216fcb07da109390db03c53d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776015, "uuid": "09bd224b-d821-407d-9862-722e678c4759", "comment": "Malware payload (Mirai)", "value": "35757a309cdb9c9d8c647122a5c06c38a701ffaa58a0c58493c73063353d08d117079bc85da2a6b1b34cbb795caa104e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781776015, "uuid": "06fc1ac7-8519-4ab7-b833-0353cc151447", "value": "T183430255A8A1C05FEC061376AB7F6045B7EFEBC3762CAD40E1780CB145C746DBA028D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781776015, "uuid": "bd61dc25-c347-48bf-b187-79d45093bd75", "value": "1536:Tf2QxZgpofgWFdAReHOnj599xbnEVQQQAM:rTzK/j5nNnu8H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781776015, "uuid": "a6680bfa-3c4b-486f-a6b5-6a069b086311", "value": 58712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781776015, "uuid": "b741fcd2-8778-4bdf-8861-012c2f610e51", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781776015, "uuid": "826572e2-03c2-4e24-b5b3-c6f1cb860112", "value": "monero.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9fea9d7-6b5c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781818169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781818169, "uuid": "01700650-35c2-45d6-8eef-0ba13470e1d8", "comment": "Malware payload (Mirai)", "value": "01a08b1c633d7bb40438100e37ee5e57", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781818169, "uuid": "2bac8109-c6b1-45c5-ab28-6c9a9dc25682", "comment": "Malware payload (Mirai)", "value": "75c660ab8eba2d3567e48fd627a56adf84073cd0dc726f786204185c8ae97bc7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781818169, "uuid": "db4baa22-fff7-4bc7-85d5-9aa3c54a0ee4", "comment": "Malware payload (Mirai)", "value": "148e6205b45bdcc93cbc0f34f4c1e387615d4a56", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781818169, "uuid": "300f8df0-168b-4e7d-a6cb-af77717a4883", "comment": "Malware payload (Mirai)", "value": "52408194610e91936cb3617098358659fe01c280be54aa4008be86ff389187dbeb994efdc366caebace2cbbcc2b787fc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781818169, "uuid": "3e02d8bf-1044-4482-9fb6-598703c890dc", "value": "T12DE44A46F8809F62C6C436BAF74D42A873074B79D3EB72069A155B3537DB86B0F3A601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781818169, "uuid": "ad46673d-e87b-4328-ba32-9e88c49e0792", "value": "12288:F8ULCajDDoP9KruQSIgsM7ouhM5Z/7DAQF59nw22phsNL18g1X8pEk+HQ:+UmajnoP9KrulsHuh0ZjDDF59w2LM+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781818169, "uuid": "049ea433-858b-4079-802a-b35083b14215", "value": 702896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781818169, "uuid": "7739a151-617b-40f7-8353-843a29a93a51", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781818169, "uuid": "6777f568-dcc0-4975-ba7f-13d093db37b7", "value": "barm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25cec300-6af3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781772796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781772796, "uuid": "b8270fed-f83b-4ac5-aafc-6a1007213bed", "comment": "Malware payload (Mirai)", "value": "66b493cd586735d2105a071afb69adf4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781772796, "uuid": "dd674508-a025-4f5a-83f3-471f332b1aa8", "comment": "Malware payload (Mirai)", "value": "75cf7f807874891f8bf678c3e164aeeb27810686b9353a9e50473052957a69e0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781772796, "uuid": "daf0abe9-851d-49b3-8442-88212f9e9dc4", "comment": "Malware payload (Mirai)", "value": "b4d0b377245cabfd084171f2ca396dac62e7a703", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781772796, "uuid": "1c878948-a9cf-4dea-bfe7-61a1dc6dab0f", "comment": "Malware payload (Mirai)", "value": "dfe953d7fc7ed4fc88f31fa06909c1b712c53655c7d0a00ec0f65958e764760941cf64f1c8cdb3c86cbbbd5fc10a7ec8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781772796, "uuid": "c8e12c43-f5cc-4af8-b45d-fa7a12a5c428", "value": "T106F38C81FB43D5F5E90A05B02067E7379B72E539102BEF47C7A89E32AC92641D51B39C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781772796, "uuid": "a51a6d81-b903-4232-ae6b-40a4c24974cf", "value": "3072:fzAdPzcNAaVKvIDUGdN9JVIbnabJicgSEMfSNkbkUBG7J3X4eI8rvkcG2w3I:7WbcNAaVzoUN9banaVrgSXfSNkb4BdbZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781772796, "uuid": "fa16243e-7316-4ca9-86df-463e262711bd", "value": 161512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781772796, "uuid": "722194ef-306b-4b97-ba78-0c86f677eef3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781772796, "uuid": "ca4cd3d1-12c3-4055-96c9-f15631ff2dae", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d408cfd-6b1d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781790794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781790794, "uuid": "256f9740-8356-4da7-81f5-de4868e77cc8", "comment": "Malware payload (Mirai)", "value": "8ce4cd0c8cb7fe951a85c6e99f359749", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781790794, "uuid": "50838b98-4f1d-4624-8079-71a41a873e9b", "comment": "Malware payload (Mirai)", "value": "7616513745c8a36fdfc3763571dbfaacd8bce26308180596cba5ebab8bf94c1e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781790794, "uuid": "348f580e-bd88-4aa0-8a18-a568d7c670ca", "comment": "Malware payload (Mirai)", "value": "bfbd08d735ceef8b64eed0e30552a6b0060884d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781790794, "uuid": "6871f49f-2846-4292-b667-b1078cf9a929", "comment": "Malware payload (Mirai)", "value": "b723bee35c305cff8b65d92adbde934619a1921cd954ed7a25eaeacfac3e7fb934d93bbd58ad5023fa67b7351122f7f5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781790794, "uuid": "2844ce66-79f3-4866-be18-534f16df1a33", "value": "T17D342A46EA418F13C1C22BB9FA9F425533339764D3E773069928AFB43B8769E4F26105", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781790794, "uuid": "ee2c543e-1cce-4f29-8653-5084bdf4ca05", "value": "6144:njUDemaBr83mHeMJYIaCCCEzUqMtZLXjQXsKrukkHIQDM/RAWkmd2s3axlQ:jUDvaBo5MJYIaCOzUqMzwXsKykvQY/xf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781790794, "uuid": "319f79ac-977e-4ddb-84ba-26714226121a", "value": 246250, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781790794, "uuid": "e5581fe3-c820-448d-8522-0a277ab13207", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781790794, "uuid": "97456dba-89cc-475e-9c28-2b78d4111a51", "value": "wicks.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ab72d74-6abc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781749209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781749209, "uuid": "a9e617b0-57b0-4df6-9b11-162bae86c972", "comment": "Malware payload (Mirai)", "value": "a44cffef56d068dc21a3f828391ab5f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781749209, "uuid": "8ec844ff-da0f-44c1-b7f3-f95c3f6fb36a", "comment": "Malware payload (Mirai)", "value": "7633d173f2465fc85b3ce29a923b3f000c3d05b08d29ed8cc71f6b583369e078", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781749209, "uuid": "d33e1299-cb86-4f29-903c-2a14263db35f", "comment": "Malware payload (Mirai)", "value": "2a519e83501a5615c2c641bd53675f6d57709a57", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781749209, "uuid": "52101fef-51de-4738-8e31-c411f3d4b26f", "comment": "Malware payload (Mirai)", "value": "e68e909027147e72d28745216279ab487f45ab9720194ed77fdb8b0b01e7185adc95e4b87da7b906e746fd48334fc5ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781749209, "uuid": "a8f20ed3-60c3-4c7e-aaa8-6d5c4964d5ec", "value": "T111C31A16B9518B12D5C315BAFB9E518D33136FB8E3EE3202DD206F50678B8DB0E7A512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781749209, "uuid": "2f244243-ee1b-4412-9069-ea6a8fde2221", "value": "3072:usZY9CnvR6/wo6+cR/UuwigD1lam7a6Gt8xym4cTMqIbB2:uRwn0/won6mNDzaUaTtrm4uIbB2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781749209, "uuid": "44bbd035-aed2-47e4-a69d-2d4df033e081", "value": 129816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781749209, "uuid": "30500cbc-e544-49b0-b0ea-ef55502da0ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781749209, "uuid": "865d4dc5-4854-4bfb-a449-2b9a149a651b", "value": "data_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "699ac82d-6b01-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1781778923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781778923, "uuid": "5bcfca2f-35fa-4b3c-9e73-da1d41ea69be", "comment": "Malware payload (Vidar)", "value": "b68593c726c90661a1402d758bc8ea28", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781778923, "uuid": "89701dad-cdb2-4ecd-bb4f-092809a9734b", "comment": "Malware payload (Vidar)", "value": "76f50197193ece03a7af880db313e72df2f718b8b110f2710da5c77e55722364", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781778923, "uuid": "672236a6-b76a-48f0-9d4b-a07af0afa850", "comment": "Malware payload (Vidar)", "value": "54982cf665491934eb39d28a20e64d7b1150d6b9", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781778923, "uuid": "a4bac1d4-0093-4331-8584-430ebbe8bc7f", "comment": "Malware payload (Vidar)", "value": "53e9740552a66575046ea1923508849f965d91b49ce711b2bcf9388d951a44464609bd276de0a92ef4f06e6083e3caa8", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781778923, "uuid": "49d3ec26-0d2f-4cee-a317-d6575bab964c", "value": "T159C5EFC78AD21DC7CDD51838AC6B5F745A71C8AAF906CE439B32A66D9FC33848C1A44D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781778923, "uuid": "119d93ea-01e0-4d26-bb44-a6476f0eb2e0", "value": "49152:Bntd2QiG/o68LMUaHlXXK4KNRq8MlLzK7DFEz:/dv1/o68AFXa1NUzdKHA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781778923, "uuid": "503fa94f-ba4a-4110-99a1-f421503a3975", "value": 2636542, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781778923, "uuid": "d6306b21-019d-4cc0-9267-ab882ad684f3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781778923, "uuid": "44e9d85e-6a2c-4150-969a-ffe93d27ea39", "value": "SetupX64.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3ca568e-6aeb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781769599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781769599, "uuid": "15513b3b-1cbd-416a-8cf5-96dccfcf5746", "comment": "Malware payload", "value": "072ec859d3c7541ed9932263a47a5699", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781769599, "uuid": "5aeac311-dfec-4207-ba1f-8cfcbcb587bc", "comment": "Malware payload", "value": "7711a65d9f26aa1f910c2398e815a3a7bfa3785e3a098851f9315423c111a870", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781769599, "uuid": "79469332-80f0-47e7-8a5b-ec46a0d918e3", "comment": "Malware payload", "value": "cc6caed787175342fe93e3cf31754af47fea82cd", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781769599, "uuid": "c4e828ef-1ac7-4d1f-a7d0-b8ed2f4a65ee", "comment": "Malware payload", "value": "33b73a26224f83d8b228d2d2050c8b0174abbfa7c4c2f26d566ed7c93155074f07063f70c1b94aabd5fa605c4e041084", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781769599, "uuid": "45fb9cfa-7689-4a4c-b722-bd5425ea5c16", "value": "T12CF73331B13579D9EA2FA37FA0A91FC5807074E0B31BD56B63787FB19A9124660F2843", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781769599, "uuid": "9454ce43-a697-429b-b9ed-316762935847", "value": "1572864:DALanPaFZBMczNsgRoJFTJQCQ5oFXY02NEbffoOd1cCnaPGwLzqoTQ:DxaF0cgdQ7mXYcbfoO5noGmXM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781769599, "uuid": "bc02b684-8ae5-4525-8db7-d4ffe4ce23bc", "value": 72116736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781769599, "uuid": "01682392-7d71-4faa-96c9-185419f4c86d", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781769599, "uuid": "88ac0cf2-556e-4d68-8daf-57580fe607e2", "value": "SteupsHR_offline_6.17_uwrsz.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0822bc1a-6ad3-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1781759003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781759003, "uuid": "4e5c9be3-900c-4c6c-9527-6f428768cdea", "comment": "Malware payload (ValleyRAT)", "value": "12e82e2d1209927f073ed1c9ccc2bcf6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sa", "colour": "#E6B81E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781759003, "uuid": "1c78fe92-1d16-445a-8f7a-bdf7739cc809", "comment": "Malware payload (ValleyRAT)", "value": "77e89f5a5e5d40bff8894fa36ab166e2ce699cfd4ad263f1db2e229764f53206", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sa", "colour": "#E6B81E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781759003, "uuid": "9721f9d5-78a8-464c-9d54-4d70f0a0c761", "comment": "Malware payload (ValleyRAT)", "value": "63947d6b89378ef2afd447621d06326c1f1b5e60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sa", "colour": "#E6B81E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781759003, "uuid": "50a1284d-2289-4847-8abf-de277aada628", "comment": "Malware payload (ValleyRAT)", "value": "a84e669ae1d51157b6ce38b983fc06f7406ecf9d9c9857a4537a2e7f387f897bc73622c8e2e390f51e8a399b578220dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sa", "colour": "#E6B81E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781759003, "uuid": "42b9ebe6-fb27-44bf-a173-c140a2218b28", "value": "T1D0D37D6777E570F8E4778235C9610A46E772B83206218B5F03A446662F273D1DD3EFA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781759003, "uuid": "de70d835-c86c-48de-aa52-50b8dbb8a0c2", "value": "015963922633a41e43c441017740355d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781759003, "uuid": "33d8e741-b650-4acd-85d9-5733bebabaa0", "value": "1536:V3KdhXJZJE2SMwzFm8b68JXR+4y5kKYSSzHv/mgJgi5qVTsWzd7m9dlgZ0yQ:4dh5MFvm8L/OYrzHmgJgEirSuWy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781759003, "uuid": "8b505e4d-0e60-4b76-b792-83c39a0e1dff", "value": 131072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781759003, "uuid": "78bf3b40-8f3a-4857-b33a-0b2c588dfb60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781759003, "uuid": "f89df3e5-8b66-4e4e-a441-1dee3d887c20", "value": "explorer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b10087cf-6ae8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781768305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768305, "uuid": "4e0ab0ae-a027-4066-97ca-781d33252bc5", "comment": "Malware payload (Mirai)", "value": "b80ead4743838f2932b25f03d4f9be4f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768305, "uuid": "87efcab9-f022-4898-9d3c-2817ca39a440", "comment": "Malware payload (Mirai)", "value": "783b1e05672f817851b6ff9b87c20da89e7f6566a2be86b2be64b3383d44c141", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768305, "uuid": "45b2c79d-a694-4346-895e-5cb3308f2a1b", "comment": "Malware payload (Mirai)", "value": "2603aaf0d11e8b54d86eab402c398376a2a0fe8d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768305, "uuid": "4625f240-a32a-48c0-8e1b-c6969d8341ae", "comment": "Malware payload (Mirai)", "value": "534e3101c4d346d18a5465a4a2178320c237e0b5def5893e999fd3c324eff24db3072b4c0ded346ee9ed44a432b0488e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781768305, "uuid": "6494bab3-ac9b-4fff-8613-a0c89166c349", "value": "T1D2E45B02EF441FEBC4AFCD30852E835B15ED9D9712D5BA78A1BC8D5CB68D2691BC3488", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781768305, "uuid": "4c75aab3-ad04-49ea-83c1-f303472d3579", "value": "12288:CX9Xn19Z9XoSOIrZ/HFXOyxp5xoeOcLf8NGctVMLZOJx/F1/1zraC5smzf6Pxhdj:JhqvXTrD5yhYg2ads", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781768305, "uuid": "fdce8f94-e26a-4e83-afaf-d4c2bbbedf70", "value": 717692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781768305, "uuid": "6de8691b-878d-4ef6-8b22-d61d3fc20d1d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781768305, "uuid": "dae1de3b-f658-4d44-acf0-9e6f6b376a8e", "value": "kaizen.mpsl_srv", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7c3476e-6ac3-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1781752452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781752452, "uuid": "ff20641e-b7c6-4ea4-bef9-b079a9f13bb4", "comment": "Malware payload (Prometei)", "value": "213a922d6acf7105a07a78110c482db3", "object_relation": "md5", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781752452, "uuid": "4d27aa57-651a-4ee8-b893-49bb7f317180", "comment": "Malware payload (Prometei)", "value": "796c061818a54d7013e29861603dec0054218c29a30007d2d35d3e983a567d16", "object_relation": "sha256", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781752452, "uuid": "47de9940-daaa-4191-b22a-0aa1468dbc36", "comment": "Malware payload (Prometei)", "value": "b8ca62d4d528aa82ed6758bd2dd07d5f7e6cae5a", "object_relation": "sha1", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781752452, "uuid": "4924a6c9-1b87-49c6-9737-74b649665ca4", "comment": "Malware payload (Prometei)", "value": "ce90dd3a54b05b6a727c6c5d2e483e97b27386fd36364482744bc4dfe47918eecee125c6a7f70743a11f5ee950ac190a", "object_relation": "sha3-384", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781752452, "uuid": "a6db2bb0-7ce6-4c92-a90d-36398a41064e", "value": "T14721998ABAA1DD3124D9D828F6F1493E5E62F6561C117812308731FCE5EC22033E9CB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781752452, "uuid": "e4174f56-64ab-4cc8-b53a-d3ee5f05b37e", "value": "24:M1jvF39RbinDSx1wyx1eC2uK6MTzaH+2TMTSXTlY27vFLlEb2m2p4nKTNXT5eORz:K9Rbiny1wO1F2uK6MTu+2TMTSjlYsay9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781752452, "uuid": "39e7d9c0-ccb3-4582-98c1-69cf102bf200", "value": 1323, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781752452, "uuid": "ee453e53-b16d-489a-81af-ad24c9a11dbe", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781752452, "uuid": "d9344db0-3980-40ee-b625-72b494198899", "value": "796c061818a54d7013e29861603dec0054218c29a30007d2d35d3e983a567d16", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c724863-6b34-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781800725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781800725, "uuid": "dcf94154-646e-400b-8341-f9e27885aedf", "comment": "Malware payload", "value": "2d245f25ec09ac5222614b9f8a9cebbc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781800725, "uuid": "fb482d84-04c7-491a-9a83-b2d88e00dc60", "comment": "Malware payload", "value": "79fd1895c75627f64717e2a7ed0c34110ce1251d6f31f2da6483786a466dc636", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781800725, "uuid": "f989db19-7be2-4b43-9621-a4de0049aec1", "comment": "Malware payload", "value": "f98e4c3c8d3d7516242635443661ea55424be266", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781800725, "uuid": "ebf246b7-71a5-4220-80a8-dd74f5b0f733", "comment": "Malware payload", "value": "a7217dfb7a035b924839e6e8cfe104d38568a80f7ce756781c7d7e065b442b316b8a125831e428b6bef1433f0589231b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781800725, "uuid": "a0cd323b-1ef0-45ea-b1f1-d7e175ef3ad8", "value": "T182A30887B902DE7FF80BD6BA409309197531FA660E530B76B367BD93AD311D41922F82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781800725, "uuid": "15747f41-05d8-4713-b5c8-b746f55b3e03", "value": "1536:Xyb7fahHxOrsCxjtwZgNU68FF4PDW0gsRmDZYvT+Ff8OUdKxaS:XyvyrCsCxjtGgNU74ZgN+tOUdsaS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781800725, "uuid": "d5ff91b8-b136-404a-a141-4f5d0db493a9", "value": 99684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781800725, "uuid": "6ebc25c8-ac84-498b-b88a-313cdaa36063", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781800725, "uuid": "c39b4b0d-b969-4f70-8c35-ed4bd645bdfe", "value": "manji.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4116d472-6ae8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781768118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768118, "uuid": "85cb59d8-1430-4f52-a42f-819535c18495", "comment": "Malware payload (Mirai)", "value": "ac8d0bc7deda0fbc4129dc0694fde3fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768118, "uuid": "d9e56f17-03fd-4687-97a1-990f12288a63", "comment": "Malware payload (Mirai)", "value": "7a01c61f2d3d35d911ec22df7ef96210557339e1d67f53d240096f175c35b4dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768118, "uuid": "c626b2c2-cb16-4715-9da9-4b78af231240", "comment": "Malware payload (Mirai)", "value": "a2561d352cb7749cf5a8e4963de10e958c1d88be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768118, "uuid": "076ac9e7-a3dd-460c-aecd-b0811f095075", "comment": "Malware payload (Mirai)", "value": "efd9726a8b17c216b23d9d77d669d5eb64b84722cb995b3be1a57048cc95168e30c893d36e602c5a839ad9246b7d76ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781768118, "uuid": "94505675-ce03-40b9-a28b-e9a0083b2e3c", "value": "T1AD7423A15CD3866B4F9C4A7E40D8BDE6FC1815B7500B4C54A49C4C8479FAEA9BB0EB33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781768118, "uuid": "8a0100ac-6191-478d-96c5-df9f11828662", "value": "6144:SFHx88gYdfxv2h/x2K1eTF/z+6m/xX+rD4KUQCGuHRPILDh3QoPg:MR8Y+32KqCxeUQQAg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781768118, "uuid": "44c00d2b-d5bc-4705-aaca-569b7cc3f466", "value": 338376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781768118, "uuid": "121d1787-6a88-442c-8839-2a38d14f9c41", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781768118, "uuid": "0ffca240-7366-4488-9f96-258a15cf4b3c", "value": "barm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0728554-6aa8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781740897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781740897, "uuid": "3474c22f-84aa-4294-9935-c8606413a409", "comment": "Malware payload", "value": "1a0590c9f835ca682765c89652f3275c", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781740897, "uuid": "f8314a36-6803-4b11-bde9-19bcfe75839c", "comment": "Malware payload", "value": "7b8c5882c57eb5ad3f6fd813c651dcea19811c0d5a67acc326aa2d9b19d3ee62", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781740897, "uuid": "a342aafc-b8f3-40a0-bedd-ec744d4b1400", "comment": "Malware payload", "value": "782412016181bb7aa9951775ce50b5d16c51970c", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781740897, "uuid": "4b804aa2-1eff-486b-a445-f80184868532", "comment": "Malware payload", "value": "a5da52be50e7344e950725a1ad1a8fdf9cb4ced6bee23ca98cfcb8a9568dde9b5db4835b06cf37e3d4a24c832d4c5066", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781740897, "uuid": "8ff14292-d229-491a-90cd-57d2db2b38aa", "value": "T1EB2142E14194D03D379C91AB34180F1B8BEA751F2430DD60C3D54A8B8B8E424E76E1BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781740897, "uuid": "c0165bdb-2aca-4ddf-b037-cff775e4f2d2", "value": "24:Hv1WmKIEQSClornT137KVgH5zjghIWptCIC20hmq5sdTu7SgZpZI7SYKeFaJmwmc:NW9I78LT1OVAzjghIWptRCwqkTZgnRR9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781740897, "uuid": "478a2249-1ff3-48c6-8a4b-335e9a1d5f53", "value": 1347, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781740897, "uuid": "8c812f10-c484-42c9-9c0a-b9b91fe62806", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781740897, "uuid": "42324f3e-1bf6-44aa-9669-08ac37810435", "value": "Wahhabism.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c838720-6ae2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781765533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781765533, "uuid": "eb7d5825-9dba-40e9-b05a-319cd4542222", "comment": "Malware payload (Mirai)", "value": "31630d84549684c51ad30f5613c2c7b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781765533, "uuid": "2900bdbf-e97d-4a32-bf7d-5a01b1ad7ae2", "comment": "Malware payload (Mirai)", "value": "7c7e5b8ed7213586d8fd62b49e2ce4d9ac05e9bd2ad513db21f7d58c5a9b4e4e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781765533, "uuid": "63a4eca8-5b67-4912-bb8a-387f71931f4a", "comment": "Malware payload (Mirai)", "value": "398dc96fc21a345237c691ad011712807fa2545c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781765533, "uuid": "be4aab6c-638f-4ed7-b5d9-c22ee1bd51e5", "comment": "Malware payload (Mirai)", "value": "92f5d421c29a18288bceaf26010d41f9952b65c1db1de1e30f9271ec5bdf2e11d128b3ae1cfceed178f2aad695015c67", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781765533, "uuid": "a8951f8a-2cb9-4a1f-bd1f-b56a64e0e7d3", "value": "T111F32A45BD428F13C6D721F7FB9E428D371A6B7DD2EB3103D9256FA0278A8D6093A211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781765533, "uuid": "6c8cbe5f-de6c-4cff-9c91-2b193c629e5d", "value": "3072:I3YEV4wVZC6IO4mobbkZilQ5SIid1G8D:+YYslO4mGbkZyQSIibG8D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781765533, "uuid": "ebdd17a6-ee1f-429d-b26f-b107c9ef5967", "value": 158944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781765533, "uuid": "f1d514ff-2732-48d1-bce2-2f5a711f8dce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781765533, "uuid": "90a0b269-0efe-4573-b2f5-256317abfa24", "value": "nova.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02904a86-6aed-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781770160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781770160, "uuid": "dd284127-c383-4afb-adcc-4b349ab4f604", "comment": "Malware payload (Mirai)", "value": "3eb3e74fa0a602cdd68eca114da925f3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781770160, "uuid": "5b482a8a-e141-4ac7-8164-ca2d6c306514", "comment": "Malware payload (Mirai)", "value": "7cf66d0c99067810af0712e9f0c87fdb5c21f4e9ffdecdc4eb6d2c910b5e8983", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781770160, "uuid": "b2247e42-94a5-4d37-a132-cad7ca57b337", "comment": "Malware payload (Mirai)", "value": "667f168f9f64a39c5702838b8c185c4397bc0522", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781770160, "uuid": "3edcb3a2-e700-42bc-b53f-dca29438849c", "comment": "Malware payload (Mirai)", "value": "f8ddad4baa49f87c86f2b418c5a68eca0920f1a510a638322621cb8cc47c8e1a9e2ed6ffda41e868af415d28db452ffa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781770160, "uuid": "c0e9a13e-d196-41bc-8907-b78d998b5d0e", "value": "T1C883016D2B06B8CAC8BDC0FC26EA87C53DB51E51F5168D48B6C6D8DAD117CC678424C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781770160, "uuid": "1b6d843b-38c6-4e45-8897-7dc3e7341e86", "value": "1536:+6dz0o+uwVjZul99BOjAWNMhllaX5dcCdn1rcAt5iGVJu1:rtw3uX9BBWNM/lU5dPQg5iGVQ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781770160, "uuid": "eb3bfd84-a02a-436a-b68a-60af035307db", "value": 87776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781770160, "uuid": "97980d9e-f69c-4778-b49a-100dd99d09f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781770160, "uuid": "79e6eeb5-1bf5-416d-9f75-74ba593e811c", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e76a159d-6ae6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781767538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767538, "uuid": "b934710d-4826-4b60-a230-ce3c2f40e98a", "comment": "Malware payload (Mirai)", "value": "6b80f6e4deaeb9eebee9426efb5a00ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767538, "uuid": "8e575bb8-444c-4a73-b530-1edb5f15f66a", "comment": "Malware payload (Mirai)", "value": "7d4d8e3ac5c5049fd4e97ba7c5ccceceb5a06f98ae943c62aab4706d5d23110f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767538, "uuid": "ee76c978-8579-4a5c-9525-8975addee702", "comment": "Malware payload (Mirai)", "value": "6a4c71201d904920467a61f760e0565ef415ec2a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767538, "uuid": "31e45e55-93ec-450d-924d-cee37f74d74f", "comment": "Malware payload (Mirai)", "value": "21270c1234eebe61ffb0e75fae083a69689900609e6d105e2e2da6f16fec310be9efcf943e2c8d2004bb518b8ea37551", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767538, "uuid": "e3fad2ef-6039-488c-800a-78196c053a85", "value": "T128A32B45B31D0A83E2572EF0363B27E1D3EF9A9131E4F644290FBA4592B2D321586EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767538, "uuid": "cca80c93-1cff-49ad-9caa-ef40f75ee2ab", "value": "1536:M9J/6vrafWm7Qt0jrMbBsQeJSc2OzEOEulH9XC1w1emLnoRDF4eSvQ0G6WDf08Cg:cart0sbBXch1eZ3+38KW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781767538, "uuid": "fc32a2bc-e265-4f95-ab90-36e0e0d6bc52", "value": 99704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781767538, "uuid": "901ceade-5829-47c8-bc7d-0201b93aeef7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767538, "uuid": "d1dfbe9c-0dcf-43e5-8c29-643995f9a422", "value": "rep.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bc1a377-6b1d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781790792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781790792, "uuid": "8a5710ec-5ffd-4897-8ee2-608dcaced6f0", "comment": "Malware payload (Mirai)", "value": "61726c594a2ec2801db5bd81b84b6ce6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781790792, "uuid": "09a36e27-3d87-4a4a-a96c-9d82554474a3", "comment": "Malware payload (Mirai)", "value": "7e777b7701de0e1a707b78f47e1542c70b5471fddad988d0d68333a9afc5d0e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781790792, "uuid": "0dcdda54-8ec5-4b22-a3a5-e001333566ef", "comment": "Malware payload (Mirai)", "value": "b3534bed142cf430c308f78eb2f0fcda3ad8471c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781790792, "uuid": "11cbb74c-0e40-4d0e-8096-fc902a63fe81", "comment": "Malware payload (Mirai)", "value": "2402b418bb2e03539d40ac40d92cd012f62e9b70be1164456872e4e8ecfb9090acb38829ab78b5dcfd758bec4f45dcee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781790792, "uuid": "1bfc974c-2e4d-4fed-ad13-631b90422e8a", "value": "T18924B60A9F510FFBDCAFCE3706E9074625CC651622A93B393678C928F54A94B49D3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781790792, "uuid": "4d93a039-2fd2-4a54-adc4-dcc63efcc96c", "value": "3072:m4HsUrXp+7pP15vwCdiBJBTOwGAN7/6+yD:mv6Xp+ZIDBJ00N7S+y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781790792, "uuid": "82748f76-8682-4094-90f7-5cf0c3d4e16b", "value": 221796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781790792, "uuid": "f8fa4723-97dc-4396-a2a2-5ce26e658e7d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781790792, "uuid": "8218670a-a9a1-491d-a491-65b47aa4be07", "value": "wicks.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41002846-6afb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781776278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776278, "uuid": "79bbb132-4fc7-47af-bd41-360b7e2da0e2", "comment": "Malware payload (Mirai)", "value": "1a8d890bc8a173865cc57ee7c7c31d1a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776278, "uuid": "dd972eb5-28e7-490e-8931-c022f7359d4a", "comment": "Malware payload (Mirai)", "value": "7ed1245af455da269dee1342dbec42bf7e60ff1d058fcd32183dad1ccd67dca7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776278, "uuid": "d9a0c37b-2de1-4688-ad73-d50ba136b25a", "comment": "Malware payload (Mirai)", "value": "141359086a280a35aa68cfd26ffdbbdf1a639619", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776278, "uuid": "5d2ad380-d987-4774-8306-ddcf99769328", "comment": "Malware payload (Mirai)", "value": "b995886b310429a32b37c387a1928515cfc2a09938e8449b880c168fd9cf3bf6c45814f1c685751d48c60302b2f41657", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781776278, "uuid": "ba1aaa20-7888-4453-8d41-9db57b0dd6a4", "value": "T18FF33A4BB7608F90D2B5CA305AF34B679AB9119716E35481E2BDDE203E1134C6C6FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781776278, "uuid": "1ee1a3c4-af95-467f-b021-b42e7c517d1c", "value": "3072:uFXvl7WE4XQbSQLW6g5RIk1EYobfRdVGN4qQUtiv0pjU4cjQT:uF/l9Yi+I2dobfRbCCUUKPys", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781776278, "uuid": "a9d6ea4e-1ba0-423d-aa84-19fdfb3ff146", "value": 166648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781776278, "uuid": "f3f15858-be46-41d6-b8bc-f1a285ec7204", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781776278, "uuid": "76ae4a11-7ec5-418d-a5ef-def991831534", "value": "monero.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f627466-6aea-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781769054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781769054, "uuid": "3cf7c117-9004-4c20-96df-b8cf8252d0f4", "comment": "Malware payload (Mirai)", "value": "72e646bedc19a53f56b529dbcb193d34", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781769054, "uuid": "2c54e3a8-afce-4c05-8ead-7415c0fce6aa", "comment": "Malware payload (Mirai)", "value": "7ed5db3b0cfb004111dd38996b93ce0c69f3e96359209a9ed85cdd0957501d6f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781769054, "uuid": "3a524ecf-1e28-4e71-bb72-c128d101c97c", "comment": "Malware payload (Mirai)", "value": "d3ffc60c467661881a8e8eda15ec7d786586cea3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781769054, "uuid": "56c4b5d5-37af-42ea-b9a5-d5164eea2eb4", "comment": "Malware payload (Mirai)", "value": "47c80c209023b46c729ada720bc89b1dfa484f641c5b771458ef930e976b5c8dbe98851ed08c2d9e46520a1cc8ec1fe1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781769054, "uuid": "1c2d3627-2ac6-4abb-8292-38a4571bddf4", "value": "T177543B46EB414F13C4D627BAB69F0245333397A4D3EBB206D9246FB43B8779E4E62601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781769054, "uuid": "62ea395d-db05-4ce5-8218-6f09617c02a3", "value": "6144:Ry7C7Y9nm0Mv8hC4ejxaNveZtGxczXiY61+nzc8Y4V/GGYmPi2YxJs:Dim9KC4ejxaNveZtGxKF4+h/Km6dxJs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781769054, "uuid": "fd53aa62-e2b0-42f8-b95c-1875936cda46", "value": 291463, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781769054, "uuid": "a458b45f-4f5e-4e46-aa00-3e9626c5fd46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781769054, "uuid": "d1b305ba-21d6-442f-a6f4-e09807ed9425", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73c2137e-6b37-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781802133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781802133, "uuid": "49c3fb5c-dae6-4463-b2e2-0ffaea9bee83", "comment": "Malware payload", "value": "02325ee683e0f759f03b6944aa317834", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781802133, "uuid": "561fe6f5-c332-4eb6-a431-8fa6f3138e32", "comment": "Malware payload", "value": "7ee6e8c3987f080e3c702f4b1a4fc107ca8f4e8f72dd10194a9cf4997a536d3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781802133, "uuid": "6a3d1136-b0dd-4bc6-92e4-021bd0745c29", "comment": "Malware payload", "value": "b8ebc26bcbd3053dc023fb2574bc456bf2016ea8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781802133, "uuid": "60ce1591-b1e7-4973-9e7c-89ccc136d32a", "comment": "Malware payload", "value": "4d725b2a973c27ede3f3cd515dd24df0dd73f0408fca30225ab746c31ca0a09c62be27e803d3aa87eca32fdce74aa351", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781802133, "uuid": "739ace82-4945-47e2-b171-ed7d392d60f1", "value": "T1A4068E17FDA109B9C0A963324DA78282373CBC451B3627E76EA0737A7E727D0593A714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781802133, "uuid": "f9f57a39-61c8-4ce8-98d1-828c0f09ac45", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781802133, "uuid": "8725bfd2-c55c-4768-871b-820a90dea97f", "value": "49152:8QyNaPtF0Q1+HGn0hywUy7lwNijh2Iuo7tzL4CqGYYZ:8wNhirkNwVL45FYZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781802133, "uuid": "3c9bb43e-f0a4-4cb3-8763-b45c7e433b36", "value": 3910616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781802133, "uuid": "fbf844da-8549-4ee4-ace9-98616d41e090", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781802133, "uuid": "040e0a37-b273-489b-9196-36804be0a3cb", "value": "mpclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "794476dc-6b53-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781814168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781814168, "uuid": "44b68a72-237b-4ab8-a422-83e13f73866e", "comment": "Malware payload (Mirai)", "value": "becee154cc8d6623760ec922e77c164a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781814168, "uuid": "f777d725-cf89-4f59-9c86-6410af662f65", "comment": "Malware payload (Mirai)", "value": "7fc892147a2e473109c25f33153843fd0a44dbc64b4ec222804b14c88e8509f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781814168, "uuid": "4b5750f8-cc41-436e-af8b-002b645ae1bf", "comment": "Malware payload (Mirai)", "value": "f85a857767812a599a8b68a56f67c2afd7f5c79e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781814168, "uuid": "e1039c90-8f4d-4ec3-b0c8-a8484c57cfef", "comment": "Malware payload (Mirai)", "value": "b929413eb227c3c20d395de4d0735ed9db70111868a865bfa0c76c974785c7c47b8f39f622f6124e663315594c061240", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781814168, "uuid": "bb9c275c-f873-4140-ad78-e35bcad96645", "value": "T1C2730278D6DFCCE0D4F4C57A5694E39823B18AB8B775B2D510801A824733886BAD7EC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781814168, "uuid": "0d590c3f-5f61-4e55-9b78-e5ae1ae400a6", "value": "1536:YyMUeEmY5rJWp3SfbpkMa18fdPqatbHhaFoI5ht/zmLvRI4u+qgw09Q:YXREmM6S9lPqEb6oI5TzavS4u+qgwx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781814168, "uuid": "73b3ca3b-62c4-4ff0-92b1-5773286aa894", "value": 80708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781814168, "uuid": "b84d978f-d6f1-4a14-94ed-b95824b52318", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781814168, "uuid": "b1fcae5a-2856-46ed-8c63-9e0789e7022c", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b17d80a-6b56-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781815487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781815487, "uuid": "194d7a7e-c1ea-4edf-bb99-9f88afffb6b2", "comment": "Malware payload", "value": "9e50f2adbf3111e59ff08d0efa520840", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781815487, "uuid": "631abfb5-eb50-43f4-a112-1b4f80709ea5", "comment": "Malware payload", "value": "7fe68248774d7a86354a5abc7fdd822d2b5114a06479e6466a7ac05eee0f2326", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781815487, "uuid": "d60b967f-d246-4ae0-882d-4ad9bf6964da", "comment": "Malware payload", "value": "483066f467c7b54844d041812cfa9866ae33f154", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781815487, "uuid": "ab6c011f-6e13-4050-bbf2-677ec37174cb", "comment": "Malware payload", "value": "36007a29b6fe85595698df7f478c9d07cddc5c746c59dfc8ce97c802d2b064e3190de4b61d6df261f7a4a12716e6b716", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781815487, "uuid": "aa5a8e89-ad1e-4c7d-a692-87c95c52972d", "value": "T15A215E8D6721E53824DDD524B7F24E3C5E63B2956C12B911348635FCE0EC654379CC36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781815487, "uuid": "a7ff7ff5-740a-462e-8294-444e1317d76f", "value": "24:4ud1jvF3dudpRduJinrGx1wyx1+u5C2uK6QuTzaH+2TQuTzuCIAvF2b2m2p4nKTi:4uddudpRduJinrS1wO1+uA2uK6QuTu+F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781815487, "uuid": "5cb33522-61c6-4514-ac3e-b38c37b6af78", "value": 1142, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781815487, "uuid": "f64ff625-9321-41f5-824a-16097b514f55", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781815487, "uuid": "4f6efcda-699c-4734-87c3-03c40829e248", "value": "clean", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b99d5fd5-6b55-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781815135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781815135, "uuid": "23af7fe3-cc12-4182-8e12-b53d9a097034", "comment": "Malware payload", "value": "9c9d806368d5962656e29c6dbbf9bd60", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781815135, "uuid": "8aa143c7-cc40-47df-97fe-e724fb555bd8", "comment": "Malware payload", "value": "806120006faf26a31758a797e20128e4060f93e152b70bf570cab81f6f1911e0", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781815135, "uuid": "41c2268b-bff0-4346-a4ec-08eff92a0152", "comment": "Malware payload", "value": "1d8cf26bfcda913492a0be8f0cbfe4f156831d81", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781815135, "uuid": "1231e6fd-59b4-4552-a97e-998a48e7c9af", "comment": "Malware payload", "value": "70f41c02bd2095ac7708df592c412bc31cf88fca1b5760965320b2fe6723ab211350a03d6972210f4542950e04884a28", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781815135, "uuid": "83e508ef-b965-4a6f-abc3-f9d6adf047e9", "value": "T1553130EF01041E395347CEDEB3B23589B10C91EB2CA7D3A5DD084EAAD6485DCB195F89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781815135, "uuid": "602b9939-7b89-4887-955d-e2746315766e", "value": "24:BJgrCZTH19fuYSw1tCZHpOKHIrHt1WRWOulQXY7A/i9I:BJg+xfff13WRWZCY7vI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781815135, "uuid": "b68b7938-7390-40a0-ad5a-b84114532d4f", "value": 1584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781815135, "uuid": "2714fe78-5474-424c-ac83-03cf0a7974cc", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781815135, "uuid": "2d82cad3-fefa-40f1-abed-8e4f7ce2ed7d", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa132d79-6afa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781776025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776025, "uuid": "b6388307-d93e-4d26-8b75-7e20d089368b", "comment": "Malware payload (Mirai)", "value": "b2d66b9fbcc36374c232a59c5df363bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776025, "uuid": "efe52f79-e815-4585-b933-c92879192571", "comment": "Malware payload (Mirai)", "value": "80736d6288ef5e3bffd2afb59d28fe80d7d0a1a384001f186dab1e1077059e9b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776025, "uuid": "eea823ec-1852-47c8-b4bf-6ab48726525d", "comment": "Malware payload (Mirai)", "value": "31a0d211932ab33d97b52ba06a1d563bdca05cfd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776025, "uuid": "817e069a-d640-411c-a9a7-b8feb68514cf", "comment": "Malware payload (Mirai)", "value": "856791f66964d52cc8b34fb870e44fccfb674394d8ae551ea5ee5842841c78588922128b1bf13b3924aeafb6aaab867f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781776025, "uuid": "ad1fa984-c2b6-45e5-b1d4-c0f04dab8a3e", "value": "T17DB37CD8B24D3D6ED1A32D3EC65A471B6F1C5A60B8434D0280A5FA8757F70AA1F364CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781776025, "uuid": "259586c3-2884-43f7-aac8-c8d8d816007b", "value": "3072:9VJCtHiohVIww1WZf0EsVUJHRNqSXvAc/to1:v2iUZaWZfbsVUJxNvAii1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781776025, "uuid": "883a9d09-1fcb-472a-9cc6-897bf1ac0128", "value": 117284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781776025, "uuid": "6395f7f2-bcb2-4c6f-a133-8d539246f796", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781776025, "uuid": "518b1f42-ac05-4d4e-8761-311e802edcd6", "value": "monero.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60e54518-6b0d-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1781784062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781784062, "uuid": "db0fae52-5871-4fed-bb4a-f0678ffb6c41", "comment": "Malware payload (NanoCore)", "value": "c6796d6c92ce468c0096dd2af625958e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781784062, "uuid": "ffa0c7e5-7990-4b72-9107-ccf2d7767392", "comment": "Malware payload (NanoCore)", "value": "80c1968fa91f2d3b7ba9e6351bc721ee1bd69d8bfb7884e6e3d189f971a0f763", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781784062, "uuid": "4582823a-f2d8-4183-8cfc-a22d2b2ebdbe", "comment": "Malware payload (NanoCore)", "value": "b0fb3ba2cf9799c88bbfa35b4fc2966309f07155", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781784062, "uuid": "f73f7f48-29ac-493a-b2d3-bcaa03b65c26", "comment": "Malware payload (NanoCore)", "value": "08b195963ade6033c7ec16b1c4b16d27371565eec12f7e0a36202a4592354f3b0f62094bd66fa3a06aa3ea7f936bb4ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781784062, "uuid": "93c43b63-1cf4-46be-8355-7a2854884732", "value": "T13014CF5677A98A2FE2DE86B9711211128379C2E399C3F3DE58D464F78F227E106071E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781784062, "uuid": "0973f39b-8e71-441a-8b28-aebbb14a62df", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781784062, "uuid": "c9d470c1-c92a-42e2-aba1-f90bc58c2876", "value": "6144:sLV6Bta6dtJmakIM5T0cFHkf8wa3PNMGdy:sLV6BtpmkcrH3wKlMGE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781784062, "uuid": "60e3c384-871f-4d61-9ad5-56473b0f36f6", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781784062, "uuid": "702280e2-e7c2-4e0f-8d33-7966ab81c238", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781784062, "uuid": "48d23dd3-b19a-480d-9f2a-0dd338c11e6c", "value": "renow.io.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd2be414-6ae6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781767574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767574, "uuid": "a1b28172-5502-4ec1-9608-267acf8a415d", "comment": "Malware payload (Mirai)", "value": "6e55fc958c884c64362bdf55cca4c117", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767574, "uuid": "cc5fd51d-17a1-49d4-971d-6c11717f184d", "comment": "Malware payload (Mirai)", "value": "8141bed4efced7782bceed490240ff764b72462fa73ba817f7bd307297acde6d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767574, "uuid": "b59eb55e-e1ec-4ff9-bc0a-3beee113acde", "comment": "Malware payload (Mirai)", "value": "0fb91e65012f119eb739f78c6271af6b9379e31a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767574, "uuid": "50e9b48c-f05a-4215-857d-33d3aeeb0d7c", "comment": "Malware payload (Mirai)", "value": "a22ec62d6540d246b436b8fc032ff93cf89f3dc2814e89ffd5ab21df9f632d222ee118c1503b715d2584f996349412f6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767574, "uuid": "94a2273c-fdef-4b07-aa76-16fd3d08136e", "value": "T19F732846BCD1CE12CAD422BBFA2E11CD372563A8E1DE3203DE156F5437CA92E0E76591", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767574, "uuid": "c2025a30-df76-4645-9cc9-924405cf4ca5", "value": "1536:iiBymWJkAEGkRxtY6Mc25idqrucq3CKLcykaIDp8ptJ7Rm:ii7WJkAs21rdmjF2p8r5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781767574, "uuid": "58df220f-fd31-4760-a593-15a4313c5968", "value": 74748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781767574, "uuid": "39766876-785b-4ebe-8bb4-f9619cca8b86", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767574, "uuid": "9a4cba4e-e986-4d63-a423-e8216889966b", "value": "h0r0zx00x.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68174485-6b0e-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1781784504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781784504, "uuid": "7a44a00d-7dfc-4aba-9442-e485da6bc793", "comment": "Malware payload (Prometei)", "value": "269649abd46533e09c46236d6c2cbda1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781784504, "uuid": "f5a29c24-e979-46df-8f16-2faa89be2551", "comment": "Malware payload (Prometei)", "value": "81612703ca004ffe48b5e6e346608d84936900aa0c31e7a55ae5e535c4d64176", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781784504, "uuid": "d22e99d2-8016-4477-94fe-2338f5a3b790", "comment": "Malware payload (Prometei)", "value": "0df1794a010ffc8767d6483dfe41a273d979db68", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781784504, "uuid": "f019a4db-404d-4110-8164-c57e54e4f709", "comment": "Malware payload (Prometei)", "value": "799c7e9874c4fa8914e12670596e33c2b511e5e92e3cb02860dbcc1e70546bda1df743ffd5ba45f139651fb03a684448", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781784504, "uuid": "c740694d-b812-4542-b2b6-159842b156fe", "value": "T146A423B4F9219E9F6DD769B91B24C31DE182C172589D4C2313AE94A34F3D632BF2C816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781784504, "uuid": "439c1d2f-2e79-4083-8d17-cd955ea163b8", "value": "12288:Fs+/py5fM2l+M5F7TsJwtY1yvr+bT1psS+6T6NCj76tsd/:Fs6pyCC/Ya2hpi6T6N49", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781784504, "uuid": "5e6cb247-1fb0-4577-a288-53ac0904bee9", "value": 449081, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781784504, "uuid": "e0b32399-c233-47fd-9820-659fb2d7d109", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781784504, "uuid": "095fdb81-e49b-4d54-949d-e9878121cd8a", "value": "81612703ca004ffe48b5e6e346608d84936900aa0c31e7a55ae5e535c4d64176", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8182b470-6b0f-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1781784976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781784976, "uuid": "c7cbb9ca-ca43-4044-939f-f9a5a363c33c", "comment": "Malware payload (WannaCry)", "value": "4e5d4cfdada0b6b0212ceaf0fff68248", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781784976, "uuid": "211d035d-d2dd-4d5d-8821-37dae66af7cc", "comment": "Malware payload (WannaCry)", "value": "82eff0d22a6390cb5d1d810d35ba7846668c716fb4a7e736ad09fcf05b75d2aa", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781784976, "uuid": "b2eea922-1e2c-4dec-98a3-68ae7b7e3473", "comment": "Malware payload (WannaCry)", "value": "5e4a1331005b15405338a1747d21829bd688be6f", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781784976, "uuid": "ac1020f3-af53-4b31-8014-2d91d69d7052", "comment": "Malware payload (WannaCry)", "value": "aaa66fd4bcbd278b3e904ffbbab4f24304dde29e2de8a125624e497fe4d8e06a1ba693df348ec5ed9724cb477fb6bb22", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781784976, "uuid": "2d3890a4-a9b4-44bf-bf45-a7be9b537273", "value": "T16436D001D2E41A64E6F20AF629B9DB10833ABE55995B972E1621414F0C73F1CDEE6F3C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781784976, "uuid": "9cf2be2c-0283-488d-8980-6827435b3c66", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781784976, "uuid": "87eacb4d-de90-44ca-836a-9b8cd8a3b884", "value": "98304:DXDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R:DXDqPe1Cxcxk3ZAEUadzR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781784976, "uuid": "8683049b-4c90-4376-8870-2b5a82e15425", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781784976, "uuid": "21da606c-8c99-453f-acee-eb4670119634", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781784976, "uuid": "37467664-5df0-44a9-8f63-d2c236297bfb", "value": "82eff0d22a6390cb5d1d810d35ba7846668c716fb4a7e736ad09fcf05b75d2aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d878c32c-6b2d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781798007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781798007, "uuid": "a77bc61d-8e22-471b-96eb-228e632b41a7", "comment": "Malware payload", "value": "bcc2b442e8234ca44a732dadc5bd18fd", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781798007, "uuid": "898ec518-55e9-4b14-b14f-30699e31a1ef", "comment": "Malware payload", "value": "836e2235a35bbe9bb4e892930d4bdff8e2e1d4e4a972cc921d06a80288abcc0f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781798007, "uuid": "d19b8b09-b499-4a76-9579-a866deb2ffa8", "comment": "Malware payload", "value": "d9b40b7acea27af3b565889f48b03194986602c1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781798007, "uuid": "b9a3f8d1-8862-4862-bed4-09b35681f69c", "comment": "Malware payload", "value": "2c5557bdb170ed51f67a1c050914a9b88ffaa4da112121578e2b86942f581d6f148bf73d64878cc698f974d824212852", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781798007, "uuid": "4d48ad74-07e7-4049-ad38-f2c1e4ecca24", "value": "T10EF615C1F164419C61F3FFE0729528BBA4135FB76422E11217ABA2D849D87272CFC6B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781798007, "uuid": "a2e39309-4322-4e34-9c24-2cbc8f2caef1", "value": "384:MUouPxYtMoZaQe6l1NwKSjZTKsfjrrOezLms8qSsr40nFMyStzw+zWB5pEXrAkyg:r3m0E28scqK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781798007, "uuid": "01011f40-5488-45cf-a06e-4e4a5a3763c9", "value": 16129424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781798007, "uuid": "3a9c52b1-1547-4809-a5bb-4e7bab60ea3c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781798007, "uuid": "dc850fcb-1b72-423e-8d3e-40df79f569a2", "value": "Notificaci\u00f3n de transacci\u00f3n BBVA n.\u00ba 0000245 Pedido del cliente n.\u00ba 76890.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d2e4d89-6ae7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781767601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767601, "uuid": "9a4be79f-62dd-4efe-8b2c-af051060e9d5", "comment": "Malware payload (Mirai)", "value": "1fd65d8168d487d6e0e2a416120f2631", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767601, "uuid": "724109e2-e77c-45a9-8aaa-25b7fcae1a2b", "comment": "Malware payload (Mirai)", "value": "849193682cecc5c73e602034033cc124ca06a6d7be303885fcd1dca989945e47", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767601, "uuid": "0e487023-c7f5-4eb6-ab38-677d7fa9fb39", "comment": "Malware payload (Mirai)", "value": "40e0c530291097ede4c935b3f157ba62e36cb4be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767601, "uuid": "2375b6e1-a6b1-4a42-89c6-7b27de955f79", "comment": "Malware payload (Mirai)", "value": "6d3b8c4266f5e3ac5614666fa721d3bcf2581a0dd44a68db7498aa246f8a71f3c17ee8b02d865e8b4d9d80ef1d3063fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767601, "uuid": "2c0596f3-9a5f-439b-9aa3-81e6d671c2c6", "value": "T123E34B46FA808F13C4D52776BAAF42493322A764D3DB33069D189FB43F86B9E0E63515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767601, "uuid": "ab6c2b1f-c6dd-4906-9162-6a34ad950a39", "value": "3072:jaMHxmINe+exwO9vU45HO7jVqr4dddSXLbFM/95MGUaD:jaMHxxqw4lHO7jVqMdGXLpM/9MaD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781767601, "uuid": "9b90288f-9570-4d12-adfb-f361e94aba02", "value": 147843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781767601, "uuid": "67f5012c-a3f1-49dc-a413-b50c6c283b80", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767601, "uuid": "954ad8d2-0bf6-4327-b02f-28707e497119", "value": "h0r0zx00x.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75e240ec-6afb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781776367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776367, "uuid": "676528ef-3226-424f-b28a-813a9047cbe2", "comment": "Malware payload", "value": "96e6331044c90839b244a917603ba953", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776367, "uuid": "0aa0155f-873d-46ee-a8e1-63a0d9725eb9", "comment": "Malware payload", "value": "8580b04050f13ea5787d54aa7627a31376844ef66a3d6483565f1c392c8548ae", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776367, "uuid": "98d9ec5f-bcb5-43b1-9da9-5809edc046db", "comment": "Malware payload", "value": "3104270de7c65739c343bfbab73358607c2b4cf6", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776367, "uuid": "9cb6380c-d56f-4a22-b9b5-61cd9ac82c02", "comment": "Malware payload", "value": "7dfd71b6cfb7b778a32bb2ac0d5528177722c8b90069cdbdd047b5b859eff808b00b4e9818cb8405b4944b278d66dbbd", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781776367, "uuid": "244020c8-70bf-4509-add5-a6372846e39e", "value": "T14C016BC68600A9005029DA5E639772A0B830C3CE565A4FACBFDC5D3EFB9C918F027F94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781776367, "uuid": "e5ba7d1d-4612-46d1-951a-966edb0b046b", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkahXC1GqBHhj1CRCCS2sU8CrAJ7zs4CWdw7:kXCKysE2hi0ziQvZohahX29JIA1lC7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781776367, "uuid": "6bda3535-b900-4fae-b054-129a335c5d30", "value": 839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781776367, "uuid": "f5f3a806-ce6f-4bdc-8603-8218896f058e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781776367, "uuid": "65cb33bc-5d73-4c57-ac8a-6612c39600fc", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6b90e78-6b25-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781794595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781794595, "uuid": "a9cbd916-9ec8-49b1-8a7b-42fe46267de3", "comment": "Malware payload (Mirai)", "value": "33d9f003478a6a709ac566f6c5a4acaa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781794595, "uuid": "616384c4-4dbe-4b3e-abfc-4be29ebe2b78", "comment": "Malware payload (Mirai)", "value": "8810390a205fbfeb1bb10f45f591f8167e52a42cbe78720454190c9b150db322", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781794595, "uuid": "3ccd5fab-6e18-4e97-bf45-51f84857d092", "comment": "Malware payload (Mirai)", "value": "48e52e2598ed264143847b94d68cc5a0e999a317", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781794595, "uuid": "8b78dcbc-932f-4260-9bb8-041fbc17bba4", "comment": "Malware payload (Mirai)", "value": "48ba04826ede083eaac4d783613b4d536e7b7a1bd42749b00206fbfd950c1dc8b4ef10344a47f4bd4ffd4578f4472bd5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781794595, "uuid": "5b8b5a5d-e665-4cc9-b282-d952bfa19a58", "value": "T1309301E9E0A53CDECD5D5EB8E60EA3C1CE21729623941749A7362D88C9A9918F81CC64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781794595, "uuid": "6e60bfb5-e7f6-4668-95ff-899a7048a526", "value": "1536:/CrWdqQbiXRM/zKwx3j0mcnVgeMGuHWw2szuSGmf2YvkQ2GDn7a2VY8WiL:/CaIm+RMbKG3QVnsv1Bf25Q2ukq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781794595, "uuid": "2ee3d814-a006-4334-935d-23d454e5deed", "value": 90532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781794595, "uuid": "b9fc3250-544c-458f-a349-621f0d9ab105", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781794595, "uuid": "d842c328-9273-4f99-8d54-1f745e450cc4", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2779f33c-6b34-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781800716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781800716, "uuid": "c74d6b18-0b03-4d7a-a230-12fdc0b8e5c6", "comment": "Malware payload", "value": "550090ef555e3f344dc67c3220ec83e6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781800716, "uuid": "233af009-5ca6-4486-b22c-4ea7aeb3fc16", "comment": "Malware payload", "value": "8865c3cb087dbae88d4b21a95cebb2309135a9b1690fcf6f0df2cb90b3137e0a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781800716, "uuid": "32fc4d57-d320-4694-8fcc-edf062753f44", "comment": "Malware payload", "value": "1a2ce725a526b1225df250b0e0eb238b41491cf9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781800716, "uuid": "9a13aab8-e2bd-4df3-aed2-9a006b98b2f2", "comment": "Malware payload", "value": "7e6972d8a0048ccac5f8b0bb89b83f6c43633c55ba6803176bd57e43e7a5ff6b11d61a72adb5d5bda469c8d3a8358b2a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781800716, "uuid": "8d65529b-d617-4984-a404-9fdcfd31b6bb", "value": "T14D932845E393E5F1D80705B001ABF77A4930FD331624D96ADBA4FFE2AE315C2A196329", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781800716, "uuid": "f033e7c3-fb2a-41db-b5a4-dbd760c0d917", "value": "1536:NJaUfdQD/bb2sZcmI3eQYmUi3100x7u/o1rOgLMRLrI:NJNYn22bIL6kp4g49", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781800716, "uuid": "785e9ea6-fc87-46a3-8d2e-7cea9564c977", "value": 90476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781800716, "uuid": "25b0abc5-3ed5-4c2c-b6f2-5ed6cf73d2e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781800716, "uuid": "d164b080-610e-4b9a-89fa-a859014c769e", "value": "manji.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7558a92f-6ade-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781763910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781763910, "uuid": "18a41343-0561-45d2-8de6-3676216cec32", "comment": "Malware payload", "value": "714c022cae384f441ffd0baf20394a34", "object_relation": "md5", "Tag": [ { "name": "2-27-62-123", "colour": "#EE0D0B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781763910, "uuid": "2aa3016d-597f-4168-8f3d-9ed2893b7796", "comment": "Malware payload", "value": "8873cd6356affd9f508a019131541942830933c1b48d1c010438c31324a8ad94", "object_relation": "sha256", "Tag": [ { "name": "2-27-62-123", "colour": "#EE0D0B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781763910, "uuid": "36abf045-e639-4226-b947-a23882304914", "comment": "Malware payload", "value": "8a9e6ae0db8f4ad451ec9121146b2a52845a89b8", "object_relation": "sha1", "Tag": [ { "name": "2-27-62-123", "colour": "#EE0D0B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781763910, "uuid": "18dd530d-0170-4435-bb7c-63ecc5605ab7", "comment": "Malware payload", "value": "9ccca2716d37e314e1f8f1c3961f81084d33a3d9e0133274ddb25cf8cb14527dce66bf0370ea40fafb1d3df74faa8856", "object_relation": "sha3-384", "Tag": [ { "name": "2-27-62-123", "colour": "#EE0D0B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781763910, "uuid": "29907591-ee65-4ccb-80e9-4a7b74c199ca", "value": "T170638D4EBBC95635E2AF8B7AE83206064272E1476F13D38E5CC5406A0F767C48B597F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781763910, "uuid": "97d7846e-8ea3-4faf-8c86-71d8df14fdb9", "value": "1536:4EinDnoGPFAUyk8v75zlC/GPCISUs4iAiELYXVZNge0jwD+N:47nsGPFD98v76/GClUs4NIXOeOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781763910, "uuid": "896df547-2c82-483b-a371-2d21a7edf43a", "value": 69632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781763910, "uuid": "84db6235-dcf0-4ad8-a5c7-a0b18b5d952c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781763910, "uuid": "13999003-03ef-4963-833b-2ce87ccb5e1e", "value": "8873cd6356affd9f508a019131541942830933c1b48d1c010438c31324a8ad94", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a44d2de5-6ad9-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1781761842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781761842, "uuid": "e8b30b97-2602-4dee-ae9c-ddf5d3959e0e", "comment": "Malware payload (MassLogger)", "value": "c5f4f8f1250ce774c106a531d4166ebd", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781761842, "uuid": "b18b9835-bf26-4a81-8cb8-d5c2bc3158c2", "comment": "Malware payload (MassLogger)", "value": "89db717a676cfc03ee69c3506ee808145d644bfc6149b87edfe742c4e18ad487", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781761842, "uuid": "1e266346-985c-4a8b-a0be-4224bed25f57", "comment": "Malware payload (MassLogger)", "value": "0df6429bd26afb4ad2746d7f450d51423b7bb9a4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781761842, "uuid": "53c0c676-2518-43cd-8312-0cf9a5bf6843", "comment": "Malware payload (MassLogger)", "value": "90caa466406cbfd5466cef9433f216364b171f3c8ac28f30b10400ecdb64d96cb2ce791faebe768f03b252a209371f56", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781761842, "uuid": "ccdca2be-d7ed-43dd-bed6-f5a38f1cc354", "value": "T1B716D53CCD58413EEAB2D918C8D9491FF4922597222DD94B90CB2F5F5E23983B7D221E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781761842, "uuid": "a7ca1540-4370-4db5-b63b-be9af8e7b25b", "value": "3072:OSrFoSuU4OOGdQpNBh6BE8oIlV30HRkTCzVAp4E9wS0XqlYdq0eVy4knx+ek938/:ROGOzxkQS0OH3SnviuH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781761842, "uuid": "eeeeb3ea-d7a2-4c9e-9624-677baee78824", "value": 4029550, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781761842, "uuid": "03318b68-9ec6-43b2-852a-4959f8b57e66", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781761842, "uuid": "942287ab-b8d6-4026-b394-f63d3ff2e315", "value": "Nueva orden de compra.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "761fb796-6ae6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781767348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767348, "uuid": "9ae4593a-a0c5-47a3-848f-e2d6ba59d661", "comment": "Malware payload (Mirai)", "value": "da20f662d23564d14fc0001d023bc9c5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767348, "uuid": "18ca93be-1178-4b21-929f-e819d49a209c", "comment": "Malware payload (Mirai)", "value": "8a313129d6f317cc71d212d75e556c2695c2bf97cf6a3eb6c295b9c1c16ffc75", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767348, "uuid": "be5c7638-615c-4946-8f2d-50b024ffd8a7", "comment": "Malware payload (Mirai)", "value": "a5f8dddff2aa5de5211dbaf8c12a7e093f68f4dc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767348, "uuid": "d4b26d0d-1828-4001-bf52-7b9e5e286959", "comment": "Malware payload (Mirai)", "value": "0bc67423a82a77919a61aa77925f873c1510818a2c589ac4a6b4ee912f94f0f59fdd5036710d25a9eea7b63e462e613b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767348, "uuid": "1c1e2664-8938-4dc9-8dc5-9b1d25ea2de6", "value": "T1AF6164B4147BC2702C964E5362F93BCC7DF562892AC97F1949C4E4EA948FE03ADC1E91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767348, "uuid": "282d1e37-9c88-47ac-a147-e61a578c5ff3", "value": "48:vEIxEbucEotowEUegUenVEU8UjwEUfU2BEU6UROEBHE07EaxExfEFnEiC:v9S5SWV87+qJfQmU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781767348, "uuid": "b4de8ef7-0b10-4e82-9345-bdc2c65c7686", "value": 3361, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781767348, "uuid": "435498c7-f69c-47a2-9070-74111280f5a3", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767348, "uuid": "a3786d26-24c9-48d8-9ea9-5d64e4ccb3f1", "value": "hiroz3x.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e7ba909-6b01-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1781778770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781778770, "uuid": "23d4917b-4052-4c42-9a46-088f38259e98", "comment": "Malware payload (PureHVNC)", "value": "5392eb608fc713327511e473980d0a98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781778770, "uuid": "ffa3bd62-b92b-4550-aff2-170da3da707d", "comment": "Malware payload (PureHVNC)", "value": "8a64ab77db431685a3c90321753643ab07ebc3908378d43e192756e0bc07620b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781778770, "uuid": "b0d5c1c9-f42b-4436-ac09-6f14ccb2e437", "comment": "Malware payload (PureHVNC)", "value": "7f63d9fffe7737c61c47fd6b68dabe8c1ee42b71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781778770, "uuid": "4d8fedb7-a471-4496-a5c3-3f27b2735c15", "comment": "Malware payload (PureHVNC)", "value": "897dfd591cadf01dca6c7b5125cff60d476b09d81cd567a4c04f9f3fe989327e079a5b275c36f18657fa0b04278b046f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781778770, "uuid": "974a38b6-cab4-446d-bbf5-de8e32168931", "value": "T105F4BF1B7696CF12D2841232C1DB120193F1658BB677E70EB98513966D033FAEE8B793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781778770, "uuid": "2fcca513-f1cc-4ea8-b028-26d4f9d06e8e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781778770, "uuid": "8777523f-7f00-4f15-b62c-d49b5615bfa2", "value": "12288:OB9FDV4WLiYiFOtX/qUAcVgbRpmzSKP/yqxvsUshs7WqgiDRCG4d:8DV4WiYTClsGiyqxvsuoG4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781778770, "uuid": "2fec8e96-5ff2-4776-b71c-a50c6bf8f912", "value": 784896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781778770, "uuid": "27450bc7-71bf-474f-bdcf-4be86ed83cf2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781778770, "uuid": "db4df834-432f-40a6-90a4-f24cf5fccd6a", "value": "SecuriteInfo.com.Heur.MSIL.Benin.5.86195816", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7515131-6ae8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781768423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768423, "uuid": "245b0ac1-9e56-408b-bcc4-5aeb59cc144b", "comment": "Malware payload", "value": "6821cd8f80c0cb9f4c38a8d4b14fb11d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768423, "uuid": "751b74b7-e60d-4502-a6c5-4ed99aa4e053", "comment": "Malware payload", "value": "8b1e618bd25e706963289818a580abc81cf15be89696c5f519e2a2e8ca348161", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768423, "uuid": "d551d853-29f8-453c-9291-5674e4ea5271", "comment": "Malware payload", "value": "08cbe9fd54818081513f3a640eda3b3e95d55b0e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768423, "uuid": "0092a2da-b870-4bb4-83e2-0cbe05600777", "comment": "Malware payload", "value": "ab08d79e70fd95f3276c8ab56ece2d93f2d29d1ac11b2aaf13eab16addff1d4fb886a37a96cd83877d8995f74be71bf0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781768423, "uuid": "00b0f570-b0ab-4f19-a0bf-e1d3b3e7b1ec", "value": "T11B3190CB14292F391212CFDE73A3354DB00C96EB2D9BC795DC480EAA85884CCB162BD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781768423, "uuid": "016d5eda-e6f5-4e0b-ac87-1979ef9d2c7e", "value": "24:PUNs8Q388QII8KClep3a30Xh5BmwsEGd2:d8y8rRtCe3a30Xhjmw5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781768423, "uuid": "145989fb-bb7a-46dd-b604-2a7e557ce8a1", "value": 1584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781768423, "uuid": "7e7fb414-33ff-4e1f-87aa-0afcbbb1e854", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781768423, "uuid": "14838eef-e75c-49d1-95d6-81317a008045", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3516ecfa-6b58-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781816201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781816201, "uuid": "74d2ebcc-e002-49c1-9a1f-354a3c691677", "comment": "Malware payload (Mirai)", "value": "2c52aa4a786741b18383bd740ae61a6e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781816201, "uuid": "3aa7eb26-e026-48d2-9a62-c5757d150b6e", "comment": "Malware payload (Mirai)", "value": "8b818a26156080447becd53da5370ecd9e673642356c271fe79ccf9228056d83", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781816201, "uuid": "40ae3a11-7464-44a6-8961-77f3c7cf54f7", "comment": "Malware payload (Mirai)", "value": "15eca7b118d8a69a9facf7b9f8e261c920e0e932", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781816201, "uuid": "fd3582b4-361d-4fb8-9c70-0474103e1aac", "comment": "Malware payload (Mirai)", "value": "c003e928c010ba5c1a8b2f1c502e8bb7af98c994112444a1d7071fa6b937931ff480107b03fab0a5e35d01103b8aad68", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781816201, "uuid": "29509f3c-28d1-4aba-a47b-26eeef987f80", "value": "T14D83123531A31700C973D77B919C4AACF95ADAAF01AE74FD40242635EEE718136F22C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781816201, "uuid": "fbc875de-e0c8-4748-a4b9-bf624181b8ee", "value": "1536:65NMeubL46W32WtobsyaJWBjiA25SCBJXJI62iykahZv3jFLu:6zMeqbW32NQXUAn5SeZ5yk+v3jFLu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781816201, "uuid": "9a3f156c-bc02-452e-90da-cbcdbd1a0d6c", "value": 85564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781816201, "uuid": "203b8aa3-a335-4a23-a3e5-71140d0192fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781816201, "uuid": "04cc61d8-eb4f-4278-b6ec-347b143e7061", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14d6d2ea-6afb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781776204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776204, "uuid": "43a0dab1-b1f1-49e8-b4ff-2c2905f23de7", "comment": "Malware payload (Mirai)", "value": "2a44b02258e2d12cd71472336a8ecd40", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776204, "uuid": "e98d9f62-49bd-40b6-ab2b-5ca93e08288f", "comment": "Malware payload (Mirai)", "value": "8bcba5a8ecce0553422e60da966f0d8a160b53eb3fd2dc451901d90be4197eb7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776204, "uuid": "63f4b1b8-2274-473b-81d3-c1b3c4b7c975", "comment": "Malware payload (Mirai)", "value": "29aafce9fdc7fae5f4550ff047a14b2d9375b5ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776204, "uuid": "2cbb897f-7e3a-45a5-a642-e760e649af93", "comment": "Malware payload (Mirai)", "value": "d790fd71ce49c1853c6ad85c48fd8534c6e2137541dd11e2da1123c9b166857a0add47994d39700045e7d5044b45b748", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781776204, "uuid": "50bb7f9e-b767-4bb9-a90b-d592cca35a63", "value": "T135B33A02B5D194FDC1EAC434876FE427DA31789802313A6F7B88BE312E75E71275EA51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781776204, "uuid": "bf4ff615-b8b5-4a21-b2be-e30ab91fe460", "value": "1536:E/8ed9yzxATsTKGYQwEGBPZKI4J+k5//AswXJf1ylYGYr9Z9kX+Urr:ETCzAVPZb4KscsYGYr9Z9k7r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781776204, "uuid": "a460869b-240d-4e2a-9fa6-7e9b0a77a6bb", "value": 116032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781776204, "uuid": "a2d1b768-3fc3-4378-9309-f6709646d8b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781776204, "uuid": "e76b8100-2911-49f6-bc7e-84b197e4a701", "value": "monero.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77a14b26-6ae6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781767350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767350, "uuid": "a5a9d41b-0bda-42bb-a914-1e47d271bdc7", "comment": "Malware payload (Mirai)", "value": "5f5415f80fb5d3680476835c09741289", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767350, "uuid": "aea49205-3865-4f26-aa9a-b6bc0ffc9862", "comment": "Malware payload (Mirai)", "value": "8c63d6c97d5a3032a173efb8852ca19726c0dcddf7134417c440e73452539964", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767350, "uuid": "9190b0d5-a850-4513-9a93-dc3a18f3797d", "comment": "Malware payload (Mirai)", "value": "34ca6d0a3726a18eebaf16cc4204f19b2be4cd48", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767350, "uuid": "90cf337e-cc2f-4093-8cd9-91290fb070f8", "comment": "Malware payload (Mirai)", "value": "d817571e3d8e7b9cc9547aefccf07c4c8a1a560949e8a7eb3b655c34e2625fce3e3f38df88d1d1b2ba2d25a43b113792", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767350, "uuid": "119fea45-a504-477a-9797-c7eaf269b6e4", "value": "T18FE2E1FD87334A47EA27A0B953200BC146394F9AC573AC6B9460E64AC31927EF452FD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767350, "uuid": "5e62b58f-72a9-4f5d-8e16-3f12d3d0e749", "value": "768:H0hVhkXYjjqakI8Vux/h1QnBQC2l5P+v5JgGlzDpUYsZ:HShkXs2ch1QnBQMVqYO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781767350, "uuid": "2b0a2cf2-5db0-4615-a98f-edb7a18da581", "value": 33272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781767350, "uuid": "d1590876-5c14-43aa-b9fe-f3f1111965ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767350, "uuid": "d277d5ab-26aa-4563-a560-5280c450ebb3", "value": "h0r0zx00x.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba298982-6b51-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781813418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781813418, "uuid": "48f2ed29-7433-4ffa-9e4a-b00c2b995311", "comment": "Malware payload", "value": "890344d81bf4a616891e1423de46be6e", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781813418, "uuid": "a931814a-da81-41fa-88ba-28cda6c8653d", "comment": "Malware payload", "value": "8cd675930a7d61f4444c1ff94334b93e8d5b855de644f7b58c597aed46fbadce", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781813418, "uuid": "e0a6cc8d-3281-4a26-9b98-e77a55457753", "comment": "Malware payload", "value": "bb3f56c09030451f34ad7595903c96c3c9098c41", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781813418, "uuid": "7505690c-e384-4995-af6e-2c09592b91b8", "comment": "Malware payload", "value": "5fbc7a5c4cf109a693a0aabfedfe3f2cc2d88d83a2896e7254ce89bde24c37cc2717bf0bd913baf73ea1dc5fb1ea6ee3", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781813418, "uuid": "65588f7d-4699-47d6-a112-c9b00c5656ee", "value": "T11FF57C43ADA208EAC49DA3318DB25685B77ABC051B3227D73E60B3386E7B7D45C74358", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781813418, "uuid": "c40f6019-9748-4d15-93bb-3bb6ed52625d", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781813418, "uuid": "01b81369-c4a5-4bd0-abc4-6eb246bfc364", "value": "49152:lbAn1xJI7/MD46fwsDw8tARTcPRxiT4CWpqbYP2kj9NgH8Euw1L6gUwYEPeTGNLu:lOCMDtwVwEJOF27lbEiLdg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781813418, "uuid": "0a037499-841c-4eb8-96bc-532e88c80fe9", "value": 3339120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781813418, "uuid": "53caee62-decf-49a2-b48c-5d4f8430802b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781813418, "uuid": "0c02932f-be0b-4767-bc0c-b584be180e7f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f5f2848-6b56-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781815359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781815359, "uuid": "31128e32-f63d-42e4-a65c-4f8435e2c6c7", "comment": "Malware payload", "value": "e131f9b9fc8b139cf6a1a8e3da5b7ea3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781815359, "uuid": "190f1072-c251-4a94-8876-994427710ec3", "comment": "Malware payload", "value": "8f68e46bf8e963a293e48e96978ccf606b2043d775219e31f7b332f761f8aa7f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781815359, "uuid": "edda8a81-f4ea-4a7e-b437-039a17d3fa97", "comment": "Malware payload", "value": "1cd7edef0108388b57b13a732487536fd4c86d51", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781815359, "uuid": "e1c1db4c-cd6a-4220-ac41-6ec4fadade75", "comment": "Malware payload", "value": "aba8c4fb78119ca879d63f5c9fdc4bdb7e574f9fee1b2fc8e1659b94f9cf9a7a1df6b77339d26f8ef80afcae898449f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781815359, "uuid": "c04a472d-ec40-4c03-a412-e73d21bf5930", "value": "T15CE32A45FC509B27C6D7227BFB4E428D372A1769E3EE320389255F21378A95B0E77242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781815359, "uuid": "db6d5d86-a370-4291-8d19-e705d89217f5", "value": "1536:JlvuP0vT3Xf2Sib+PkfW5rUjrlqABgJgADOF4TOgeBq6frOrIGCMHT54l5tAwyw/:LI0Lf2SJkvlqeAs4veB/9Gfz8YHEx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781815359, "uuid": "2002f3b5-2c28-4482-8acc-b97a6c93d274", "value": 150240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781815359, "uuid": "66d19b03-a519-4abd-b375-34f9954e1879", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781815359, "uuid": "078bcde0-6d7b-40e8-a622-c24903bdd14d", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "740c6e11-6ae8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781768203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768203, "uuid": "cd19ecb0-ed70-4b42-a0c6-c6a09d868a9f", "comment": "Malware payload (Mirai)", "value": "c74e3b9787e64c68c3f9d77c89b6c257", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768203, "uuid": "dcde7e51-eb3e-4b3f-a203-9ad859c53fbc", "comment": "Malware payload (Mirai)", "value": "901e22130bd963779d5d0b4b4a2e82cd2eec713049da8a1ff0ed68b18e4f59c4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768203, "uuid": "355a1c55-b50d-489a-87c7-b8832aad6e53", "comment": "Malware payload (Mirai)", "value": "86a7feaeca0981d98b38d95ae58675808e746ce1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768203, "uuid": "e0c1a92a-3ebe-4c7b-88b8-0301785bd110", "comment": "Malware payload (Mirai)", "value": "b95b77672677aacb7225c99966bec9ac70c1473e879ff553817dea0afaad62828947798a9a7b2502b39a5a4fe8351075", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781768203, "uuid": "8c916749-bc38-4ad5-a506-100dc594a359", "value": "T1CBC4D0C767023E3DE0BF5A3AC9910F166B36A3950583771F6078F95AA82317D2F22647", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781768203, "uuid": "af0767a9-b651-4934-9c87-fecdc4bd6fe9", "value": "12288:r+qjwT+xJ/ZQD7g/yBbxkdrIo3K0cMNTSKAhVBQa:rBw6xVe7g/ab8shlV5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781768203, "uuid": "c03224ff-8664-4012-99fe-7ee5db3fd9df", "value": 566816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781768203, "uuid": "43dc5f7d-dc17-4b6d-b4ef-ad7cc834efbd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781768203, "uuid": "ef72663c-a48b-4abe-ab46-332c7fcc39e3", "value": "kaizen.m68k_srv", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eebee9bb-6b25-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781794608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781794608, "uuid": "498e2ab9-90f9-4e9b-9385-f72c951a75e4", "comment": "Malware payload (Mirai)", "value": "9fcf9d931e0041003e885c7d335026e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781794608, "uuid": "36ffbe69-490e-4f4d-a1bb-294d35907b6f", "comment": "Malware payload (Mirai)", "value": "913a78b17429e05f183596d1646496b9ae4391327544eec8005e5823520e52d9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781794608, "uuid": "88db6646-e84c-4c4f-8a04-9c67ad12f899", "comment": "Malware payload (Mirai)", "value": "b406a10d8f98c9b0363326fcffc23dec40538d85", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781794608, "uuid": "e995cfa5-59d8-4735-99d2-38e05479fe12", "comment": "Malware payload (Mirai)", "value": "f8d8e060ea78a91c334e58a14dfd98c2638851bc37615164be6f1b35385c530cda94ba38364ac4b41959775f5908d60e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781794608, "uuid": "bbdfbff2-8df9-42ca-8d6d-90b79e57652b", "value": "T1A154F80AAB610FFBE8AFCE3752E90B05258C545712A87F3A7174D918F54B68F06D3878", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781794608, "uuid": "845618ff-9468-42be-8bbf-a1b9bb0ea721", "value": "3072:yvNRsR3XvCR3ddgG07xJkrqtvJxa77U6BkEFfksEIwWFbaEvsA:2WZafdgz7xDtvu4+kEFZiYbaLA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781794608, "uuid": "ad488d20-2744-4483-99e2-86dbd8750b7a", "value": 282432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781794608, "uuid": "618e028f-8c34-4ff4-9001-a52c88ba9401", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781794608, "uuid": "8fcf53c5-07d9-4000-bd92-0774122ccc60", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1cc1011-6aed-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781770535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781770535, "uuid": "029432c4-b4b0-4512-a243-d68945b9caac", "comment": "Malware payload", "value": "66ad9867c7fc194c82795ff08b8ff2c5", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781770535, "uuid": "c0b18258-b938-49ba-ba39-a102beac8b57", "comment": "Malware payload", "value": "91896c01b2749a736056c313bb852dad081180b01914e1cda575a644daa8238c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781770535, "uuid": "19160006-04c5-43d1-9f9c-1771a645831f", "comment": "Malware payload", "value": "d129f5f6832ada8a230319a4c603389c47aa28c0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781770535, "uuid": "6215ee42-4cb7-40c9-b6ab-6ad19b08faa3", "comment": "Malware payload", "value": "ec23aa915f1152229b4bfcf48973b40a554488474c328733eaa36ab990b7aeac9259c3750f07b03ba3864ed5ce25d293", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781770535, "uuid": "ed94bef0-71d4-42a2-85e8-b374d94bbe4e", "value": "T16FD097A381B30278E4D24826F0C27610B4019B7FAC0A8A1CBF2738701F05B05F0C07C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781770535, "uuid": "81c21f9f-944e-42db-81df-6818c0d7f7be", "value": "6:hTmtLgvm8GmlPScaFpAulNXYq9DG+NjVsNXYrkJ:VmtpNcwPiq9DGmKi2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781770535, "uuid": "89515835-d3f9-4367-b578-44fbf2c31e2d", "value": 266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781770535, "uuid": "98c08d13-5200-467e-aad9-352b31848d37", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781770535, "uuid": "6ed59528-6940-458a-9ff9-e06d7a68c140", "value": "WSW0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68619d01-6ade-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1781763889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781763889, "uuid": "72196cc5-581f-4b4e-bca9-2a0d544781ba", "comment": "Malware payload (PureHVNC)", "value": "b33d31f35b3b00c42bde0cddc3d9e9ff", "object_relation": "md5", "Tag": [ { "name": "2-27-62-123", "colour": "#EE0D0B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781763889, "uuid": "02e6367f-0bbc-4aa9-8b92-a29033fc1d31", "comment": "Malware payload (PureHVNC)", "value": "9397a6b35f338094bffdf6c6ff44b95f095c35fd405902d10e72380b3dfaea44", "object_relation": "sha256", "Tag": [ { "name": "2-27-62-123", "colour": "#EE0D0B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781763889, "uuid": "fddfd83b-e498-4cdd-a0d2-20314cfbc898", "comment": "Malware payload (PureHVNC)", "value": "132f30ef40ad0b44ec94a16ebf50693f5bc085e2", "object_relation": "sha1", "Tag": [ { "name": "2-27-62-123", "colour": "#EE0D0B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781763889, "uuid": "7b8a0978-e860-4b5a-bbf3-3b84709ed3db", "comment": "Malware payload (PureHVNC)", "value": "48d1686ce3df380dda847c940b1b1648990cba01b798b864a4ee02cd1c9f2196afaba523cd15e47810a439e432d931ba", "object_relation": "sha3-384", "Tag": [ { "name": "2-27-62-123", "colour": "#EE0D0B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781763889, "uuid": "5262b847-19b1-4d48-9650-51efbc3f6e69", "value": "T105D4AE3672574E21D3985733D48B9D0083B4AA85B1A7F71F798413A2250A3FADF4B2E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781763889, "uuid": "704c4b53-d720-437c-9a16-45d5c21ae452", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781763889, "uuid": "3ffcb976-d437-452c-ac69-d0b76bc449a8", "value": "12288:kLURt3k1+fKMea88uk7PXnY5K8LfSFzrfbiD5ok3eWJ:kIRt3k1+fOamcv6tSFuCk3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781763889, "uuid": "132ea3e5-39e6-4e60-9dc9-8f78ed8cc01a", "value": 637440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781763889, "uuid": "f3d1bb92-cd35-4d71-9eae-1bf9ab70295c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781763889, "uuid": "6aa3a6ec-8a88-423e-8220-9fb0510a7486", "value": "9397a6b35f338094bffdf6c6ff44b95f095c35fd405902d10e72380b3dfaea44", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e17ccf65-6b5b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781817779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781817779, "uuid": "7203f1d7-6e49-483b-af26-79ca286ac82f", "comment": "Malware payload", "value": "a6996f1dab6468c12d20e78c6e96fb79", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781817779, "uuid": "e884d629-dc23-4461-ac0a-66c367ddb046", "comment": "Malware payload", "value": "9410c3cc736efec4335145fec5f69e17accb5931c384675744dc84d66410397c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781817779, "uuid": "484eb676-5c7b-4e41-970a-62c9c9350a95", "comment": "Malware payload", "value": "0988b65b273f5b3ea1eac5f3231c4e47d1e253bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781817779, "uuid": "e72b60d9-81b5-4f7a-80a6-a3cfa813e6b2", "comment": "Malware payload", "value": "20f4b33eb0a74af5ec83184d7e975769348f2eb909f02b7408c2b1045e6ce14323c32b9577834d8a454e11957eef45ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781817779, "uuid": "779f6de4-c765-4c40-869e-2384a35b98db", "value": "T1A5D08081C152D143C07C5D3574045F6E1B15C13780901F2623D56BCD8CEA5540E31B19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781817779, "uuid": "489101ca-a109-4021-9069-3776ba211105", "value": "3:Bkkk/tMlwXll/O/slrCs4X1lFrSwfjjNlPmM8IPNioOHyUvwGcVhVflgLfE2:Btk/tMl//E2s45leKQXSEwhVDlOfE2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781817779, "uuid": "04fc5d3d-7119-4555-8d1c-353dc6cf3037", "value": 207, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781817779, "uuid": "af2e7e38-d215-4190-9f5d-d56dec1b3ec9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781817779, "uuid": "bc1c8044-da85-4272-8253-7b8ca5a1f4e9", "value": "49.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa89eda4-6ae4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781766577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766577, "uuid": "927f9cdb-355c-43b1-87e5-d06009468158", "comment": "Malware payload (Mirai)", "value": "33f952f57faa2a04dc979ce031dc4504", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766577, "uuid": "101725c5-f2a1-485e-a43a-3da2be4beb54", "comment": "Malware payload (Mirai)", "value": "946a01b5522140cba3fcc42c39e73d11dfde9544725be9644c175a2a8f170d9b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766577, "uuid": "e87cbf65-357c-4446-8fdd-bf6c55234a07", "comment": "Malware payload (Mirai)", "value": "51b013b97f3738207a37dd877f68b622b1ff7776", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766577, "uuid": "97dd3f67-32a5-4425-abc3-7051e589e353", "comment": "Malware payload (Mirai)", "value": "e7145b8e22fa715a6602d62c30f622f9dba9c127f305cbc1486951fd5d54ee96ecbf1962ee4dc6285de4ffe7f05d72fc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781766577, "uuid": "68d03cb4-d681-45d1-ba73-104b48ace7ce", "value": "T163041845F851CE13C6C612BBFF5D828D372667A8D2EA3203BD255F2C378695E0E3A542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781766577, "uuid": "6273a825-cc49-4779-8f20-58733b36df2d", "value": "3072:WymGp7NeCdVTRocEJYBJ3y41uhqtA7Uanu5Slu:WyxzKC7i41CqtAg+u5Sl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781766577, "uuid": "ac4d7545-a3ea-416f-9458-804af9657144", "value": 175936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781766577, "uuid": "55cbe257-ac83-4ee1-80d3-50da22e71faa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781766577, "uuid": "35c4ca08-3f27-4abc-be90-4e67649572b3", "value": "onie_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a927d6d2-6afa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781776023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776023, "uuid": "db9dd38f-cf48-46b8-a3b1-15260ab22cff", "comment": "Malware payload (Mirai)", "value": "a4bd4a964888752d5150edac754257d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776023, "uuid": "08a252d8-0341-4782-9218-08902a9422dd", "comment": "Malware payload (Mirai)", "value": "963f3ab6b8c1943e52cd5c4c4f525ae09bfae80ce0dbcc5d853240fa78d8858d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776023, "uuid": "72ceb319-e616-469d-8d31-bd78b5f690ea", "comment": "Malware payload (Mirai)", "value": "f1baef72fed11fdec830878e62fc00acd4d61ac8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776023, "uuid": "e334d09d-cb34-4c11-b33d-425c005a9e60", "comment": "Malware payload (Mirai)", "value": "b1b74875829b4014646482ac329530141bc0dff6625a5f28b01f1af810ffce6f423bac2d9677bdaffaf30312bfc08640", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781776023, "uuid": "ae1bb9c8-a0f1-4b6e-a9b4-b643e78bd3f8", "value": "T19E4302EE7E8EE0FFEDB8563E207553DA9466994130BD020C507610640BE7CF296BE365", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781776023, "uuid": "eb9d6330-d43c-4937-8f2c-439c83db9c3f", "value": "1536:4e/uxdmRGkULpukDkuRup9hxiZ+0EB61wQHuf9O:PrR1ULkUkuRuLhkDpO9O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781776023, "uuid": "16696a59-fecf-4f11-b81e-0ec0078a0df3", "value": 60204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781776023, "uuid": "7967cda2-6e06-4715-9ad7-0001ad4a6fe8", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781776023, "uuid": "d6409133-f118-4899-b944-22eb524a41d0", "value": "monero.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0fba27e-6af6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781774426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781774426, "uuid": "eed289e2-a4b9-4b47-8438-dd73de764c14", "comment": "Malware payload (Mirai)", "value": "ceb55e44792cf44199ea2736a40b74c0", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781774426, "uuid": "45328085-4554-4a90-a07b-c5d4ec77425b", "comment": "Malware payload (Mirai)", "value": "96a8433d7aea4545074f17727439e3c46231b4d36b69c763043972a09e870856", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781774426, "uuid": "4655773f-0f11-4eef-82f9-b2cca69b79d0", "comment": "Malware payload (Mirai)", "value": "071ea9358b9197baecfec85df9eadb38aa0675f0", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781774426, "uuid": "f2381211-5c1a-4c0e-9e02-dba972823e72", "comment": "Malware payload (Mirai)", "value": "63c1b8cce71dfc0e51b384b739a44593a831a54052a5671d252ccb3e3552fa36dfd26b021ef3d689e04ddd7972422ede", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781774426, "uuid": "60e6b289-fbd5-4557-a0f9-222f682f9af4", "value": "T1B7762751FE8B50F6E9030D3105ABB22F63325D064F29EBE3EA407F29F97B6911936149", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781774426, "uuid": "88620a58-0989-477d-a40b-c3958e5b713b", "value": "49152:HTZXXp+A9M8E2yxWaMYyGF2ul3Db/JOZ7WjHSWJXJsw21xAfwj17WUXWEcmCLpHr:zx5+KMxDMYyQhOVwH15sjvhjiEc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781774426, "uuid": "0affc862-69c7-45da-9507-5346a9eaf27d", "value": 7278776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781774426, "uuid": "13d748f7-567b-4065-8abd-e811433862fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781774426, "uuid": "ab6ff4bb-1f03-495f-9e99-9b7574c62673", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dad39679-6afb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781776536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776536, "uuid": "a01b2c59-c358-4d97-94fe-b4f957b224a6", "comment": "Malware payload (Mirai)", "value": "3a3822fc92c8e16a67691e16d5bc3313", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776536, "uuid": "d99a5a88-3216-4d44-89ad-6b4f1be16689", "comment": "Malware payload (Mirai)", "value": "96c6c63bb5e198fe4e43749676261fcaaca39df5a8e6e6e31f311f790513b761", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776536, "uuid": "dbf1d6a3-f255-4cd6-973c-61176b5def53", "comment": "Malware payload (Mirai)", "value": "7fb88da04d03a25c0c337e0f4267bc776d489df7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776536, "uuid": "9b484735-7498-4364-900d-a02d59b22c81", "comment": "Malware payload (Mirai)", "value": "b0cfa95b19213abdb9b72e64053df1695fcc2f8e4fe8dd5269fbadc749d852ab30fbd359ccb16b75879c593c6c43dc1d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781776536, "uuid": "bd3e1d5d-062a-4535-9ce9-afb2db54857c", "value": "T14773F104006B6DA3D97181B0FD0983C63C8B1E61E6DFB2B9B1245D6AD6EC94EA1F47E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781776536, "uuid": "817afded-cdc5-475f-8bdc-63b0a3a60d39", "value": "1536:jx1AJjdXf0ZzH9d9mAkvhtPDa0SW+kCq1Z9LLz4mONC7sCBzb:g1o0DlbTH7s4P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781776536, "uuid": "65353604-b85b-40bc-93ef-63a52c881e91", "value": 80168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781776536, "uuid": "06458fd3-bab9-4ace-9e56-b93af038a8b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781776536, "uuid": "6a00f325-2162-4e1a-ad9f-81321ac8d718", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9df7fd80-6af6-11f1-a769-42010a9c0008", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1781774286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781774286, "uuid": "b7fdca50-b7ff-4b8a-a562-bfa038ec49bf", "comment": "Malware payload (PureLogsStealer)", "value": "f4e4775f452428132bb180f225997a74", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781774286, "uuid": "96a90e38-1625-418e-9127-ee910af160a1", "comment": "Malware payload (PureLogsStealer)", "value": "977447b2af9c39331061de905157743c7743a434b3f661afc6c85ca1c7b77582", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781774286, "uuid": "0ec8d769-aab4-436b-a3fc-3d65d2194b1b", "comment": "Malware payload (PureLogsStealer)", "value": "18f7fa47587f7b4b6188efc8c5d4da8aac306476", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781774286, "uuid": "6d69c2b9-d12b-4302-a337-bad8e627b067", "comment": "Malware payload (PureLogsStealer)", "value": "8f4b723e425acdd97834f9699b3f9c572f892e978ac63a2533c5aabcb976123f40556f91bfa9df13f1be44cd35518993", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781774286, "uuid": "65a90d86-7db6-4626-8d16-265253a01fcd", "value": "T1E8F4F73DCA14012EE572DA19C8AA095FF8C20A5B222CEA4760D72B5FAE7354377D335D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781774286, "uuid": "6beebb02-4f88-4f31-9d60-850479bc9219", "value": "3072:cBtwtqRCQKnjGC04jvypMd61t90iiyKStc29s4Pz5IKKhdSYlENPxO0WVnKjRFPx:UEV3Qz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781774286, "uuid": "89dabd3c-3914-494d-8202-dcbeb67b63bf", "value": 790914, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781774286, "uuid": "3ec9c929-3698-46ea-a49b-1c5298a2b1f3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781774286, "uuid": "0279ea80-7cd9-4344-8db4-d4acc817ea6e", "value": "RFQ For Payment Invoice VER18000263330-80945139_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba574fd9-6af9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781775623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781775623, "uuid": "4bf2c95a-4a44-4ded-92bc-de03cadfc9eb", "comment": "Malware payload", "value": "18b159021cf4648079d7bc8c863abd44", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781775623, "uuid": "a96bcd5a-ff0b-43bb-b6e4-c9ec550f2026", "comment": "Malware payload", "value": "97e7c5a99fc8a7a2e593dc2fc070df8dbc54b704ce2096982d15e7aaa951c48f", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781775623, "uuid": "b1350944-b34d-41f9-b41e-47a171d5e714", "comment": "Malware payload", "value": "a0448a0459371b8cc81a9bf3d743bb468b62458c", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781775623, "uuid": "938181b7-b3b3-4840-8724-d58a7b30c6ae", "comment": "Malware payload", "value": "3b5435852e9250bc5512403e0c8b857ceb63fb05878df8d8f5b7f3e3218f96e35a1601e3a373cab85a3308dd5d153632", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781775623, "uuid": "0289ae28-f9f9-42e2-a1de-fa0bf20b5888", "value": "T144D55B07ECE509EAC469623189B79296BB35BC481F3227D32E60B3382F77AD09D75714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781775623, "uuid": "03c86c96-0ca8-4e80-87e1-fc717099b8f1", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781775623, "uuid": "05733f18-6e0a-4832-9f8f-423d1f972830", "value": "49152:tHwoStBfkkUWK6pPVWDLe4+X5xyPB911Hw+C:ttzk/p08X5QJ5E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781775623, "uuid": "8ce18af6-6c00-472d-a2a2-23166a8ce8cd", "value": 2849672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781775623, "uuid": "98b93ab7-db96-4571-a953-efe3a09d2e02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781775623, "uuid": "8e14cf40-eb7d-4735-9af7-35192302717e", "value": "jhgkuyyg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a74f9a8f-6afa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781776020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776020, "uuid": "75ce0b74-6256-4d74-a6d5-4e87298864f7", "comment": "Malware payload (Mirai)", "value": "c532cb30346ec8f4aa25a481e829e359", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776020, "uuid": "af749703-49f6-4452-b53c-1e17600827fd", "comment": "Malware payload (Mirai)", "value": "989b7d4caab0cec0dbf77107b0568edf3da81f137dcd63c25ee333039efcdcdc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776020, "uuid": "f76220a4-b877-427b-8f16-de0aa915f86f", "comment": "Malware payload (Mirai)", "value": "a4d44bf880300d7c06a83e765599fd1d8f959098", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776020, "uuid": "56b296bf-c357-4a0c-88ba-d9d2410d5479", "comment": "Malware payload (Mirai)", "value": "b4adec5ee44ee6c1ee40d1533abbe52da0ae6b9780069cfc15a40287d8ff0a5a1be13c02f0e3279a29d4bb4d6efa37f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781776020, "uuid": "d0f54175-6474-42a6-8837-7adb7d67c806", "value": "T1A2530213E6238544E1CBB67229423B19AE41D3593234316E54F0B7BA20FF95D893DA3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781776020, "uuid": "ac87b54a-8027-4d7e-8327-4099916e2057", "value": "768:5CzeRFY0vKkOAEplZ7JPamYEo3GC6osjk+Z7gUebxiuQsuP8iJAKUxsYZDEK+d:8Kdv5ODzf2Eo3GCe2Ue1UryYeEK+d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781776020, "uuid": "292b85ad-94ec-4db4-b288-c625ab380e03", "value": 62748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781776020, "uuid": "c2fe8238-efc6-468a-80e0-015af90aadc9", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781776020, "uuid": "c146b776-5464-4581-af1b-3d1a57690e1f", "value": "monero.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fb8f4c2-6ade-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781763874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781763874, "uuid": "ba7c3823-afc9-4976-a993-7956002ad57f", "comment": "Malware payload", "value": "1284c0db7163f67cf3553597fa80339f", "object_relation": "md5", "Tag": [ { "name": "2-27-62-123", "colour": "#EE0D0B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781763874, "uuid": "4943f151-a780-495e-94b3-e5896e127885", "comment": "Malware payload", "value": "99210835caf2f31c31575cd771360f8efaf3695ed9d09896edfc7d3d9172a2e4", "object_relation": "sha256", "Tag": [ { "name": "2-27-62-123", "colour": "#EE0D0B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781763874, "uuid": "8aadafc7-bbed-45f2-9bd6-434ded3f463c", "comment": "Malware payload", "value": "1b32b9bcbafa538c1a9d7a1d51828e54a96d7bc6", "object_relation": "sha1", "Tag": [ { "name": "2-27-62-123", "colour": "#EE0D0B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781763874, "uuid": "c94add1f-fe13-4801-8242-31fd2ed0dbfd", "comment": "Malware payload", "value": "8f6d77a80020157ac247f9781b747750eaf34a516f7b9928af3abc313fe447c8c0d06da5d9c24564762a35ea18073062", "object_relation": "sha3-384", "Tag": [ { "name": "2-27-62-123", "colour": "#EE0D0B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781763874, "uuid": "8760584c-863f-40f4-b4f7-3d3baa2f87c6", "value": "T1B554120ADBE99133D42F117469F5372816F4B1578841BA9F28D4C1933ABFBF788A6381", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781763874, "uuid": "f9283f21-33ac-4c06-bad2-046f1d5a1bc7", "value": "1536:kp8MeE0PCzCqEpeTpLgkGwWbmmJtqHP/jDpSLVl6TuXg+CIZh+raDXiorhNMYSw8:Y84udITmkGDMjoLVcTkgLIZpMYSwqH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781763874, "uuid": "f6099700-d9b7-4b1e-a579-d23ee3ebace6", "value": 304128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781763874, "uuid": "470b447f-a0e8-4a15-be6f-368c172e0e31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781763874, "uuid": "15824c05-45cc-43f9-9254-a92d81b2972e", "value": "99210835caf2f31c31575cd771360f8efaf3695ed9d09896edfc7d3d9172a2e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbac8d77-6b1f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781791946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781791946, "uuid": "7fae902f-0446-411c-a6ff-0616adb225db", "comment": "Malware payload", "value": "7c014973a4c7faf314941717a9e77084", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "proxy-aiddroneheat-top", "colour": "#CCB7F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781791946, "uuid": "0c53516d-388a-4e4b-af5f-7045c81d1f9d", "comment": "Malware payload", "value": "992254da9a9b328d70d8e18bf350b087463dcff4f156fb0b6a55a783485528ef", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "proxy-aiddroneheat-top", "colour": "#CCB7F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781791946, "uuid": "3de297bb-d9fb-4f41-8994-f33b19bcc629", "comment": "Malware payload", "value": "0daf7b5322c666b5bb7d83536be310b66c9e8393", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "proxy-aiddroneheat-top", "colour": "#CCB7F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781791946, "uuid": "6623ac92-c94d-44f4-bf1f-012a912d6f42", "comment": "Malware payload", "value": "e29af75888541e07237e597969ea3a6b42a6e3dab6e68cbd7aa70adb2519361450784342380604e85332847c21ac527f", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "proxy-aiddroneheat-top", "colour": "#CCB7F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781791946, "uuid": "9788bc32-9bf6-400b-8282-3e4efdc008ef", "value": "T1A196D002B7F84066F5FB563495B69A12EA36BD611B31C3DF0190926E2E73BC09E34727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781791946, "uuid": "769d233e-ba4d-45f7-851c-a00baa643af0", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781791946, "uuid": "c7f0855f-b29d-4161-b4d3-4bd788898ebf", "value": "98304:1cjIRND69FvZpNyvZeMcOPg8RO9p/JJOEDSBneS3qKDpYgb6KJMVCBl6:1cjooxyWJ9p/JJOEGlZqKDpYdKyV1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781791946, "uuid": "f4178c12-d916-42eb-965d-ce4c3125990f", "value": 8970240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781791946, "uuid": "00838518-5286-44c0-bbe4-c4f44ad9fab1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781791946, "uuid": "16cce955-cbe2-4bd1-b415-c0a350b7c2f1", "value": "recuva_professional__technician_(2026)_full_espa\u00f1ol_[mega]_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "232b7277-6afb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781776228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776228, "uuid": "870732d6-2735-4e5e-b0a5-bb48a83733cf", "comment": "Malware payload (Mirai)", "value": "b6553246e632e8fe996cd29c696c34ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776228, "uuid": "da67f52e-c28d-422c-9cfa-bd839e4678e2", "comment": "Malware payload (Mirai)", "value": "9a5ef43b868f4755a2228dde510198f79784e3447e34d279af8b2fdeb546c5c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776228, "uuid": "12a63d80-337f-4841-ac7c-7fda41a4dc75", "comment": "Malware payload (Mirai)", "value": "a145d158bd1e3bb607037d2e438f635e03c47bfd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776228, "uuid": "1abf472a-1384-4bac-a216-752d4a202f7e", "comment": "Malware payload (Mirai)", "value": "c2440a0aa58b3b9b499a97414f13e29fee6b7d7c777f340d84065dee1415eb1536314f8f46a372dcf3fca2f3308c4789", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781776228, "uuid": "fe751c05-1937-4ec3-822a-138fdafece4b", "value": "T14AB38E9CAD0FAC80C3DAD37E99098FA2B137747843648271BD01535DD5BE997D8F2922", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781776228, "uuid": "fd5bd036-26d8-4093-ad79-815a46503aa2", "value": "3072:GZz9bLJVTL2Q4dB4U8QGw6cEaekDlgRSP5h1eCEzKS5:yz9bjTLyBF/1lgi5r+KS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781776228, "uuid": "5a1f79f8-0e83-4d95-8679-c406a6401a1a", "value": 116464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781776228, "uuid": "d507016d-0293-4882-a6d5-169069a118f4", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781776228, "uuid": "889d263a-4dad-4de0-8198-4bce55efbd8d", "value": "monero.arm8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39206446-6b18-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781788720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781788720, "uuid": "a4754cff-4f07-4ef3-8a01-41bc1e8409eb", "comment": "Malware payload", "value": "08cbe4d263880cf10849ae8f4e17a7aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781788720, "uuid": "af68bff1-673b-4880-85ff-ae5636d9d834", "comment": "Malware payload", "value": "9b32b67cc77b1f18d003e12854a7e59dbe2619e9ca21ca656a0ce705058bb0a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781788720, "uuid": "9be5cb6e-d341-4d3a-9fb6-d54c74426180", "comment": "Malware payload", "value": "825f8bcdf553937f3d1b4880b3178cb2336dfa9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781788720, "uuid": "825c584c-fcda-4451-82b3-596a633fc714", "comment": "Malware payload", "value": "d54c499b1ca2bfb86060e41981e651ec8099df60f2dc4ffba8e19e0b16f7450f7da5adbca038703fb6e883d896eb03ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781788720, "uuid": "3c47a29a-bcd2-4d6a-90fc-b79b87e1d004", "value": "T108D34A53E50C8022F9DB02B9B9B252128EB584844576903776CDCACE5F9F7C887BEF91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781788720, "uuid": "97b2a6ce-929d-4961-93f9-63d93b739104", "value": "4886a557d112c7c409915a0a09ed3328", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781788720, "uuid": "d90ee301-18e5-4749-a0a8-a608d6959207", "value": "3072:G/bFf+Rn2PrTKuJEx4zjChW76N5ICx3sZKJGshfmKyQE5p1:G/bFrNX2NNNyD5p1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781788720, "uuid": "9bf94669-43a1-4bbf-ac77-071c7d6d05d1", "value": 136704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781788720, "uuid": "5f9e8f2b-7835-4854-905d-1a52bf1ac710", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781788720, "uuid": "1a8c4cb1-8005-44a7-87d0-313199e9b450", "value": "infinity_clash_gems.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d355602c-6ae9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781768793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768793, "uuid": "8ae86e2d-68af-4889-ba31-95140c2f56b0", "comment": "Malware payload (Mirai)", "value": "fd1bfe59c2e5685e06f2a567410e459d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768793, "uuid": "38737277-b903-4887-8da6-8c56adbfb097", "comment": "Malware payload (Mirai)", "value": "9c1552acf468572144bd2f5f003ca57d632e57fc591e514bac8e183e46272657", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768793, "uuid": "ecaf31ad-7f99-4c4f-afcd-3a4fcc00b328", "comment": "Malware payload (Mirai)", "value": "170432d54514038d5a88a9c0fca212d5e092246f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768793, "uuid": "35cfcf51-f0a7-46c5-950a-fc1bfe505a05", "comment": "Malware payload (Mirai)", "value": "b74d767b54df1ae7f357c40f8b1595dbe455afecbc0e9eb21fc632e898451cd55063e2f4b1ebd852cf57e08b48bd2b64", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781768793, "uuid": "8e56ac9d-70f1-47b2-96ea-90edbdf7517b", "value": "T14EA3124179D7BD1B62A0503363698545FB5E363AF2A3EE8102D38B135B4F80BF6EC082", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781768793, "uuid": "9ea1c36c-3be6-4fb6-a635-3a316639ab88", "value": "3072:Jwzy/vxCNwv4SE+H9GoifVOLi3NbZDW5J:J0y/pCev4SFdGvfALm7D0J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781768793, "uuid": "07de5fe8-ec21-4be0-8062-1260a4001d24", "value": 105196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781768793, "uuid": "968e687f-fd3d-402b-86d0-b4e994a66de7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781768793, "uuid": "9bed0be8-0f98-4221-a4ba-46a73851cd8e", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a14e1aa-6ae4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781766442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766442, "uuid": "f65a0daf-2f3e-4bd6-9f02-3d9acb876949", "comment": "Malware payload", "value": "218538688c2bfdc760de66c415a16d39", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766442, "uuid": "dc37abef-33e4-4222-95b5-706a6bb89116", "comment": "Malware payload", "value": "9c9cc3cd47bec052002b0f73de3b801758688fe069cb7ae49c9e1bcce820e6c5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766442, "uuid": "8b84fe7b-0da1-4f6a-b399-c4698f3f9006", "comment": "Malware payload", "value": "84dadc074437b7ba346a145d5c1eb9e96e77262f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766442, "uuid": "04919027-067a-4fea-8b90-3032cdf7f31b", "comment": "Malware payload", "value": "0798b982af1c1ab590671812f2abbef0063c00d77d366ffa494ea54450857b7e648bcd2f0d83065f23b67fcd0be79df0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781766442, "uuid": "9f3d2c7e-2fe0-46fe-ad3f-7f4160ad62ce", "value": "T193016FCB47506D00401A9E5E62D75290F821C3CE558B4B747F9C5D2EFBD8A14B137F94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781766442, "uuid": "5b3b9996-1a58-45ee-8cdb-8660685a5e48", "value": "24:kXCKysE2hi0ziQvZohaC1NMxyN6FC529rj3AF07:e9Qp+MsC1NMdC5q3AG7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781766442, "uuid": "758d3b17-e902-40d8-99d0-0d76047aab88", "value": 831, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781766442, "uuid": "9d6cfb8b-d37f-4c0d-9776-8afc4fc32dbf", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781766442, "uuid": "289f2b1b-ef7e-4821-86da-ca3df23afc9e", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a791a8bf-6b0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781783322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781783322, "uuid": "d82f0659-9299-4edd-a6f5-4ec7b93d46b7", "comment": "Malware payload", "value": "3ef9c2e533b12033ff3d7d6ede24e5a2", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781783322, "uuid": "e128c39d-7585-41e0-93d8-bedf3f930895", "comment": "Malware payload", "value": "9cc571d3d60f4c9c614e51e71fa691fbc4eb5b94e4b6ce8eb4455dbd4ea12698", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781783322, "uuid": "bedd42c2-5456-45c9-9060-e9c1a3b38e23", "comment": "Malware payload", "value": "73d7f491f6be6c37e51d18f118002242fceb1e63", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781783322, "uuid": "e8c44e06-8d72-4450-8116-5f9ea2a8cb71", "comment": "Malware payload", "value": "71fcaf82df407b2baa5ca0c4eaeac1e682f676e7f8ce33945476b34e94660536845260278baa9605d6e616b067b4b8c8", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781783322, "uuid": "6e529f8f-73d0-42e3-8146-c5ab9357d70b", "value": "T18741C9203BE90629F3B32E37A8B6851034BFB8056E01C50C01A293885437A18C13BFB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781783322, "uuid": "519830a6-562c-4275-afba-a43593ea9e03", "value": "12:8oz9Xk5hGM32bLn1Il+WKlDmo0eDn7GXuHbLn1Il:8ozdYhCY+B4o0eOXuHY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781783322, "uuid": "6444dde2-0422-491f-a290-43eccca5e1a2", "value": 1910, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781783322, "uuid": "f58c9cf2-9559-45c9-b55a-c309abf48413", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781783322, "uuid": "f33247ac-f49f-4196-bcae-8521618b53e4", "value": "artes.pdf.lnk.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bb69c28-6ae2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781765532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781765532, "uuid": "406add8d-2ac9-4f7c-a2a2-4dc748b232da", "comment": "Malware payload (Mirai)", "value": "1193c2b09d8723a9e7a666407510057f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781765532, "uuid": "5aa7681c-a040-4eea-94b1-08052df68143", "comment": "Malware payload (Mirai)", "value": "9de0fd63ae7cea892f597c63ba0f6e07fbb4b2ccc2b24419c5e78dd80aea4b07", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781765532, "uuid": "5302d3f8-7f16-4c46-ae1e-8a4e2a7d008e", "comment": "Malware payload (Mirai)", "value": "255d581eb9299e77d0c6427109a9266fd77b7113", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781765532, "uuid": "80dc9e5d-b3d5-4578-a93f-b7f622782934", "comment": "Malware payload (Mirai)", "value": "75b3fe382df14c54f6219ac06e86f4f9047e155e1482ab9346c30bca80eef39df12a365e661c47dde904dc7c50942770", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781765532, "uuid": "9efa8229-b76a-4f5e-8d64-30b5405e45b9", "value": "T109F32902770D4F43D2972EF02B3B2BE1979BFD5228A4E540751EBEC98271DB2504AED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781765532, "uuid": "573377e0-a335-4aa7-813a-8b39c20cb7cd", "value": "3072:9kuphOdopVX0p17oP4axSav1sewKRaOzHD72T1:auphOdopk7owaxSav1setRXv72R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781765532, "uuid": "a67c57d0-3bf4-47e9-b31a-3430091863f0", "value": 158964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781765532, "uuid": "c2446f36-382c-44fe-b50f-fe8190f1f59b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781765532, "uuid": "15c7902b-7cba-4ca9-b98a-76664e04caef", "value": "nova.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07a53337-6b18-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781788637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781788637, "uuid": "0d5d5172-a84a-4038-8a78-560e0d412f7a", "comment": "Malware payload", "value": "fa722f65dd8569e016ed7f0032e4b94a", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781788637, "uuid": "7bcd5c9f-3285-4fa7-a887-31b585b92394", "comment": "Malware payload", "value": "9e031576bdf06282fd05ce04db52e60e96b28e0cf5ae705393482e24fb9681d9", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781788637, "uuid": "ad543e30-b99d-4cd4-841c-9f86b2ec7d67", "comment": "Malware payload", "value": "3cbe4ca7617033a4314f838ef525d1ed6ae70995", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781788637, "uuid": "b3ae75ed-d14b-4de1-b299-dd06f99cfb0a", "comment": "Malware payload", "value": "3c5940ec4802f782b9a4f53017a9cb5d16db267fb04eb1ab63d651adc4c18ba8402eb5fca0694cfa0ae63c188a8256d2", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781788637, "uuid": "ccf466be-5ac8-41bc-98a0-e305283e6679", "value": "T160410FAF01DEE70A8661D784F58709499A0B9F516119BFDA72EE9913E40C30FE3B8784", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781788637, "uuid": "5bc3495b-9935-460b-8cc5-b11bbd7cad04", "value": "48:bsv7qld1XNczN2TbBOijp4QGDkHsJxXpURQpzm/Ho9m5+H9N+ViD0l/k8atpaTti:4vGDM8BV4Q0vW+9m5+Hd0lsHyjo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781788637, "uuid": "4f0b8d17-1723-47b5-8bd8-e31847c19604", "value": 2313, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781788637, "uuid": "65a751e4-7f8b-4aab-baa4-1ff35d8398dd", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781788637, "uuid": "ca5f0c62-ab0f-4d66-9493-6f0b6f17b085", "value": "AdobeReader.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6eec0cf-6ac0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781751189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781751189, "uuid": "72f52186-1c3f-4c56-82ce-16da29e63288", "comment": "Malware payload (Mirai)", "value": "bc9338ed51a977900c3e0b3a5d697c0c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781751189, "uuid": "8746f395-9722-421b-973e-ee530f3d8d02", "comment": "Malware payload (Mirai)", "value": "9f1df95a3d4cb0a2baff7ea758f50f6d783c57250e1780c5d6081fef13c7f9a9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781751189, "uuid": "e291497f-db04-48f3-91b8-a00330953920", "comment": "Malware payload (Mirai)", "value": "911c316d932546df94735eac426299554b895ebe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781751189, "uuid": "61ac7f24-ae20-4e10-a344-66a6c78666e9", "comment": "Malware payload (Mirai)", "value": "2664504fcc95e7798171d13edfac690a4e4ba29c6fe507066e1f77cb78b914f23687a7b6ba8e1669c7685caccf20eeb2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781751189, "uuid": "3cd52e38-154b-4f0b-92be-eb88eff12e6c", "value": "T18CC30A52BE519B13C6C321F6F7AE46883B136B79D7EA3102ED247F50278B4DA0E36611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781751189, "uuid": "55001874-94f7-47c5-bb23-f71dbfca98ad", "value": "3072:YivLWohAgQcmddswBddZFTl/9it4TDxC3NT+:nJAgQcmdawrNTl/9iGD2NT+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781751189, "uuid": "d0e92e76-c908-4475-ad13-fbc3ab7afb3e", "value": 120836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781751189, "uuid": "ff68a900-03b4-40f5-bbf4-8d02b1b7bfda", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781751189, "uuid": "8ddb8168-2d2b-4738-8d98-48a76e497811", "value": "data_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce01cebe-6b13-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1781786822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781786822, "uuid": "2ddbe202-3e5d-405b-9c1d-c548103392b2", "comment": "Malware payload (RemcosRAT)", "value": "52c1005cff76c7c6f4b21a231ad6e130", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781786822, "uuid": "dfe6c034-5777-463a-983e-db61548c8870", "comment": "Malware payload (RemcosRAT)", "value": "9f844a78cc2cd8d8a426f050a3efe319930f723eb10be231de1c1f1600e82127", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781786822, "uuid": "cdd15d1a-1ad9-4d63-930d-07858e1588ca", "comment": "Malware payload (RemcosRAT)", "value": "fceb71b23ead80d609b2523936fe925e6c1fcb24", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781786822, "uuid": "a3c74f6c-0f45-4d17-9d1b-1f3d033da36a", "comment": "Malware payload (RemcosRAT)", "value": "d3a7b5e7aac7fdbb77023afe2f22b150e4b1e3bcdfbc0661ac43f587c1e36117e35605f1960edce64bbe76e542eaf58c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781786822, "uuid": "b964c623-0325-4b2e-89e7-f9716309cebd", "value": "T10F45237EB619D10AE54F03B61992E07403BEBEDCA513C51BAFE0BDEBB566F0019006A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781786822, "uuid": "8f1cbde2-d705-41ae-be73-a7191a653b01", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781786822, "uuid": "eeef71d5-c533-4ba3-a82a-76340c34f1c2", "value": "24576:0IFzrn0UruWt6fkxplJZz4m2ueUS2S+pP6Vb4zigcajbBykg+DiMrtmV2:0IFzrn01u6fcHJZ8m26SOpP6yzTcajlf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781786822, "uuid": "ab7fdb52-4824-4d0e-9066-ade50282d12f", "value": 1257472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781786822, "uuid": "67bd5fbd-ff87-4c0d-aa9c-6d46ad6c54a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781786822, "uuid": "5a77d10c-acb5-4994-a783-8373a3bea854", "value": "JUNE18TH-PO-3520398763520.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "398a6da0-6b34-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781800747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781800747, "uuid": "ee24f982-f3b2-4970-8bb4-87096540dfd1", "comment": "Malware payload (Mirai)", "value": "90e1a4ff35596c251d29519669bb6627", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781800747, "uuid": "73684d86-93dd-4d8d-8081-5ab37cb974d4", "comment": "Malware payload (Mirai)", "value": "a04e9a6a4ad885a9cd8fb804e40f28d307ae55fce38bcf4755f84b083eac1852", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781800747, "uuid": "427591f0-f37d-4863-b235-be852e7cf2ec", "comment": "Malware payload (Mirai)", "value": "a9ca63a98185ed348724fcec4561e2da8cf9382c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781800747, "uuid": "99fd0921-a681-4ebf-bdad-56e72f858ae0", "comment": "Malware payload (Mirai)", "value": "b43a4e8d24f89ed7882b50ac6c6da1d456622df585606655bd64c09b58a9dbad96bb899fe03d0428950f45861ce3fc7a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781800747, "uuid": "a72ad39c-fe64-4eab-bb7d-37029bd8714b", "value": "T1C783190377094F03C16329F0267B1BF097EABDA519B4B284756EBEC59271EF12182F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781800747, "uuid": "fe9ffbe8-5fa9-48c0-b3ac-675ec40e0413", "value": "1536:VLblgTewtHfOooI1Pl8Cce4Xe+2eDqs++mJvSZn2ikBIH3j8JVc:Vy/WopP+FqKm/ikcwc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781800747, "uuid": "c44ddba9-9c0d-48b7-8ec8-c3fdb4f53e37", "value": 88732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781800747, "uuid": "dccbffb0-96ca-48e7-ac38-5f53fc468d3f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781800747, "uuid": "31827df5-2548-40ef-a21b-9fd010974222", "value": "manji.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1137135-6b6a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781824140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781824140, "uuid": "fc285808-92f0-4579-b109-3e3f3279ee43", "comment": "Malware payload (Mirai)", "value": "a1a162cc2e5d022cad068aee8c583f7a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781824140, "uuid": "ad80d3d8-1e29-4a00-b3d9-732f8dd76ad9", "comment": "Malware payload (Mirai)", "value": "a08c8c2c5985c3ae508ddb44da6c841e4f2ab1b3dde5790b2a8858513feae810", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781824140, "uuid": "c6bc7e67-816a-45fe-912b-d8fd5500d9d8", "comment": "Malware payload (Mirai)", "value": "feee6ef497a8113e125f976cb820d62a5f140c2a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781824140, "uuid": "dd81092c-9a46-4b5f-aac8-645404c34e1d", "comment": "Malware payload (Mirai)", "value": "9e2fc8cd2554d81eef61ce25770411715c3e16445811abc0d44450be996db7eec58272e5875318721adde3e21c047287", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781824140, "uuid": "c3ab83d1-14d8-4926-8ed3-ac388ba58f90", "value": "T12B63940AFF610EBBDC6FDD3706A8074135CC651A11A83B7A3574C92CB65E54B46E3CA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781824140, "uuid": "b060d05f-f2d4-42f9-abc2-393b4271517c", "value": "1536:p71bpQ6VNr8iTGzEpNvVOQZRatSw9jIdhE4:p719QSGyNkQYIhE4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781824140, "uuid": "217d257d-3b59-4407-bc23-5aaa47b45b33", "value": 72516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781824140, "uuid": "84608919-e019-4f84-97c9-95eb44fca087", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781824140, "uuid": "b5a85adf-2038-4552-ac70-2268d6a0876d", "value": "godisdead.3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca58e502-6b0e-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1781784669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781784669, "uuid": "d4809d38-675a-4ef5-9e4d-467d8703ac2e", "comment": "Malware payload (PhantomStealer)", "value": "1348b61498226312efc6de0c4b30bee6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781784669, "uuid": "8d62f840-4310-4924-896c-959c83a30cfc", "comment": "Malware payload (PhantomStealer)", "value": "a1a64e53591cc747ca8a9b906bc83ea3d6394aba5fa6a0d7a4a4acc725407a5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781784669, "uuid": "d83c4490-e838-4a18-bbb2-89596045ff1e", "comment": "Malware payload (PhantomStealer)", "value": "c7a3c9f19bee1dcb92f7db25dda92a00ba73e226", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781784669, "uuid": "46f8726a-fa63-4560-a800-c045085ff832", "comment": "Malware payload (PhantomStealer)", "value": "cb32e13633e4e3ce354f9948705c7bd9273c1c865cf185613c325de7395e800230f5954ea62d2eb87d9b230246e50412", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781784669, "uuid": "6b2b5bf3-3d6f-494a-afd2-d5bc42906d38", "value": "T16765231D6348C167D0572F391E32F9B407768CDD4912D24A9FF9ADB73836BA22E007A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781784669, "uuid": "4ea0c656-fdb6-4615-9c9d-9627849d6a1c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781784669, "uuid": "427f5c53-053c-4ac6-92c0-3df82ecbd08b", "value": "24576:JIFzrn0Az7LHPmMWsj8HmfDtO8pDhArGorxZnOkcPZaIF6lP5CZMX+vTKnCPTsBo:JIFzrn0SPmMxBOIdArRZOkUa9152TNbv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781784669, "uuid": "42ea84da-3fb2-4b19-8907-1defa19c8c79", "value": 1494528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781784669, "uuid": "1679fa64-d044-40a6-b8c6-dd38caf893ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781784669, "uuid": "5d2b52f5-24c3-4b4c-aacd-1b8d61ee2089", "value": "Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbd5d128-6af9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781775625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781775625, "uuid": "011a0fae-36ec-40e5-a3d2-6de8221bfb2b", "comment": "Malware payload", "value": "3a496bdfd71ed4acbc12f3d23c63cbc4", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781775625, "uuid": "a9f387af-724e-45dd-9478-134dd4d8b1ef", "comment": "Malware payload", "value": "a1bcb598e7f10fb7c944527e5970d8380fb106d2a8a61ee929d4c99fde17d1a4", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781775625, "uuid": "f198ef35-9222-461f-acca-559e4aae10ae", "comment": "Malware payload", "value": "133a2e48bc7ba217c652151f5585d07289623a9c", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781775625, "uuid": "9260f9a8-dbfd-4855-a3bb-24d8c4c9dd50", "comment": "Malware payload", "value": "57ba666e63e73edebd9256a6aa94a681629e9b54087349ffbe18f5b3257e84e433a5bddad496967117d015cca7be5697", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781775625, "uuid": "dba577cc-1a11-4408-81d1-846f385a6542", "value": "T1DCD56C07FC9558EAC09A62758DB64286BB75BC481F3223D32E60B7382F76BE09C75714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781775625, "uuid": "27edb915-a10c-4eed-a4f9-88f1da1c8025", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781775625, "uuid": "5a5ee03f-8256-48ad-9e93-e1f2c93678ea", "value": "24576:gnQs6loLVP2+Xfod44c7lXRFMkEZEfcHTHOlMj1XGgiCEx3vAoBele5I92KbNcTX:gnQX+xP1foGT7f6JOfEIM19iCEOHH5Id", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781775625, "uuid": "c0033abd-2f15-4f28-996e-d690598636ee", "value": 2847600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781775625, "uuid": "85e7f2a2-fe9c-45c2-877d-266770ebf1da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781775625, "uuid": "f023ffbb-696d-485e-931f-85366a32698d", "value": "kliulij.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1664dd6-6ae8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781768306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768306, "uuid": "95dc7819-854a-4b2d-8d72-6bdedb2bc047", "comment": "Malware payload (Mirai)", "value": "53f7fb078756ea3ab1d5ef26e16275f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768306, "uuid": "48596421-305e-4990-97a6-f628559366a9", "comment": "Malware payload (Mirai)", "value": "a219616b7bd91a821d2692398caae25e86af1b4b96161fa919455b23b2daeb0b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768306, "uuid": "002af83f-01c9-4fac-8077-c72d3d7bbd5d", "comment": "Malware payload (Mirai)", "value": "7884e716455628d5880ea5c9374d09ee6ccf0c62", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768306, "uuid": "fb4a576d-4915-416d-b5f3-eb7519d251d4", "comment": "Malware payload (Mirai)", "value": "16827b1a788faa226f89212e3e457e287c79bcaccb5a10b48d5bcd040ee0e474bfafe78ff7a7d43f56e45f46a4d5c622", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781768306, "uuid": "cb567724-fbab-45de-948e-a3d56f8c500c", "value": "T14D5423F896F3A397FE89C24EC407D688A4FB53B518DFCA49CF6C151A5A1F2009961F81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781768306, "uuid": "941e4913-f41b-4981-940c-81ad6a13dbd8", "value": "6144:3jpOgicGJDwe1evfvXXxFzL6Mi9b3+stZ+4JhfxL2vP7nhsKwJhxgmHWDc:3j0gidJ9offBF/nObHf+a587hQIDc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781768306, "uuid": "a59cb5d0-1ad8-48a9-8b94-a102473de721", "value": 296468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781768306, "uuid": "10096cf0-2545-438e-b2d1-d76056c5f40e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781768306, "uuid": "8c621e15-53f7-4dfc-b1a1-de8a9a22cd6b", "value": "kaizen.ppc_srv", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bdfbc60-6b5d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781818280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781818280, "uuid": "c08d39c5-4734-4b43-ad3a-3e261f3684ac", "comment": "Malware payload (Mirai)", "value": "a12eabd84be691975457064b6fe9eeb8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781818280, "uuid": "1a96709a-7208-4319-95f3-64dffff5c94a", "comment": "Malware payload (Mirai)", "value": "a5b911b9f854d14af6c45df27a4685d33e0c07de635da599ff6787d53b64b243", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781818280, "uuid": "7bd9edf7-b898-41c1-bb7b-40dff863574a", "comment": "Malware payload (Mirai)", "value": "ca8cdd67c3585b4b37eb3572692aff0cef4b104e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781818280, "uuid": "adf05655-414b-47dd-879e-4d86606e60cd", "comment": "Malware payload (Mirai)", "value": "14a638f1e80886f538accbb90c691c0b862700baaccc79fbbc525e6a9e06a17db4ff11215bf58b2ea04fa1b3031e8a2d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781818280, "uuid": "3c849384-7025-45cf-aade-a242c363b6c6", "value": "T1D1A35CC4F683C4F6FD1215B51027A7339B33D43A503ADA93D399EA72ED62261DA1A31C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781818280, "uuid": "a3be03c6-02b6-4036-9d2e-843dea6e8689", "value": "1536:16ZqgYzJoU8ZlxxlAJPfPq2OZrQYNeGlKdfSGREfy5:16ZBYzNaLlk/q2OpBeHaU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781818280, "uuid": "6a629de7-4861-43fa-bef6-56eccb4db432", "value": 100268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781818280, "uuid": "b2745095-8d97-428a-b020-8505c735296a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781818280, "uuid": "4b67dece-bc26-4264-b4f2-f6b954bd42c1", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa66d746-6afb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781776589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776589, "uuid": "5ea9a176-e281-43f5-ab31-2a6d6c0d2ccf", "comment": "Malware payload (Mirai)", "value": "bfd86ae6579c2390c7a19fcb73a2787f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776589, "uuid": "8f6a8fbe-41a8-464b-84d6-e5e81153ff34", "comment": "Malware payload (Mirai)", "value": "a622b1dc97105c87f44e589f583cbf743f4599d49c155310300d0602b2748181", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776589, "uuid": "28f534aa-aa97-43ca-989d-7f8241fcfc0c", "comment": "Malware payload (Mirai)", "value": "642747c5da0c29d2b745da25428c3b3d47515c42", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776589, "uuid": "6b3d6db6-87bc-4434-b324-aeb425e5f971", "comment": "Malware payload (Mirai)", "value": "ec4621af9b03a0b6fe6282a0cffd6864052a1857ef9ab75775ceb30774bca791b77cbcfdad0beb2ae7f8e0e63a67993b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781776589, "uuid": "ef2f593f-6e98-4485-b050-6f225a10a96d", "value": "T1BF245C02771C0947D1632EF02A3F27E193EF9AA135F4B645755FAB898272E321485ECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781776589, "uuid": "fa0a5a4c-457f-4221-ab2e-65678dd0c99a", "value": "3072:hMH6dDHOXJewHtIXlmWtTPK0isrPRhnx9vEfrtiBu8ClpHOkN:dlhc0pDRhnx9vEfrtmubv9N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781776589, "uuid": "83ad1639-7e43-473a-af27-e25f18d689f1", "value": 213008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781776589, "uuid": "08150be1-4b28-4d77-946c-cafe43477d90", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781776589, "uuid": "c92a9a82-9803-42f7-aea8-8606aaefab0c", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab318e3b-6b62-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781820694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781820694, "uuid": "3fee5c73-da00-443c-9509-51f0be5d9230", "comment": "Malware payload", "value": "8fbf68a1d5c2a4b21b6863f42e75704c", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781820694, "uuid": "fbf8d776-6e3b-46d7-ae4d-f830487ee638", "comment": "Malware payload", "value": "a69a6aab118b41b35bb1abf0ea88f5abaeba2e3c173b12be1137f95ae88133da", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781820694, "uuid": "789e929f-6033-40a5-a83b-851087dadbbe", "comment": "Malware payload", "value": "bd9ee6d3467893685d38b6360a3545366cf19c34", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781820694, "uuid": "25f60375-d3e1-42b1-8225-285b828d43bf", "comment": "Malware payload", "value": "252cc19f0cf982985a10362eace1a594e9dc38a2db5fcf4c04be38658bf6ca7b3a6188ec3800ff18a6d836f06d6848a0", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781820694, "uuid": "e69f6f4c-8821-4513-8a8f-36e6903fbbd2", "value": "T1D321879E84237570E66C2A7C30F01B96360650E9F825594F07B0A6F677E6625C7D2B50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781820694, "uuid": "4700dbcd-b787-47a6-a028-01e846372a6e", "value": "24:9ZY988VdvJVHyasqWvB250FgyNsLuw+ET/oMV8MGX1OMBM:9Z+ZzXHyXqkO0vOLV0MVW1OM2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781820694, "uuid": "fb2a31d8-c0fc-49da-b173-5d8ebb6db442", "value": 1290, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781820694, "uuid": "b3a996b5-b76e-41aa-8eb9-db8c243f98f0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781820694, "uuid": "826a3716-459e-4f78-9bbc-ce3f78a25d74", "value": "Ltr. No. 248.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac4a018b-6ae8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781768298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768298, "uuid": "891d073c-706a-4dc0-a94b-53b003b19b16", "comment": "Malware payload (Mirai)", "value": "1c117903239c55d4a908bf6b5f88e7c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768298, "uuid": "b90e67a1-1f60-40f6-899d-c28ce49917cb", "comment": "Malware payload (Mirai)", "value": "a6a13e93e270c95ad38109ed33a8027cfa0983cf83d5d84174d9c7bb483428cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768298, "uuid": "5078105a-f1b1-4383-bb43-4558f05430f6", "comment": "Malware payload (Mirai)", "value": "a49a2eee6aa2b588c592241eae06df2cbf556351", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768298, "uuid": "0ac57a59-f219-43fc-ad1d-9160defe7d24", "comment": "Malware payload (Mirai)", "value": "48c7514f3b7dffb0ee9cd9f149ee20481d21b50c86490092ce76505ec6446b7b53ce0b86ffc9e1c6054ad35112b1e4d4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781768298, "uuid": "00652232-ef26-4852-bda7-448a52403a94", "value": "T109E44B46F8809F62C6D536BAF74D42A873034B79C3EB72069A155B3537DB86B0F3A601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781768298, "uuid": "23baedc6-84a2-445a-8ff5-722961b7548b", "value": "12288:uUJuXIsGzydYnDQtZZA2X+5XGXtl796vHFpA6jSnqdkBB7IdYX8pEk+HI:XJuXIPzyYnDQO2XMG9lx6PFpAASnpM+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781768298, "uuid": "69074e94-fd68-4c5c-9a50-873b305373ae", "value": 690656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781768298, "uuid": "b67e7427-27be-4645-8660-8048a823be18", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781768298, "uuid": "11320b85-be02-4852-92bc-f6e463708885", "value": "barm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a03bfe27-6ac0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781751097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781751097, "uuid": "b88cbc2e-f2d1-4ede-8fb7-868ce670114c", "comment": "Malware payload", "value": "9ed2b447d2c6193591e2ba355bde9536", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781751097, "uuid": "6e17e836-5529-4220-8b93-2e1dde465cff", "comment": "Malware payload", "value": "a742d810bd6ce9d7ae3389ac70181b83064f5f77dd7af31472869c9f6ad1e0ca", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781751097, "uuid": "f87039d5-2421-4322-8929-047e4b2a84eb", "comment": "Malware payload", "value": "df1020fc974112a2f9634499181e799f23427899", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781751097, "uuid": "70d4616d-f11a-466d-b8d9-54cae4c494ff", "comment": "Malware payload", "value": "06d0ee530f84ae4626feb886f613b1cc3b30db46e3ed2beb9dafb52ab0305faceeda8c80fe12d105f8e1b489fcb3167d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781751097, "uuid": "30a8a700-2683-4224-97af-d9aae2517f48", "value": "T16831819A44152A352312CECE73B63988B10CD5E71DD7DBE4980C0EE992D83CC725AFE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781751097, "uuid": "f5d94f79-a425-4f65-b293-02976e552429", "value": "24:dGAjO2cepEeuL+QcAeYZnO03marYiM6MRMKM3ff:Vg8EbL+IOShAaff", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781751097, "uuid": "e1d60677-1393-41b4-b9e1-1abad87f8c5c", "value": 1584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781751097, "uuid": "365d8855-3081-482a-91f1-951f916d0115", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781751097, "uuid": "af33f8d4-0a30-46be-b062-cf2037f79733", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbf0f6ed-6b31-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781799677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781799677, "uuid": "946fe15a-bd48-4951-9639-e4d2d5b978f4", "comment": "Malware payload (Mirai)", "value": "9be47978e047e00667f6ed4e02505fe1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781799677, "uuid": "7e130305-4d91-42a5-b531-bc47df72fa10", "comment": "Malware payload (Mirai)", "value": "a7ff5362d665b65f2ca99696325776227512f9f9b9f7d8308e2be593b2cbcc58", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781799677, "uuid": "96db2756-1d83-43f2-90e9-df38f7bea8eb", "comment": "Malware payload (Mirai)", "value": "f05873862d57b4e6cfdde729f8acc2483917726c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781799677, "uuid": "3d8a35d3-75b8-467b-a6ed-77444b247051", "comment": "Malware payload (Mirai)", "value": "00d68963f775f0a0ebd5dd2b8987f59a2a663478119c2cfe550c0f73afaef016266943ee659f1c38aea4fec75e3c8b5b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781799677, "uuid": "66cce668-ab3e-481f-8104-459127e40983", "value": "T1C2E33AC7F800DDBDF40AE73B48530909B230BBA245925F372257796BED3A1991973E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781799677, "uuid": "16cc0fd1-7091-47df-8073-b206ae83a81f", "value": "3072:V84c5Z3jwPsy0Vj0/J/BDWs0qKH8cVxjbiQLrmHMXw:O410y0J0/J/FWPH8yLBXw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781799677, "uuid": "8c668c47-13a6-4bac-8a77-f739939dd6e3", "value": 150176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781799677, "uuid": "efccb62f-6d2d-4a2d-a207-18712fba6f35", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781799677, "uuid": "f08d0138-f95e-4738-8c58-39f4f25ca40b", "value": "main_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6275fe9-6ae6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781767455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767455, "uuid": "1d009193-57e6-4648-aeb0-e19c8f7f034f", "comment": "Malware payload (Mirai)", "value": "ff2c40b5424aac146841e9fba6d252d9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767455, "uuid": "b07d361c-b9da-402f-b65b-780732a37211", "comment": "Malware payload (Mirai)", "value": "a803630655b016f1de61227aacb5fff3ad5dba1ad05aab8987f053cad0d410b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767455, "uuid": "bac5b89c-52de-4d2c-aa85-8848c34c144b", "comment": "Malware payload (Mirai)", "value": "c21639e4a29729698db58775bb499d2c199c7c00", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767455, "uuid": "be3e9f42-0bc9-42a1-a58c-8a13422f5ec9", "comment": "Malware payload (Mirai)", "value": "573851a1990c5a1d790f2544d0a6ef99fff54a24a9e99848f8b29af877decc389d0bdbf2ea3df395e4414eea8faaaf10", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767455, "uuid": "f695fb97-6cbf-4fcd-9ddb-063aefd0b339", "value": "T1AFC30952BD429F13C5C321F6FBAE424837136B7DD7EA7102ED246FA1278B8DA0E26511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767455, "uuid": "c09b82d1-2e40-428c-8e28-2edfe6c376be", "value": "1536:06MV2he3ifUOTFc9OfyNyalAMuQVecxfa2T1WEvmdrm44l3LUGsh4EOgrxjasDtT:02heS80Fcv5umN1LmRR4l3LU7Vin/R+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781767455, "uuid": "f24b05dd-b72a-492c-a0ef-cdadbd184398", "value": 124932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781767455, "uuid": "47b98cbf-b7cc-4382-bcc4-0e1432e9c2b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767455, "uuid": "a3785103-886e-4a0f-9d8f-b1063639242f", "value": "data_arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "141e43f8-6b27-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781795101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781795101, "uuid": "0de31187-ca96-4549-803a-fdb6dd765f2c", "comment": "Malware payload (Mirai)", "value": "c54e8342f3e3e489e34f085472da48b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781795101, "uuid": "467df71d-01e1-43d6-afbc-249cd1159e5a", "comment": "Malware payload (Mirai)", "value": "a8827c91638b27fdb94ddc35d2b56cfc3083e7a0c42b0cd81782d67881575f24", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781795101, "uuid": "e96939e5-90b2-48d5-ba8a-12db773aec0b", "comment": "Malware payload (Mirai)", "value": "8e9a906aafc5021719634c64d9e524aaf764eb97", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781795101, "uuid": "facd6cd6-c450-4c1e-b2ad-f2fa80153384", "comment": "Malware payload (Mirai)", "value": "2df1ef01aa9c88aa53f57c12b16648088ceb21d4078b500bc65bf279e1bb4e50ec5e246dfb858868cf08d0dcb26f0e81", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781795101, "uuid": "205f55e8-cc5d-427d-949c-18ff15063bdb", "value": "T1F263126B5DC8ED18F094073A20671B4B20A4A144BE82CAEADED1BE574D9BF5E2F508C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781795101, "uuid": "548bc603-1652-4006-b2af-0ea8d0463f6f", "value": "1536:xKt6U9BcqmQDUYEa7d3N3yOQR3GVasFcbp+nouy8ryz:fCc/QoY3/yOQR2VJFJoutg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781795101, "uuid": "864aad11-3e81-4821-9422-b904265ec19c", "value": 68092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781795101, "uuid": "c2c76fdc-bcfe-4751-aed7-8d542f02ef77", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781795101, "uuid": "d11835d2-f2c5-40bb-bae0-586f440b952b", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31f01dda-6aaa-11f1-a769-42010a9c0008", "comment": "Malware payload (KongTuke)", "timestamp": 1781741463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781741463, "uuid": "3cda1558-ec6b-4878-8c12-420125708869", "comment": "Malware payload (KongTuke)", "value": "a3216a38945232c3bcbda99d7b1c46c3", "object_relation": "md5", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781741463, "uuid": "ff2ea8e4-63bd-44ce-8892-1633e1b4c989", "comment": "Malware payload (KongTuke)", "value": "a9773c53a9611c737dc6a08622b3240e38430ceb0a3960f81391606cd1f02a86", "object_relation": "sha256", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781741463, "uuid": "402dae97-d404-42b1-8a64-39bc11c22b1a", "comment": "Malware payload (KongTuke)", "value": "bb1559ef0dc4c1a41183794794bd8bdc770222bd", "object_relation": "sha1", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781741463, "uuid": "a3d5e003-c317-49da-9e32-6905c9db013b", "comment": "Malware payload (KongTuke)", "value": "dcfb226a4aca8c7b18d94231539387079114c7ff4db65d19962990108482805dcc1e4dcda9fb1346d2eeab561849ced2", "object_relation": "sha3-384", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781741463, "uuid": "c83ed4b9-6238-4eea-911a-4b163716cf25", "value": "T1FCD19E2537123B6EE0836A8978DA503281F5217356212D90BB0CD7D26FB9EB3C3414D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781741463, "uuid": "c95a9b84-5826-4a73-86e6-2f4077233e8e", "value": "96:jTFyM04z82xYWhIW7LsMzGYpfSHU4AzNU4J6D7Q6EHukZyqAcfOvs0WDO4LySo1D:NJ/zMWhBGqfS04A7J8E6qAe0EO4WSo1D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781741463, "uuid": "5f6e2198-b2f1-4b35-8d6c-588095f12476", "value": 6309, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781741463, "uuid": "645af1c4-11c0-4b07-8f35-a82029633286", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781741463, "uuid": "239925cf-7aeb-4595-b0f4-e55bcc769151", "value": "o", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dfb4f47-6b1e-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1781791440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781791440, "uuid": "74d0cb7a-80a4-409a-9828-419c6375f3d1", "comment": "Malware payload (DarkTortilla)", "value": "f116f62d9ccaad036dac5a1965c2de82", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781791440, "uuid": "0a342c0e-62f4-45ec-a026-b31912ba111f", "comment": "Malware payload (DarkTortilla)", "value": "aa87d302ef084bc37bdd794fb1f7c600fd438e132e5dd8f51865ef475c7b9a43", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781791440, "uuid": "5d02c152-625e-4c29-9048-a9a7487c704d", "comment": "Malware payload (DarkTortilla)", "value": "5059272f852dcfb4d2f82f4b0836ea1597e10dab", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781791440, "uuid": "4c9a2611-f03b-49c8-bdab-7d3e02926331", "comment": "Malware payload (DarkTortilla)", "value": "f014769ea417c0cd70450a5a0b02cf84dfca053c2b983c5860d7a4d64c3df3bcfc2e5d43e6325cc753aca3af89f98fe5", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781791440, "uuid": "2e4a91a7-3ebc-4b76-b270-07300265bb98", "value": "T12C05E0195D863B59DABE0FB8C033148873F0D45393A6E72A2FFD40F1AAA3B85CD56542", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781791440, "uuid": "b4065bc9-14a8-4ace-baa5-12051e3cd2e9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781791440, "uuid": "6dea6484-36bd-4eaa-8cee-e1567ec4610f", "value": "12288:+842h5V2RHIEIGWGWK6cvyKy+H3vYUTuHSSjPCfpZqEewhjE:g+5UIECGQ+H/JTL6CfpVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781791440, "uuid": "e8c3af20-80ac-4aa1-ab30-de8a8fe12fb2", "value": 812032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781791440, "uuid": "4af35a12-e5d0-49b0-ab66-d2a152175b7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781791440, "uuid": "d1120864-a071-4e7f-a905-1f13a93d537b", "value": "Pedido de nuevo producto.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "731dec6f-6ae6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781767343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767343, "uuid": "1c49795c-8413-448c-8571-5fa7887264f5", "comment": "Malware payload (Mirai)", "value": "2e3b4da6028cc7d8f82d8cc0272f769b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767343, "uuid": "fd0f889a-b8ae-4b7c-bde4-5e86eaee34c2", "comment": "Malware payload (Mirai)", "value": "aa8f1b0f0196d64adabb90f6bf636990b80b2215c7022cf30f13d03b3e4eae12", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767343, "uuid": "06928257-258d-4220-8e51-02492ed2df8d", "comment": "Malware payload (Mirai)", "value": "95eeb3088fa4cdc54f72b5cb233980bb05c532a4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767343, "uuid": "e5b205bf-4a22-4d86-9a68-9aaab0922226", "comment": "Malware payload (Mirai)", "value": "452ef1e31f0ba6ae379905f35010a7bbd71156c77137be3acd15dc2118babf6ace7e68e438de7692efd53c03690bda67", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767343, "uuid": "a92a2cb9-779f-4f4c-be8e-b2d73da2eb22", "value": "T12DE2F17ED804DDBBEEF4B53727FB0490181A7E61A2DAFBD0601578632D1281C17B299A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767343, "uuid": "df840884-16ed-448e-b9b2-6c8a8f391602", "value": "768:LWWbgXTCMlNuK1NZeXk9q6RPgY2cGr97SbnhzyPaDmmKo2J:L/bMHlQeuXz6NgYUrVStz3qmKo2J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781767343, "uuid": "36479a2a-470f-44a0-bfa2-e249be4b0093", "value": 31316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781767343, "uuid": "216256d1-c3e9-4c2c-8ba3-2208610c542d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767343, "uuid": "6cd53a91-fa0c-4b62-beb8-c206a5006cd7", "value": "h0r0zx00x.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a77565ef-6ae4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781766571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766571, "uuid": "35c92c02-5807-4896-9f1a-be7a6c400c1c", "comment": "Malware payload (Mirai)", "value": "37445fa836ba0a43639a13886dc6fd9d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766571, "uuid": "815126eb-9896-4bbd-a109-daa37de40769", "comment": "Malware payload (Mirai)", "value": "aa98d220e3d693006ffbf826827e0128bd1b8a9f2fd28499e560016934cc3923", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766571, "uuid": "c6057422-bfac-4b91-8e0f-e50d186192aa", "comment": "Malware payload (Mirai)", "value": "9df4d383b83c483d1fff65da0577c1454c9f311e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766571, "uuid": "615f2045-9e50-4cce-9876-e19b57ef5617", "comment": "Malware payload (Mirai)", "value": "27301d86d5c990955ebc94f66655150983d597c44c858edd967e1f76b58a7b82df6e555565fcdd6084f99d309df3ab64", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781766571, "uuid": "d1c4b0ac-02f4-4457-a185-400abe14cf09", "value": "T114630756BC92CA1BC5D42375BF9DD69D3322B3E886CA3713FD144B2C368A50E0E76981", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781766571, "uuid": "0a9bd0b5-2667-484a-83d4-9ebc64d897bf", "value": "1536:SLifZGElZ3G5d0AFlxY4EhURgxL3erfkf7opiE5wy2R:SLixGv3OUpkf7osEf2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781766571, "uuid": "b46e4eba-95df-4532-8b20-c0f3de80d405", "value": 72280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781766571, "uuid": "dcd58b6a-00d7-4784-98a1-420487639921", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781766571, "uuid": "6828c274-5dda-4fd0-9fb2-edf35a52d482", "value": "onie_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f7fecbb-6aea-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781768920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768920, "uuid": "4b79ce36-cfc5-4daf-ac1c-32c3f2fd75d7", "comment": "Malware payload (Mirai)", "value": "546e19e396e62d4309520867a4c489ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768920, "uuid": "c7d67983-8213-4599-8ddf-586d208700e7", "comment": "Malware payload (Mirai)", "value": "aaccf44077093f8b1a903cb40e9a46adea30e486c6561adc52b20609deb78fb3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768920, "uuid": "ff2857aa-29db-47ed-a0da-f032f258fe39", "comment": "Malware payload (Mirai)", "value": "fa6246886665b4cae393424244175328e7f20d7e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768920, "uuid": "b18879a7-ac01-4c84-9377-e8e8a801a318", "comment": "Malware payload (Mirai)", "value": "efe0b0c5bcdd005f0097974a38a55e42164944e688932e80a1a7817be7bf36e6998e70f78da8d658b477ee8c01a8151d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781768920, "uuid": "c2466181-a90e-4926-b7bf-f0cbe9a6266c", "value": "T10A838D63D8256D74D039ADB0B0F1CB792B6365B580831DB9A5A7C27C8183DCCF56A3B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781768920, "uuid": "d959d577-66f0-4e63-9269-5f862198514d", "value": "1536:WFNPJ/e//LbW577PJ/z6w6XKHF8IjCdKCZzYzeA0DnovnSA8gK9:sNq/67DFz6Ql8IjRCMeJDMS3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781768920, "uuid": "60f7aa85-9506-4917-8ce3-e191d7a9f810", "value": 87332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781768920, "uuid": "6746ca4a-a545-48aa-b415-899f45f87d43", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781768920, "uuid": "50980cfc-8233-4ca9-a3f3-3c948f69b721", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e885a358-6b5e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781819079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781819079, "uuid": "c77392e5-1eb1-4a70-8be8-d1951e714459", "comment": "Malware payload", "value": "569bb140b73052811887902a7c749a95", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781819079, "uuid": "44f1cfdf-533f-482c-a0e1-736ba8792c2d", "comment": "Malware payload", "value": "ab28afe98dc7637499f6bd254e6202ff8f5797e595e4699ee7ba2632ba0b291d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781819079, "uuid": "3d245846-4343-481a-af59-76e181665d6c", "comment": "Malware payload", "value": "b985bc12e064c559f7e94dfbbf10055c126d576c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781819079, "uuid": "b63d53da-f0ae-444f-8f09-e4cbd87daa89", "comment": "Malware payload", "value": "bc652f781342a2c33cf889e3901c7ac678b02363365a12171e12ac2813e48d8384a65c84445aaee78227afe773789744", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781819079, "uuid": "b9abe980-3b28-454d-aed8-1b9d74b3641b", "value": "T104D02EE2A8630221102D8421F8CFA840F504833E0D428A2DFE2220B40F8038AF0E0391", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781819079, "uuid": "58a62eee-2026-47cd-83f9-5bcd6799e970", "value": "6:hTAVKvGpozF1guAulNXYq9DG+NjVsNXYrkJ:Va6GutPiq9DGmKi2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781819079, "uuid": "d9e1066a-06db-4604-9452-f262c068e165", "value": 266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781819079, "uuid": "701bec3f-5ebf-4891-a774-8460555e8a0e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781819079, "uuid": "6be71bab-d0c4-44c2-be82-b85ea43604e6", "value": "WSW0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68b37be5-6ae2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781765607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781765607, "uuid": "2de5d16d-2d53-4038-9bf8-aee0915bd95e", "comment": "Malware payload (Mirai)", "value": "03e07737f076ac26dca15effec273b14", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781765607, "uuid": "45381037-f352-4b85-b2f9-be7852ff7def", "comment": "Malware payload (Mirai)", "value": "ab692299315151ffe9be66b9e33dc27dd80e30fd92f0ea798fee2fcac0356db0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781765607, "uuid": "3e34c21d-bb2f-4f37-a60f-4d80ba91c963", "comment": "Malware payload (Mirai)", "value": "377f522124486782f7c42b8271bdd1dc5e7c0928", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781765607, "uuid": "d327ed17-22d7-4562-9640-26bc250f2348", "comment": "Malware payload (Mirai)", "value": "39349c51f98ef2a29759f76d335cf6e75a22913219ad19fb1fe67579fa967fdd36d65e39a4ada3fc178b92e6203a8b07", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781765607, "uuid": "00db6c97-fa9e-4164-ae0a-e7689760edce", "value": "T129D34A63DE229F1AC166E1F0A1B28E345B13FD6549470EFA6976EEE44043DC9F2053B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781765607, "uuid": "4289e1c0-9431-43cb-9ab0-55775ca9e583", "value": "1536:iKeDfuvwVCUQjtsYRL22fGqC5KZYweZ3HftJFSUWNu9wwKii/IBNJ:/eDGjUoRLXfGq9ZQHftCUWQ9Pi/IBb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781765607, "uuid": "ec89dfe6-635c-4786-b01c-e4a768ef2f5e", "value": 142876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781765607, "uuid": "96c0a0a1-06f0-41ab-b956-5d07cf6d6e67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781765607, "uuid": "10e6d5cd-1fc5-4859-b00a-f4716faddd36", "value": "nova.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef4705b5-6af6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781774423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781774423, "uuid": "63848a55-b030-4ea4-bbce-f14f83522e92", "comment": "Malware payload", "value": "9b3c1e78126fb58b9dada057fe673def", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781774423, "uuid": "2f6ec51e-055f-4c4c-9f15-0e898389acc8", "comment": "Malware payload", "value": "abc2264c785def14d88caa363ab0a68fb025701cfc6136c15a8c616562bd96da", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781774423, "uuid": "86fe5c86-6a11-4204-8333-5d19c104de77", "comment": "Malware payload", "value": "476d2ad5efca3b9bd9b70ba964e06fd955469d02", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781774423, "uuid": "363fb07b-8bf7-447b-8add-7f773b9578ec", "comment": "Malware payload", "value": "66f69a98ffbf64f40033a48952456ef4459d4537743cd098080c98e0c3ddecd80566a619d44e88da2cd46c8abb250618", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781774423, "uuid": "c8196fb3-1a4f-4e38-b5cb-5c0a0b670cc0", "value": "T19C762A87B8924552C4E43A37BCBE81C432630EBA9BC7565B6D15EE383EBE0D90E35744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781774423, "uuid": "7c6d45f1-df69-4198-903f-2d940b76bf84", "value": "49152:jopbUGSQCmcWRk/rMHd94jHk5QY70+q1d29HrSoP4GFsbm5zvuL25E8:0YmcWR8rid94jHk5Qo4GFsKEsE8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781774423, "uuid": "7ba265b6-effb-49fb-ae09-dd210244bbe1", "value": 7405752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781774423, "uuid": "e4b3fdca-2607-4c29-97ff-c168fb8f921e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781774423, "uuid": "eed9cb19-edd5-446d-92e2-c2a6b46e215c", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2985017-6b31-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781799688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781799688, "uuid": "2be00064-1413-4fde-9ce2-55aaf3133711", "comment": "Malware payload (Mirai)", "value": "4cff8c58e7954c62a036bc5f7709688e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781799688, "uuid": "67025640-1393-4f74-8e22-7f1efa7c00cf", "comment": "Malware payload (Mirai)", "value": "ac8cf1ea393c3c518fbc09ccc05f6c3fa537473f1c6436d98b78f08f400242ec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781799688, "uuid": "6b744d90-5212-45f8-a95d-e0b1e87a6528", "comment": "Malware payload (Mirai)", "value": "aca7bfb3277c52e970c72785388c4f7948209325", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781799688, "uuid": "317a393b-17d5-47c9-80f0-53059783c659", "comment": "Malware payload (Mirai)", "value": "92ac4523c76e351701ebc01db294b7626676ec39e0b68263a417b19d490fd3cc78d415a93333e046a3eaaa53a4da325e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781799688, "uuid": "5306120b-93f7-4d11-bee7-cb88e2f744c6", "value": "T1D304C6066B910FFBDCAFDD3746E9070139CCA51B22A93B363674D528F54A50B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781799688, "uuid": "963f185f-4011-49cc-b452-89ef95b9d957", "value": "1536:mK0x6RY7ofbXhFmStvJtanth/d1ED6clk3CbbscUpW+bQ7ZQTgWsczd0vgk0+5kT:70F76h8SxzathcQcP73Od0F0XKTC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781799688, "uuid": "4b02a5e0-738c-4ef7-bebd-54b427040713", "value": 177848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781799688, "uuid": "92decc7b-ed27-4e48-8346-99e9fe2410f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781799688, "uuid": "2d8120dc-4a58-475f-8afb-dcb9d08fa903", "value": "main_mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf816a92-6ae6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781767498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767498, "uuid": "fd1997af-73b6-4f42-aa4c-9946300ead55", "comment": "Malware payload (Mirai)", "value": "5255b83eefb121a164c1bb62a07a084c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767498, "uuid": "f1e9f03a-03a8-4dda-b86c-8893deade415", "comment": "Malware payload (Mirai)", "value": "ad23a0684bad219fb78115677aed67aa6ff80227d3c15c00270cc45dd8e0a1ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767498, "uuid": "1f8e81fe-bc01-4b50-92cb-e4bd773d68ea", "comment": "Malware payload (Mirai)", "value": "53a9f9a2422bf5d9de4a86999731b335ca81310c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767498, "uuid": "59d94835-4129-42b3-8146-e11c73da2114", "comment": "Malware payload (Mirai)", "value": "8964aebd14f34ba1a695321241865f3e41268349a2bf28fbfc52d3b9ca970f0952b96eaa24a093fafbd202f3e1f07a31", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767498, "uuid": "87811a18-0692-444f-97f1-e9f318bef103", "value": "T1E4536DC5AA53D9F9EC100A743077EF729BB7F03F2129EB86D39995329D02602E11729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767498, "uuid": "9d71ea40-75bc-4072-a2ab-c2522113238a", "value": "1536:kk2qInEKyMk1k0k+QbgKOssks8ArjhwZYcAlm3:N2qqEKyMJxNgHssknmjhw2N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781767498, "uuid": "050c5519-f210-45a4-8c92-34d515d737df", "value": 66320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781767498, "uuid": "cc54c01c-e46e-4725-af90-c78177224987", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767498, "uuid": "d1d9bd58-a519-4a37-a939-14d8c63dc236", "value": "h0r0zx00x.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67a7b793-6afa-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781775913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781775913, "uuid": "f677ef86-b362-40b8-a83e-2941a169abad", "comment": "Malware payload", "value": "289a29daa885235b8bae9b9b2d20e2b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781775913, "uuid": "849ff4a9-157f-4705-bcd7-16f75120da88", "comment": "Malware payload", "value": "af6c7f253a661d2e32e2b8940cb10b1f4f771880ba6f3e80310766ba1453f9b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781775913, "uuid": "89f06c92-ed9d-4487-b4e0-07d15624c9ce", "comment": "Malware payload", "value": "0b39c43f07fb1b2227823b0480cfba1762524656", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781775913, "uuid": "5b4af6b6-c765-4ddd-ae92-afac87051c98", "comment": "Malware payload", "value": "f223d85046710bca91b06a9af778bad513ddb41a3f442fdacbf1c7e989a284cd61eb42c7066307eee33c61a27358634c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781775913, "uuid": "980e94b2-c9e9-4732-a61d-e77672c5a66c", "value": "T1E8F27E03EE4206D8C081C675462F9B27F9397D681B2512FB1FA17B0B2EB6BC4D23B565", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781775913, "uuid": "0ae0ecec-6cbc-4d2f-a337-a39b216ad317", "value": "e81d90b230abc81b286482b9dba12e35", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781775913, "uuid": "08055095-4d9c-4c2b-8be3-5a59a05947cc", "value": "384:KDYSpD5nXeyyAhgnsDjj2hcyEsvXmDSw+tgK6GtmQj5Of998eRTHFHeNQXwM:UBXT5ssDewm4QOf3beQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781775913, "uuid": "d0c7e04b-b258-45d0-b055-d736ed8530c1", "value": 35328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781775913, "uuid": "50fa3634-f882-4c55-af89-c0ccd1eef7ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781775913, "uuid": "3a53e3cf-5973-41da-8ad5-c10a9267f532", "value": "newuiexe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8980c057-6b22-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781793150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781793150, "uuid": "d2b4b53a-4d59-424e-b574-8ec1d69980f8", "comment": "Malware payload (Mirai)", "value": "1284ad4cd8d97aa25d06f841f62484bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781793150, "uuid": "78f2266c-e996-41b8-85e6-ddb3272053e5", "comment": "Malware payload (Mirai)", "value": "afd19c7e46fef49fcd095806fe43735f68bcfd5a6d4ca3d7b7fe06fc0bbb7ad9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781793150, "uuid": "40eeb31b-b1d8-41a3-977f-e3c33b33bda3", "comment": "Malware payload (Mirai)", "value": "60714de2b7b8befd3d01863c1ace3ffd115437c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781793150, "uuid": "ba1c4aac-ceab-4836-bf7d-736489608868", "comment": "Malware payload (Mirai)", "value": "c52f1059a280c5070a02243336507eead0aff06db1a02839f8013cafdbdb8fa8efdfc677cfa18986042cadcfa6b4e308", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781793150, "uuid": "794d57fb-5b1b-4c7d-8307-59c16b00b109", "value": "T148149E23D8786D98D26598B0B4F48FB81B63E51081471EFE6A97CA7840C7E8DF50D7B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781793150, "uuid": "82830425-6eda-4e86-ad4c-8ebc089ff8da", "value": "3072:HSEWZwLhNlsXZ/mc1rSl0QilczDih+eWSJHI9y1AaY:yIh8p/mQQ0Qiq/LSS9y1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781793150, "uuid": "99c09db9-1c3b-40e4-ab3d-ce184fdd396a", "value": 193828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781793150, "uuid": "a1ea1b5b-6e02-4170-9053-aea117bb9951", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781793150, "uuid": "24ad54f1-980f-43f5-b436-79d42f286b31", "value": "psh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24d043ab-6b1f-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1781791693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781791693, "uuid": "0c884ea3-9a40-4369-bf45-dd5f2fdefe58", "comment": "Malware payload (njrat)", "value": "b403e6dbe08ecd6f86b3d6858d2e4c7c", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "not-njRAT", "colour": "#DE0E7B", "exportable": true, "hide_tag": false }, { "name": "proxy-aiddroneheat-top", "colour": "#CCB7F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781791693, "uuid": "44089987-1242-4e9b-b45c-3bfbb04425ad", "comment": "Malware payload (njrat)", "value": "afd4b76a1c8586d6c9ceeeca30bca4a00778b097a957890c5dbafd76ae8bf918", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "not-njRAT", "colour": "#DE0E7B", "exportable": true, "hide_tag": false }, { "name": "proxy-aiddroneheat-top", "colour": "#CCB7F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781791693, "uuid": "88023b54-db87-4f00-96af-00d77ca616d7", "comment": "Malware payload (njrat)", "value": "97cdf92bed154736457cf67ec2a211b8136ed7ea", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "not-njRAT", "colour": "#DE0E7B", "exportable": true, "hide_tag": false }, { "name": "proxy-aiddroneheat-top", "colour": "#CCB7F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781791693, "uuid": "8bc5390a-ac4d-488b-90bb-b023c4a740f2", "comment": "Malware payload (njrat)", "value": "2beec504d281d4ed5df336785b8302c1376870883f02a9dab4dc6fc41f163ca65539f96f0d9db85cbbc7ffb22ed77c38", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "not-njRAT", "colour": "#DE0E7B", "exportable": true, "hide_tag": false }, { "name": "proxy-aiddroneheat-top", "colour": "#CCB7F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781791693, "uuid": "b5f6f9e4-1d1b-43e5-a034-d44b26070376", "value": "T1DD77CF02B3E80066F5BB563495B78612EA3ABD611B31C3DF1294A26D1E737C0AF35727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781791693, "uuid": "faec166f-2de5-4b2d-bc2d-68d572c56a18", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781791693, "uuid": "f7032b8c-36a3-451a-8897-aecae9b2f872", "value": "393216:QLpqAluI/Gpui8UQsyTE/kNWLWTKVenaUAkGwVfD:OcAluI+pui8YWaVO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781791693, "uuid": "816071d0-2157-4917-aca2-ee8c971812cc", "value": 34369536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781791693, "uuid": "2b93e03a-1731-4726-98ae-fb5d881bc125", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781791693, "uuid": "986c93c4-c315-44ab-8975-887fcd5482fe", "value": "cx-programmer 9.1 free download full_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "663499cd-6afa-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1781775911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781775911, "uuid": "6879c570-f09c-4396-a1a0-123d5683e9ff", "comment": "Malware payload (LummaStealer)", "value": "1c3dc9c668e0ab00da5149895c11b56c", "object_relation": "md5", "Tag": [ { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781775911, "uuid": "82fb5618-3ff5-462d-956e-5cdfc5cefdd5", "comment": "Malware payload (LummaStealer)", "value": "b0014172ee7e57852beb41c02301d4727142606cf5154014fef6cb9959b185d1", "object_relation": "sha256", "Tag": [ { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781775911, "uuid": "781ba8f5-36dc-4db7-aa0a-79586ab583f9", "comment": "Malware payload (LummaStealer)", "value": "4a99d873f1c26bdbc276a2e0388ade6db5b47090", "object_relation": "sha1", "Tag": [ { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781775911, "uuid": "6d03deb1-ee3f-4541-8183-5d9531c3ff0a", "comment": "Malware payload (LummaStealer)", "value": "c2d72f4368db60d3a3eebbdffc6e8e99b6cfc47576a243bf37146ade4f59dc2fe1338711a1c4cad240f7bd2f15827685", "object_relation": "sha3-384", "Tag": [ { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781775911, "uuid": "ec37b3c0-6d02-4049-b3f1-6fdd578e455b", "value": "T141D57A01EEC748B6E443563259A7A2BF2338AD050F36DB87EB443A79FD772D51826309", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781775911, "uuid": "891356ed-fe2e-411a-8730-399dfd16d6fd", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781775911, "uuid": "86a86112-4ee5-4586-8a87-d304805743b6", "value": "49152:Q/4YXKJHHPVwc+n5euaXlhOjcQaNLouJjdWh+bQ/pTMz:srOHHPVGEnOjcQadfjdWhV/Oz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781775911, "uuid": "8efda1be-6025-475a-ba9b-f36c712a2f75", "value": 2992496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781775911, "uuid": "94fe3a73-b96a-4c6e-9c0b-e370f588a343", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781775911, "uuid": "c182e331-9f0f-473a-aa7e-5cf076dd0810", "value": "beb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f03c09e0-6ab4-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1781746078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781746078, "uuid": "35fede5b-5552-43b8-84ab-6d067d4e62d2", "comment": "Malware payload (Formbook)", "value": "d9c7dff39dee75116bc2850339b6a37d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781746078, "uuid": "d82ae2f1-d804-4477-9b7e-0e0921c53a1a", "comment": "Malware payload (Formbook)", "value": "b0907be21611ebfd894794d1d17d11d7a471ea30be20c4adab119b61ea3f90c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781746078, "uuid": "9ffb5bda-ddf6-40cd-ba49-37589f258738", "comment": "Malware payload (Formbook)", "value": "99d8565cb9c751360a2a8b2ecffd8fe1f921942f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781746078, "uuid": "37f7c421-629a-416b-b203-251a65d5fb67", "comment": "Malware payload (Formbook)", "value": "d986dab60948ff2302cd19e655a08e7c47acb0b8fa7dac12c06b1e242e136692d8246fb1cb24b0cf0884b26e948f5d7c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781746078, "uuid": "ab56a0fd-c96d-4ef8-955f-2c5ffd4f8a54", "value": "T1D625239DB3588413E5A657350932E47847BFAEAE2835D281CFE8FDDF3666B542800723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781746078, "uuid": "61c21a10-a18d-4d3e-b6c9-1ca74cb10834", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781746078, "uuid": "4ef83ded-5841-438e-910c-2754cf38068b", "value": "24576:sIFzrn0biZ5ZiebFbeRs8U/E2WhDJwNgmKxUtp:sIFzrn0eZfFss5iDQTtp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781746078, "uuid": "cb350d07-73d1-4749-91c5-056337d290b4", "value": 1010176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781746078, "uuid": "fe1ba239-951f-4b0a-9321-5a1d992420f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781746078, "uuid": "5616365f-8635-4b8a-b631-f6d1b0094769", "value": "PURCHASE_ORDER0923118765pdf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "871eb328-6ae5-11f1-a769-42010a9c0008", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1781766947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766947, "uuid": "2ecb2322-17d9-4d75-9448-73ca49f9e853", "comment": "Malware payload (PureLogsStealer)", "value": "5984a4df01e5c49c4c760424f3800256", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766947, "uuid": "2e63ed41-9d93-4852-b263-336c2325daf9", "comment": "Malware payload (PureLogsStealer)", "value": "b0919df822964a2ed3ea5eb4310224d6f7dffaaae768ca799dd7fe3a9b8014c5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766947, "uuid": "10ed229f-710d-461c-ba20-64c7492018a9", "comment": "Malware payload (PureLogsStealer)", "value": "bed9cfa1d11e727d8e460336b99fea32b636dfeb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766947, "uuid": "90cdd435-e28a-40e6-afda-8b8d4d3f3356", "comment": "Malware payload (PureLogsStealer)", "value": "ed9e91984d787cdf4c1d83a2588bb32d0fad8d129ae7199ba8c5b68e6817c0710f3409091e538b0a3c4476149a0bc502", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781766947, "uuid": "01fc0f13-5fec-4012-8002-b0559c7f765f", "value": "T1B805E83CC964412EE176D729856A044FBC932E0B523CE84B64CB275FAF639467BD232D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781766947, "uuid": "dc1e8281-4f70-4ac2-bd86-8289f136307b", "value": "3072:mujuevQklMTuLtYKi8jAll/AuYqJf0s/6bXMWvE+2WHkWZkl6AxNsKGlyllKjbCu:TpSllc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781766947, "uuid": "6d7d42c8-6dbe-4f9d-af02-0f3b80b10013", "value": 797780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781766947, "uuid": "13c08805-6a6f-4c5b-becd-a4a38ec6a555", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781766947, "uuid": "c1ae9a8f-b9e3-49b8-b822-9ca87ae4709d", "value": "Requisition_List_2026_Order.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a06c2221-6b1f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781791900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781791900, "uuid": "ef42c74e-90c4-408e-bed5-7c9dbd596c2a", "comment": "Malware payload", "value": "87ef528741cd4c3cd54e810f77b3d000", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "proxy-aiddroneheat-top", "colour": "#CCB7F5", "exportable": true, "hide_tag": false }, { "name": "pw-6134", "colour": "#B0A038", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781791900, "uuid": "967d7522-4d0d-4f13-8bbd-a4da657288b2", "comment": "Malware payload", "value": "b0cd80693a3c7d0a4ebd495a9b542fe4d3a0acfa0b35a8054cc315ce022400bd", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "proxy-aiddroneheat-top", "colour": "#CCB7F5", "exportable": true, "hide_tag": false }, { "name": "pw-6134", "colour": "#B0A038", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781791900, "uuid": "cde1a1be-0c12-4bb6-bb6b-8768c0684231", "comment": "Malware payload", "value": "fd28752b70c9680d0644c0d92c4229958add1633", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "proxy-aiddroneheat-top", "colour": "#CCB7F5", "exportable": true, "hide_tag": false }, { "name": "pw-6134", "colour": "#B0A038", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781791900, "uuid": "72caf095-72a7-4d2c-b155-65cec4963978", "comment": "Malware payload", "value": "3c54cbcf59ea665e1684b27fb9b4f04ffbb1185c06f00f914b18a24424aeab833f134b94eb9678874bd06bf1af8cb127", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "proxy-aiddroneheat-top", "colour": "#CCB7F5", "exportable": true, "hide_tag": false }, { "name": "pw-6134", "colour": "#B0A038", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781791900, "uuid": "7d534fe2-349b-4a2b-9517-26c49fbde448", "value": "T16A36334B58B224FA4264E76ACA459EA14DDA4C3C9CA6D4D8CDDFE041DFC0A7F0E587B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781791900, "uuid": "f91f346e-9ab9-40a6-aded-7b0aa58387d8", "value": "98304:OxDmdla/W6V1I9WqfsQO6XuwabQiMUTHCpbla3ns2R1KS1LpDTLamznawa2O:OxDmdY/W6TBqfsQb1BiMUgQLKulDTLaR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781791900, "uuid": "0349f58f-69d6-4a0a-a157-7cf70fac2f6d", "value": 4875107, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781791900, "uuid": "824d271b-0065-4f37-9e2e-d6fceb62df4b", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781791900, "uuid": "5fe9e87e-301e-483d-ba74-a97620f91cb1", "value": "recuva_professional__technician_(2026)_full_espa\u00f1ol_[mega].7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8f68b50-6af9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781775620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781775620, "uuid": "70be86b6-a0e3-4fef-8a33-cc987ccc240b", "comment": "Malware payload", "value": "9d9e3cb699ae7a4f80d37a752526b47e", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781775620, "uuid": "6d904bd0-abaf-47c2-8e01-3e908f2101cb", "comment": "Malware payload", "value": "b190269b9d364f2323ddf889489cb04e6b8fa01f1b36d38a83b01b9a6180610f", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781775620, "uuid": "e38608a7-fa57-44dc-ba34-2ff041d962e9", "comment": "Malware payload", "value": "8d38bea24d0173a41275eab9a79a195baf624040", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781775620, "uuid": "a2451602-35d4-4bda-9eac-46f610e87306", "comment": "Malware payload", "value": "c8e5970e17fb1938775b647360e29888a6dd2889d62e2cf8e3c636e32c9a05b75889cb684c894aa51cfa744d58c918aa", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781775620, "uuid": "2d76ac51-d97e-4bec-959e-172a1768c5db", "value": "T1BFD55A07ECA148FAC0AAA33189B696567B35BC491F3227D32E90B3783F766D09D35714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781775620, "uuid": "dad6ffbf-f22b-44e3-92c1-69ec2fc3c76f", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781775620, "uuid": "77ecfed4-9075-4001-8b9d-4f8da069486e", "value": "49152:MBe3EfHvbcVNFE4WwWaPGmI5U7xvuKIJHQa9:MelVNFWD0ul/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781775620, "uuid": "970cc331-3493-4819-a79d-6a83ba9460c0", "value": 2852720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781775620, "uuid": "3e2b4625-0bac-4cdf-9aa6-0ca20fc634eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781775620, "uuid": "e3c0e0ae-dff1-4b70-a238-456959c5e42e", "value": "bjbh.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb8b5c4d-6b17-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1781788536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781788536, "uuid": "76c80326-2cf6-41be-8144-6d27f0a91ebf", "comment": "Malware payload (WannaCry)", "value": "db133a7ead8a83e3dd1a6b2bc4ee41c7", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781788536, "uuid": "6a0eaa9b-c720-42ce-8f9e-dc4f1ddeb708", "comment": "Malware payload (WannaCry)", "value": "b19285bcdf3fed2f9bda055d9f61118a616664ee0a6b594f9731ce20cb67daf5", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781788536, "uuid": "18f32395-029e-4d2e-9294-bb2589317cab", "comment": "Malware payload (WannaCry)", "value": "4bd8ece432c1638d9e0b7e65e4f13483a7ae9870", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781788536, "uuid": "4f205b81-e457-4fda-a045-6c4f22e6ea47", "comment": "Malware payload (WannaCry)", "value": "4db69fa0b11815906dcde9c1caff53ac2f9be5fdf67e1a3ed79f0d8546e1ae070de3c0f739021b612d8bf74b72b4a304", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781788536, "uuid": "b57f7c94-b71d-4ebe-928a-bdfe39ba293a", "value": "T1CE36239932BC81FCD10619B884F78E12F3B27C6A12FE5B0F9B40457A1E13B55BB64B52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781788536, "uuid": "b02ce836-c879-4303-a010-dd44cf678e26", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781788536, "uuid": "bacbd27d-7683-44d0-8907-bd150a95e062", "value": "49152:jnsnsEMSPbcBVQej/tINRx+TSqTdX1HkQo6SAARdhnv:DMfPoBhztaRxcSUDk36SAEdhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781788536, "uuid": "189a8069-706f-465e-b68f-4553de521c17", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781788536, "uuid": "4fca28ec-2032-48ed-90b6-43162813a661", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781788536, "uuid": "e4fbc0c2-527e-4dd8-918f-3038090b34e0", "value": "b19285bcdf3fed2f9bda055d9f61118a616664ee0a6b594f9731ce20cb67daf5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46ab78e9-6b23-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781793467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781793467, "uuid": "3c91ddd7-2049-49ca-a547-e49a73787a40", "comment": "Malware payload (Mirai)", "value": "4de6c22283cb8c817b2b91f75d303811", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781793467, "uuid": "85535a08-b184-4cf2-9ab3-7841e495682f", "comment": "Malware payload (Mirai)", "value": "b1aac09192c2a7f10de5422826db16bdb6bedb31319bd37b6152051aab067e29", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781793467, "uuid": "dfea0b20-dee0-4ff7-b272-d53114140610", "comment": "Malware payload (Mirai)", "value": "d5afdf839c346d653982fae19274f3a29c61b077", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781793467, "uuid": "12f21d89-488c-4c38-ae7a-07e06b8ce904", "comment": "Malware payload (Mirai)", "value": "dab0a8dd8a8b2cba054f480e23a41bfe9a52638e1b54b33eef1b1400404ec90da71d3e111e60e3c41cf71d0475edb23d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781793467, "uuid": "ba51e106-8fd6-42f0-8f99-4aa63f18e1e8", "value": "T171242A46B8819F15D6D012BEFE1D128E332717B8D2DE7216DD205F647B8A86F0E3BA11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781793467, "uuid": "c257a7ab-f611-43f7-ba9f-d1b5b8a81081", "value": "3072:nQlKlfgBQx6T+ermvJn33oQIcd7S6RUPuk3sX5/kMeaDXLzYL1OSMf5EH5QlYym:6ag+6Keqvh5c7sXdkbavzGOjaH5Qlw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781793467, "uuid": "cae491a7-9981-4026-b537-40359e510419", "value": 224380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781793467, "uuid": "62afe23d-2ae1-4940-8295-58f35be2d5b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781793467, "uuid": "19ba3adb-ee25-4105-b91b-7586cbeb4650", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ccaacc7-6af2-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1781772325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781772325, "uuid": "3029fedf-aa24-49a2-84f4-d4522e9ac3af", "comment": "Malware payload (AsyncRAT)", "value": "4ec98457f0fd1edf2f4c282daea7cd55", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781772325, "uuid": "60dc8e3c-ffc4-4848-96f4-4096e14c183c", "comment": "Malware payload (AsyncRAT)", "value": "b28ce2eeb9e4b5552908aa5c0b1515df29a2a9d7e6a8b4b4501ef8ee01e9810d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781772325, "uuid": "c1e4dfe8-aae3-4be8-8557-eca8cb3d6bf0", "comment": "Malware payload (AsyncRAT)", "value": "9cd4c8a03aaa3f0997cf5ac61ca8f7aa7e6db52b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781772325, "uuid": "e01a328d-719f-404d-8d9c-d5301074c684", "comment": "Malware payload (AsyncRAT)", "value": "dafd0957620351a98616cf170ceaf8ca865c451ef495bfdd5307b0bf68249366c7a506ba1348e7cfc0ebe4d0071e81fc", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781772325, "uuid": "6656b780-6b1c-43ec-b2a1-4748a5030370", "value": "T1A0D62321A68FC636E16D017BD83EAE0EA1397DA7033041CBA3F4799E2D714C15A7D792", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781772325, "uuid": "d82e4f78-63c2-4a45-a47a-b07215edbdcd", "value": "393216:B12pvEdyg59GgOLbjBiS63T1jZsjT713:B1WWCBif3T1jZsjTB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781772325, "uuid": "831f5402-9981-4885-b6a6-b5d42696c62b", "value": 13405696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781772325, "uuid": "6a0bd749-23f9-4bbd-9e28-962067bcadc5", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781772325, "uuid": "c9ff1773-ac51-43db-8eef-2f7a0d1b4431", "value": "LetsVPN.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7255f573-6ae8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781768200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768200, "uuid": "3ef604e3-b02a-4336-92b2-593e6e3c8a4b", "comment": "Malware payload (Mirai)", "value": "768a0ba4fc36dde992631d8b6e706e91", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768200, "uuid": "7fb316a0-e618-4b56-aaec-02cd946140e4", "comment": "Malware payload (Mirai)", "value": "b3f59415949a6a17ba9e2859fe727bec1d375227e685c92ecd61bb8e73e531a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768200, "uuid": "049dfe40-09b6-4a34-bd8c-beaf60b1382c", "comment": "Malware payload (Mirai)", "value": "06cf0d14176762846228b467f5e1ad1fc6872150", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768200, "uuid": "6824daba-ba04-479c-bcfc-3be3b652d39c", "comment": "Malware payload (Mirai)", "value": "7c95c0677e5220cf9f17e531a47effdac09ca3fc9fb1f94ae624c65ee845f4d880efe7e2a289e05d17908dfb9289f3e5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781768200, "uuid": "64d3310a-4756-4d8c-b028-3578b2e755ee", "value": "T128D3295AF8C0DE63C6D436BAB95E018C336257B9D2DAB0039E146F2437DBD9E063E506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781768200, "uuid": "a8155951-0d04-48c1-ac9f-2acc60be102f", "value": "1536:KKgRre08RdzoKqd64ONiioJGfJRbak8+AHG3XkhK0DBj0f3ucb+8bFQ0rSTyNZAl:KKcrKFSiBjRx6yooucptWRub8YaN41", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781768200, "uuid": "0a9d9232-92c5-48ef-8455-f66f2c0e8e4c", "value": 140584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781768200, "uuid": "d5c9e831-c52e-484b-9143-c85b1fd4341a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781768200, "uuid": "88691379-5922-4b6f-bb79-c37a6884ba47", "value": "kaizen.arm7_srv", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72ff9e27-6b18-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781788817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781788817, "uuid": "aeb85bd1-4114-4e81-9c60-fec6338839dc", "comment": "Malware payload", "value": "c58fd6f24ceb852ae7b1ae7c0fbf956f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781788817, "uuid": "96b9e405-0ae4-42ae-a5ce-12297deca9a8", "comment": "Malware payload", "value": "b4039a16cd5badb3bbdc2a4c70bc0f869b4df0e32bceb663c8cd17d98051d8e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781788817, "uuid": "ea65f440-7c6e-48b9-a70d-f957e8991ef8", "comment": "Malware payload", "value": "e13ddbd35bd7bcaaa0c8695bc3ff9d374bc5ceef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781788817, "uuid": "6707c89a-862b-4735-b573-e899313b697e", "comment": "Malware payload", "value": "12286b724d584183d6e6a419518482b9e736c6b4e0e7ac8bdeecd3a0872d4b6ff9397d4453a9f2d8f96da273b2315f5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781788817, "uuid": "425a17e1-bf07-401d-b361-ed1a62310539", "value": "T1A6D49E1B72968E11D2840236C1D7454297E1A84B7A37E74E7A8017DB2E073FAEE4B3D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781788817, "uuid": "8fbb40c1-496f-4332-859b-65f4e78760ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781788817, "uuid": "533c6cf0-8988-4ee1-b4cc-1c2f50a9826a", "value": "12288:kbtNd5bFP6bLiX/ag9oVljRuyuUfSaudvbTE3kXun988mNqC:kbbQb+XP9oV/kUaaudE0VqC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781788817, "uuid": "616caf13-d216-488f-8b23-69dc8e7b9621", "value": 640000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781788817, "uuid": "1a5b59b4-70ed-4d61-9925-71177cbd5c7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781788817, "uuid": "7265a7fb-786f-4b38-a72a-5a9463421255", "value": "Hnfpmer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "378611de-6b2d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781797737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781797737, "uuid": "0c63dd42-7a3c-4488-b6fa-3735f527997c", "comment": "Malware payload", "value": "de31191a44f8fabe7c49ad6935bdd4b3", "object_relation": "md5", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781797737, "uuid": "c99c2ed3-46b8-47bb-9504-800671dc5a36", "comment": "Malware payload", "value": "b424d821f8772824e213bbf9de9e6a431ac634107020689b46995e6bcdcc6232", "object_relation": "sha256", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781797737, "uuid": "ef6b8a9f-5a0c-4f24-9e4d-beebc56d1db8", "comment": "Malware payload", "value": "96915e28baf63b05b88859f1da6bc6b4f539e9be", "object_relation": "sha1", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781797737, "uuid": "92e170e1-24fd-4776-8274-3cf332ec8023", "comment": "Malware payload", "value": "4b1bfce18634bb1f24b22fe07f905b0a663128f3b88fcbd0cc79eceb36d04bda4670d170d442e7807afba0a673229843", "object_relation": "sha3-384", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781797737, "uuid": "385f6b3a-78f9-471b-9470-5ff362cb0c2e", "value": "T1B5C4124B76B521EED5328239C92129A9C332F8351611DB6F07A5425B0F7F2D28D3BF62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781797737, "uuid": "381c336e-e871-47a6-97c8-c3d1221444b2", "value": "e8a4cbdad25c90c1b143d5701f1c2ba5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781797737, "uuid": "a1fe4a0e-2632-4e71-ad0b-cfcaa38ac8c0", "value": "12288:hzQ+73GTthYiwEwJPFZRdIu8tAjjD6U0UCjIg1ibY6nmKd:yo3GT1wEW9WI3EIg1ibLm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781797737, "uuid": "0a8281f1-b90e-4b39-b4cf-07c0d3bd9c71", "value": 554496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781797737, "uuid": "4f6a6f1d-9349-4cea-ac7f-08578e31ecc8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781797737, "uuid": "bc47ad67-64e5-4723-a373-b48154a68758", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "147a07a6-6b23-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781793383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781793383, "uuid": "4c3c11e7-8b2d-438b-b05b-0f0935c8b9d9", "comment": "Malware payload (Mirai)", "value": "d4f85911cd0912a60fc3d3285c7cee31", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781793383, "uuid": "3ac7a70c-f7a5-4187-905c-fa97e4317687", "comment": "Malware payload (Mirai)", "value": "b495523dbb070639fadef60efb84c9a2c9da138e39c3acc51221c862c4f83506", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781793383, "uuid": "bd970688-6bbe-4d3f-97b5-c721cb915aca", "comment": "Malware payload (Mirai)", "value": "cd4188681a3b6653d35fecc1c8da32b6093c9e98", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781793383, "uuid": "9a12fe0c-e840-4d65-83b6-018811f08a24", "comment": "Malware payload (Mirai)", "value": "14b52e01838a78c2088df6c1f807218abdcf0471fc0e4871ced0f6f8c511ee36278bf8b5eccf7fa30dedbc459de8c443", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781793383, "uuid": "481f76de-8474-451b-a846-a9eb195ba939", "value": "T116831275E3F08EB28A789C3DE41956C39F9F6CF95017A8B12F09967819E2C88C4F401B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781793383, "uuid": "fcac2153-7fad-4a82-b798-c917cc8d239c", "value": "1536:HG8EhT8IpKg5DQYHQSbUNTzKTtswtUssVg4Plz7FxsUlneLM9:RMoIPDLHQpItswtzag4dz7AnLM9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781793383, "uuid": "71f23a56-8435-4427-b90c-a2804d1eb6e1", "value": 85128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781793383, "uuid": "0ad335b1-f34f-4787-a8bc-a85e2c5428de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781793383, "uuid": "58254f83-75b7-42b1-969e-bc194ae37a89", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f172195-6b1d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781790824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781790824, "uuid": "66d94762-d66d-4fc2-9f0c-389479a5ad28", "comment": "Malware payload", "value": "e30ca8bb2252dd2517e0908e9f03db18", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "mx-pulsefit-cc", "colour": "#AEE793", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781790824, "uuid": "afefd95c-dc8b-4212-b1ed-fcecebc9d379", "comment": "Malware payload", "value": "b4eda2b75dc48f241dfe0c95341cbf3fd169b2f49161a1ed6d767af5b3d81ccb", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "mx-pulsefit-cc", "colour": "#AEE793", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781790824, "uuid": "0d090c31-0e1e-4150-a809-68c847bd3921", "comment": "Malware payload", "value": "d9ddce056062e2552761e4743ff9e8d394ba9126", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "mx-pulsefit-cc", "colour": "#AEE793", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781790824, "uuid": "9f3c9731-8eb3-4877-8be3-b7fb81e9313a", "comment": "Malware payload", "value": "1d224b76c078e86836ed8c56a12e77068551203248fce625a4771e16f1ef3ac15f5d6ad45dfe813902b4f00dacfe09c8", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "mx-pulsefit-cc", "colour": "#AEE793", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781790824, "uuid": "f9c72804-b00e-4160-98c4-b52b91ed36ec", "value": "T146473325F44532A5FC0ED5F905F12EA803E46D39126B93C832B8B94FD667EAC8E64D31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781790824, "uuid": "d0e51acb-7a16-4967-825f-81415e8017ab", "value": "786432:AEdVef/x1ouuJRT2kKnSZFrl4/oGAbiRinUiU:pdCuH2kKnSjlpGA1U3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781790824, "uuid": "447daa6d-c20a-4317-92d2-aff5204801ab", "value": 25165894, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781790824, "uuid": "32808f96-4e5c-4468-9769-268628912272", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781790824, "uuid": "a3edf640-7513-4a62-bf5f-5b2805c8c45d", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4a23da3-6ae8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781768312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768312, "uuid": "4fe6a30e-eaee-47a1-8e05-04db02880897", "comment": "Malware payload (Mirai)", "value": "63b623f0f43bafa9203218068ecc1be1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768312, "uuid": "aee053e0-ccb3-47a8-a7ed-526a9e91660f", "comment": "Malware payload (Mirai)", "value": "b76961d5e9aabbb3e3532262dd294787814793a88db5637a3866c811b4fb436b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768312, "uuid": "18e8ec3f-f35e-4ece-bd5e-53787dd9b636", "comment": "Malware payload (Mirai)", "value": "e24e04dd8f8ca4d35a630ffeb5c1b9952e5729e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768312, "uuid": "317435a5-ce60-42e9-8458-c95e258fbce0", "comment": "Malware payload (Mirai)", "value": "8a0eacd0d2ce0a003885cfcf17ccc0db6d43feb8bd0e3b5094c7bcde53f7d74d37b5a2caed1e3e0efcef42664715ef77", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781768312, "uuid": "3579652d-c2ca-40b4-8194-89dcce029988", "value": "T15AA35BE7F800ED7EF84AD73B44138906B230A7910E821A76631775ABED7B1941937F4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781768312, "uuid": "ff505c19-8645-4557-a135-bd7a28ca982a", "value": "3072:pKN1mmtTfCWTMU5yT6ImObJJAqE1yb2vhU2T:Ymmx3yTThbJd+0KU2T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781768312, "uuid": "d183a709-6fcc-4cde-8a39-440d32a2d051", "value": 104508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781768312, "uuid": "1aa4420d-57f2-4eed-894e-2b4705df5389", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781768312, "uuid": "50fca071-c6c2-42c8-a6b2-fe1295afcd88", "value": "rep.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ace8bc07-6ae4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781766581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766581, "uuid": "1745dade-5329-41e9-be8d-968e1a52dd05", "comment": "Malware payload (Mirai)", "value": "3d0ae16920507c94e915d061a5b4a69d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766581, "uuid": "e01c27a4-5aa1-47d1-8fcc-13ff3cb00351", "comment": "Malware payload (Mirai)", "value": "b7eb9619fb011858f953c78b446d3a4b5a80f462b17f493caf1d7b3f4e071ca8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766581, "uuid": "19820223-9007-47a7-881f-a2950811e9a1", "comment": "Malware payload (Mirai)", "value": "eba243eefeb10a34b214a0a4db1c3188ab25ba3a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766581, "uuid": "9f8b58d6-8417-4490-b1ca-8041024ca83f", "comment": "Malware payload (Mirai)", "value": "2057fa828949d0c813f9e205b81f005fb1082be88510bb92290030f1004e328498e68ec9a28baabc376a81e0142d5324", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781766581, "uuid": "11f8fcb2-a981-4753-b969-4968cd43adb1", "value": "T1A204170AB5C0C4FDC4DAC1784BBEF536E971B09D1638B24B3794AF2E1E49E201B1DA56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781766581, "uuid": "97538dec-b07e-47b5-b3d6-379e70b33015", "value": "3072:pWM0EmS7exqmu6RYT08L8Xrwq2N6Bc/7r70IQKhehO63Xlu:pWM0ETex/ullD43Vu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781766581, "uuid": "7bdf76c4-acd7-45b2-99c0-3a2fb1cbbc04", "value": 185608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781766581, "uuid": "805623b1-2cc9-4c85-b606-16ad443efde7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781766581, "uuid": "9d943557-337b-44db-8496-8985696b08b4", "value": "onie_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbaab454-6b05-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781780779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781780779, "uuid": "017927b6-374e-4a3e-9a37-91bcaf6236e1", "comment": "Malware payload (ConnectWise)", "value": "ba0af2752e80d9f6c2691633e20ed895", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781780779, "uuid": "084f4d93-ea30-4f81-b178-6a60907ee201", "comment": "Malware payload (ConnectWise)", "value": "b834f96b09a020e35a370168f0c8a399ef67501a1250c90beb7ecb7e1e0e0f22", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781780779, "uuid": "932917b7-c437-40a4-984e-05506d270e04", "comment": "Malware payload (ConnectWise)", "value": "6b07346f5a2873efe79023e26d90317dc34deaa6", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781780779, "uuid": "a7494a90-1c10-4d09-8410-a763997123a0", "comment": "Malware payload (ConnectWise)", "value": "ae6a66fdc5087396d9ccb504162c0187b107d853c180ae5d35bee979375e021a799157c8ad1d208da5710d87a224b68a", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781780779, "uuid": "83d210d8-9e41-42d6-92c3-63c64dfadcb8", "value": "T1FBC61201B3DA4979D5BF0A78E87A81549B35BC049B12C7AF53947D6D2D32BC08A323B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781780779, "uuid": "0ba5c685-19a6-4429-ac30-800fda8f4aa8", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781780779, "uuid": "d72f80af-fa6f-45d9-a635-f043b518a74a", "value": "98304:HRDRs6efPwPpiTBNxNBWHcGS0h7276PpiTBNxNBWHbpiTBNxNBWHhpiTBNxNBWHj:HRdfefPwPK5NqyaK5sK5GK5aK5I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781780779, "uuid": "fad31f1e-fe06-46f3-894f-7a2e86de2de4", "value": 11609936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781780779, "uuid": "d6b25862-4edc-4a6a-9913-80709c674944", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781780779, "uuid": "05ba7fb2-3a5b-4d5d-818e-49052e6b33f6", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6b1278b-6ae4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781766570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766570, "uuid": "c968f3aa-9c71-45c8-b4b4-8693e7240b17", "comment": "Malware payload (Mirai)", "value": "972af6ede752dc96e1edbe143b83fa51", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766570, "uuid": "c17c7e5d-f66a-4654-a1af-d104dc38b3ff", "comment": "Malware payload (Mirai)", "value": "b93288eb55f21f5c1adf7d7a0e5ab47eb1776fd2fb4b6b05e7039dd77b514ae5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766570, "uuid": "9a3a3f09-2215-4dcc-8d51-0e07f6cb6d15", "comment": "Malware payload (Mirai)", "value": "199eef2e55b720fc6818525007f11dd7319684d2", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766570, "uuid": "8ffae85b-1eb2-4a23-9b48-4c9073fb513b", "comment": "Malware payload (Mirai)", "value": "64ffd4cd9440d1d20d0fe89eb9d16c793304264372643ded67380de9794913cdde20051be10341a73ee7789ba8aaa631", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781766570, "uuid": "248377ba-87e7-4618-9013-8f75e3988f7d", "value": "T151111E8F2370D361294C9EA1F7764A157E4CCBC539FECE849EF5146A54C990020A4F4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781766570, "uuid": "75eb90c9-1c6b-4e05-8012-baecd509692b", "value": "24:+h3MHNNIXhiJ3xKp7GFsiBNIXihYNjpgYp4M1p:+h3MH0hi/67GFsiBNIXiMjpgYp4M1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781766570, "uuid": "092a9d00-18a9-4716-af36-329540176aac", "value": 881, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781766570, "uuid": "65ca63e0-55d0-4b0f-a54f-e9347b0abdb2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781766570, "uuid": "a6e35eab-4f41-44e3-b76c-cc68e428dab1", "value": "viet69.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c955b56-6b6d-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1781825233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781825233, "uuid": "73212280-402b-453a-82da-ff50328669ce", "comment": "Malware payload (CoinMiner)", "value": "9c49e1aa778a45e63e8fbff11108dae0", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781825233, "uuid": "071297f9-5fa1-4d28-aee6-bdb4e6806f99", "comment": "Malware payload (CoinMiner)", "value": "b9c43cbbc9b35df9f526e3863d782db4e8a9b89b7e693613bfa1e98c5c89cba2", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781825233, "uuid": "06460fc2-655f-4529-bc28-eeca288b42a0", "comment": "Malware payload (CoinMiner)", "value": "6a14d7057a17ff1af8e8c493275ca7d69362b266", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781825233, "uuid": "34555774-51c2-4ed8-8ffc-3d8bdf8c531f", "comment": "Malware payload (CoinMiner)", "value": "da3cbd5a659352c013bb50b3d7c91e1bc431078031e094b8ed43d4a7c1c9a399e12286c267a06c9e8e5ef5400942b491", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781825233, "uuid": "b5c5bdf6-0359-41e4-b30e-399b6c8e8122", "value": "T10E329F1E2E4B4332DE5149B8E461428A542D5EE37343EBDBE633D19B4AD6E4084C1AAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781825233, "uuid": "d32e5ba9-9421-4fd3-960c-ca72a1acb965", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781825233, "uuid": "7c7a8b88-493e-4763-913d-044d5b54557c", "value": "192:P0doLWHNS5BMfGxSHO865quRPFJxTEZmFhqucW:P0doi1GsufMuRPFwZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781825233, "uuid": "f82f96b7-0a44-40fa-b38b-f547664d8c35", "value": 11776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781825233, "uuid": "05052e51-e54d-4d29-ba12-732fd67b8ea9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781825233, "uuid": "7abda6b3-3bc1-4248-8c08-e9c29afbe898", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48b2d885-6ac8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781754387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781754387, "uuid": "7bc3c3c6-2761-4ded-b1d3-9deb1cf1cc5f", "comment": "Malware payload", "value": "6f3421357bc6880e4e44d35265d7f331", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781754387, "uuid": "ccc0c0b8-5453-4ff2-832b-8529d4073edc", "comment": "Malware payload", "value": "ba355eae6cfcc2fb0d50da33648d1687adbce235e8eb5329e1db64c1e24c3ce3", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781754387, "uuid": "6865225d-a42a-40e3-bbb4-3332017a13a7", "comment": "Malware payload", "value": "b1f99f54df037124510668dd3ae9974f10ce8632", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781754387, "uuid": "940a04df-0277-481d-9987-236bea0e3935", "comment": "Malware payload", "value": "36b4033342b64a67ea6a2d5d1c5dd545951a0004b91ab41c843ec7ec224bf5cb443cfddbfd2f95bda545244aa8a32d38", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781754387, "uuid": "e5fa8a3c-7603-4efb-9572-b4acfcd4d216", "value": "T135136D6516953C25AE99883B5D7F2F0CBDA983E2304491DDBFCA3CF18C5569CE218B1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781754387, "uuid": "c0cb8295-4218-4804-a3d0-4f496bce745a", "value": "768:Or9NyXsZztCy9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:4HusZGco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781754387, "uuid": "64c6ecbf-45a2-44d9-92d0-107cee57db65", "value": 45211, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781754387, "uuid": "662a59cd-f129-4dd6-bb1e-461ec59df841", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781754387, "uuid": "b85fd3d6-f195-48bb-a333-980ade7d7e1f", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26bfa52b-6ae9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781768503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768503, "uuid": "428f5bfe-5e7c-4b2e-9bf7-a7cd110b4d38", "comment": "Malware payload (Mirai)", "value": "cba503764540a3a62bdb819dde253d7c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768503, "uuid": "a3086ee3-51cf-4017-8687-e8faafd9f856", "comment": "Malware payload (Mirai)", "value": "baa20250ddfb3cb1f8d4d6f303632a78af4d410b26907653452cb8e125df3e5e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768503, "uuid": "b3194943-4281-4e1c-afd7-2f61b3623ab1", "comment": "Malware payload (Mirai)", "value": "906eca7d0fba4e87c81fc190e8d3096fb08f1e83", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768503, "uuid": "b1520cac-a818-46b4-bc82-6a3eb10c7987", "comment": "Malware payload (Mirai)", "value": "7120cdfcca03e9dbea6d606aeb32956deca9a2f6ebb5976588dbd329d92f2a07a6429976f96d594c82079d6015b30213", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781768503, "uuid": "7e47ad81-a92f-4ca3-9a15-693a1954c870", "value": "T137F46B42FF1C4963C9430DF0193E43E9F3217B5241F9C229371E5B5B2622E76AA8778A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781768503, "uuid": "41e76a4f-82b3-4a05-b095-5b1627f185f9", "value": "12288:TweJ9GMDDP6IrcL14Ml4iJh2N6HsJa4T2oiYl+LPhsXepIQxfDxUbA:TrDDP6IrcJH2uMd2D3LPLNC8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781768503, "uuid": "62e30cda-5fbd-45a4-be67-d5823a8f808a", "value": 726708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781768503, "uuid": "1c3d4f63-ff30-439a-a447-8dcb7cdb9473", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781768503, "uuid": "67dc26ff-b777-4357-a286-2fbf111baf94", "value": "kaizen.ppc_srv", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6d67a68-6b18-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781788904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781788904, "uuid": "0e319975-0442-4182-acce-97f6dd7ad9db", "comment": "Malware payload", "value": "866be65d47608384c640386f4f39a236", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781788904, "uuid": "c135d020-bdca-4694-9f09-6d234268c183", "comment": "Malware payload", "value": "bae619b9dd605a24eb7f6ed3957a5061276f254c8fec306d4a54cb5d1e40ad90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781788904, "uuid": "d72928f1-7cb5-4284-81ca-55765997dfde", "comment": "Malware payload", "value": "7214c6be392e896d4590a0883fcb7eac3998b9fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781788904, "uuid": "9ff2beed-b8a9-48ad-9f73-190e9f719034", "comment": "Malware payload", "value": "5a72baad12d581ff40448a29c0eb704a7cca47d5ffede8ad1273872c2d6dd89b80665059514cbadee53a75039e9470a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781788904, "uuid": "aaddf361-af0c-4d69-90de-b7b8b7ca5077", "value": "T1B4F57C47ACD518FAD469637188B39A867735BC042F3227E32EA0B3383E766D06D35764", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781788904, "uuid": "646a2e97-de5d-4aeb-8443-9723f858925a", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781788904, "uuid": "586e292f-e2c4-4b67-ba3a-160822ef3b07", "value": "49152:75Lo0vBp3fJJmxFZ+S3s8hSGycyeizomRqqEQ0V375vOt1upsczH6J:7blJI+8SGW3QTVrxOt1upjz4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781788904, "uuid": "326a0399-4c30-470c-8dd9-881071965194", "value": 3345264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781788904, "uuid": "10648a81-4850-46c6-8bcf-77d5d383380e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781788904, "uuid": "6994c898-b032-4e0e-af34-0dce67b90c5a", "value": "8349520787_v.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "761c9dc0-6b14-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781787105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781787105, "uuid": "fc62ae33-6ea7-4043-901d-497b9f540ab0", "comment": "Malware payload", "value": "cdad16f57f5b3f80c33367907cc2a2fd", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781787105, "uuid": "a96b38b1-3cef-4977-a1fa-ba9ac7dcb6c2", "comment": "Malware payload", "value": "bbbd375392829b5f4f247a60b1a6aa98a4d0fef45d75747ad7b11cb77294dbd8", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781787105, "uuid": "ad699585-bf5f-406a-bfb9-101ba07e7291", "comment": "Malware payload", "value": "ab6e3df1a08373e47df8b88730c48df318effe88", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781787105, "uuid": "95ab0392-6976-46e5-81a9-27f1aabc2b0e", "comment": "Malware payload", "value": "0adc63c9aa7a52380ac4a89d987e9b2f55816fac282d6e9d37fd12f63178d937efb90d8d32bd0beee1cb264fb82f7ea8", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781787105, "uuid": "85c557ab-e999-4152-b285-4da2f51ae34e", "value": "T12571F6102DEB11D8E2774F7167E8B6FB0966F871A82E65B411408A844B70BD1CCB2F76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781787105, "uuid": "ec069904-431e-4a04-b8b5-9e9da173e1c4", "value": "96:8GsMMGbhfs9R2/u7PWLsh7c2pVmEvblp3k9hV0:8GfbhfY2u7P7c2VmgrU9hV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781787105, "uuid": "4b4a079b-fbe3-4d4e-b154-d4d5cea214bf", "value": 3576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781787105, "uuid": "c6b298fa-5575-4bc9-a78a-2da6a9d783dc", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781787105, "uuid": "0eb8acc8-6591-41f5-b9ea-43a2961ec02d", "value": "report_INV28401.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32a5eb0b-6afd-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1781777113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781777113, "uuid": "ad668fc9-176c-4e86-b042-46c78e767dd9", "comment": "Malware payload (AgentTesla)", "value": "3ee4d5fc4ef74349d7c330acbf0ef718", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781777113, "uuid": "77566ad2-7d6e-4e38-a0f9-799751810807", "comment": "Malware payload (AgentTesla)", "value": "bc37921377b4fe391a8487b7116cb8b92b3b09b1c0e9b4f48fb99f217f43eec2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781777113, "uuid": "9b1c1709-2ce7-43c3-bf03-30932cea61f2", "comment": "Malware payload (AgentTesla)", "value": "47a39f1540cf158c542baa417117617a9065d46e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781777113, "uuid": "6022a04f-5fd6-4024-8efa-3fc40522d7e2", "comment": "Malware payload (AgentTesla)", "value": "ba2faa7aceefea80d812fa762ac6a29fb3ac084c56d30b9a6b5d309aaef0623eedc85158da92bddee93ed9a4326aba30", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781777113, "uuid": "3ad30e51-86a6-4c70-8a75-3e42528547f7", "value": "T1C9251208B3BADC13C2661BB594E2D03043B66E8AE933D95B2FD47DDF3A227914990743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781777113, "uuid": "21ab6f2b-2113-4aae-b274-ca669804a507", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781777113, "uuid": "ae1bac3b-dcba-4462-abbb-aa11aed9918f", "value": "24576:qwfNOyEh99IRqvxZsvRZFv/1UhxXXZaJk4Vt1lRJig:xfNOCqqRZDI4Sq1leg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781777113, "uuid": "060c7fd2-fb64-4113-a497-b8257b5bb87c", "value": 986624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781777113, "uuid": "96281aaa-73df-4ec0-8281-cf3d7cc42719", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781777113, "uuid": "c373064f-b4f5-4717-8900-7e1b47d6e5de", "value": "Vessel_Description_Particulars.pdf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74f69ccc-6afb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781776365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776365, "uuid": "44caf2b8-d2e2-4193-969f-9a2e7d923321", "comment": "Malware payload (Mirai)", "value": "a5fb4c405861c49449afb4413e124ef0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776365, "uuid": "2d9c9640-be22-4aff-a2b2-82d95113109d", "comment": "Malware payload (Mirai)", "value": "bc4414c1302b059b78c4ef5dda97bb53413a4850263850e67e2f341b3fcb3744", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776365, "uuid": "66f3919f-b2a3-4a4f-a0a0-afeb7522dc80", "comment": "Malware payload (Mirai)", "value": "e87f0ceca561b49acc70836c318d9807bd52230b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776365, "uuid": "f6d550c7-aed7-4ee4-b3de-de0bb5ad4842", "comment": "Malware payload (Mirai)", "value": "482ddbb96db2e87694f4e5e6db1c89e58f6273b5d896510b6d2fb9af98a6fce042946863d982cdc837f00d2928ef5738", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781776365, "uuid": "d8f4ee55-c859-4f12-8bc1-4ed85e0e0b34", "value": "T1A17312725255AD08CFF5ECBECFB3B3D183B15765F78D89027877C6028B6484AA242C46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781776365, "uuid": "fd2f8464-2f46-4d90-82fa-74f69f08ca70", "value": "1536:/jhiq/goYoHfOvF6HRcYbouG5FNRf74N3pTwg9Oh7bXWNq+oLR3t7JJ2np4u+qg5:/9iq/goYomvcHRcYbouoX0N3pJOh7bXt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781776365, "uuid": "eb0e4b2f-2e52-4cde-8925-91ec85c1bdc2", "value": 80484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781776365, "uuid": "681c633b-4d32-478a-a814-de255e136fde", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781776365, "uuid": "a92f175c-368a-4f23-ad50-a95c2985d739", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "653ce463-6b3c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781804256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781804256, "uuid": "14f299cb-503c-41da-bcdb-a81a5891b5c9", "comment": "Malware payload (Mirai)", "value": "89d5c9da707381ac727b587936fca6e8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781804256, "uuid": "8bed24f8-ea31-490e-9197-92ab3c2c56e8", "comment": "Malware payload (Mirai)", "value": "bccb99ed4486fccb25270b360a2cd85fd38fa69593de49c71d441c93059dfc92", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781804256, "uuid": "b7e298ca-2e6a-4a62-8505-38d4e2df2227", "comment": "Malware payload (Mirai)", "value": "22389b734b739ec435e1a1c52910a5c3ba0be1b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781804256, "uuid": "ebee3fb9-af8c-46b0-9486-16b45e6d93f4", "comment": "Malware payload (Mirai)", "value": "ec87bfec35608a9f72d40be3aee532c5768d2153cff6ef21f4301a6ed96af7cd17efd9b0b847d2048d355fcf72affc6f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781804256, "uuid": "8bb41ab9-a904-4bdf-9c2f-0597be257376", "value": "T1CBF38DC0F743E5F5D94B01F020A7F7368776A93A102BEA42D7A9AE36AC53601D61B35C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781804256, "uuid": "8bdd3032-2ad3-4621-9993-113d4504ef44", "value": "3072:OoAzjZvljrWC2IDIFuNfY2DKxp3PgHpfuaUljJPBykrvgVssihG8BU:lAzjZvlfWC2Iq6fYrxpfgHpfu8krgqF4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781804256, "uuid": "de6aff78-0880-4d4d-85f0-0a3dc6c673c3", "value": 163208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781804256, "uuid": "df2b5f00-56ab-441d-92df-040137be3572", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781804256, "uuid": "877eae24-dacf-44ef-80e1-f3e248e74dbe", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f73c4e1a-6af8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781775295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781775295, "uuid": "92a32651-58ea-420e-99ef-9cec0436b338", "comment": "Malware payload (Mirai)", "value": "d96288bc3c4732ce8b00582c8691d50b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781775295, "uuid": "439cbe81-6da8-4273-b512-f5a229676c43", "comment": "Malware payload (Mirai)", "value": "be9e30d765f72834ee4ebe465d924912caf5963a21a10a354078711e43876be2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781775295, "uuid": "56abe87d-5b1b-4820-b55c-226b98b5693c", "comment": "Malware payload (Mirai)", "value": "1c625152c23765df66b4b7b2921708f8e5590db4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781775295, "uuid": "66a95af5-8db6-4c3e-835a-6fe3965823c9", "comment": "Malware payload (Mirai)", "value": "70bc086b913e441977ea8d914719cb277983bfbbea55c216f08f12c8c5d37e13f8d6f71c79de4034d4b843663d6ec13a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781775295, "uuid": "2c1a8c73-9f6c-4161-88e4-c284c4dfa194", "value": "T1E844D61E6E228F7DF769877547B38E34976823D623E1E580E1ACC1115E6038E542FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781775295, "uuid": "46609a53-52d4-4ba0-8101-e23f180de3a3", "value": "6144:VONHsCHxN1lfQJ/eqJjfcsxgMmHPoA/nJ9:VU2J/vTxYnJ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781775295, "uuid": "1dd90949-30a1-45b6-bb62-1000a11522b9", "value": 277920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781775295, "uuid": "cb97b15a-f3e0-4f25-99cc-14589910f0bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781775295, "uuid": "4410e2f6-7f59-48c8-b52e-edda95c1ef08", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f35a811f-6af6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781774430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781774430, "uuid": "2f0ea2c7-2457-4b14-a6e8-fa3b31e7cfe4", "comment": "Malware payload (Mirai)", "value": "3480cf6ce74a72a866e601667eac0cd2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781774430, "uuid": "58f2533a-30ab-47fa-b337-e444c24d6530", "comment": "Malware payload (Mirai)", "value": "bed1fb37fe260403eccc9871fcb63a2786c602344836fd314a91cb8d741013ad", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781774430, "uuid": "5db3496c-1733-46ea-8f49-dd22ea70936c", "comment": "Malware payload (Mirai)", "value": "4983a10aa0598935f12eccd81eaa8a0e1c668de0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781774430, "uuid": "c4848f45-6cda-42c7-bdf7-e946bb7c7c1d", "comment": "Malware payload (Mirai)", "value": "7e4795eba666312cad3861ba0abb48f3b32d815c246c44ebfc9a9a61f3dd698c94ef4e8c1740608a66cf2a0f43d8db20", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781774430, "uuid": "8f03378d-8064-407d-96fc-f9ae773c97cb", "value": "T1133178AB809D9F315490D903B26D3A0DF079B3F76C794B387C5E3455948820E7289B8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781774430, "uuid": "07171d27-d678-468e-a7dc-18dcff174ff8", "value": "24:tU46UsUzoUrQUfUKKPWU0U0UwUwUOIUOvbsZuUO3UO6rQYGUJUdWUQoUoUFUUtUi:HrrVuvoZEz6rQYIET", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781774430, "uuid": "89a78376-010e-41d6-aec8-d6c2b0f88217", "value": 1633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781774430, "uuid": "3c17dbc8-f8e1-4b91-8dec-38a16efe8d3c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781774430, "uuid": "5e2ef43b-8a90-4d29-9e05-ffdcadac4f7d", "value": "run.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78172787-6ac0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781751030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781751030, "uuid": "057a941e-4977-492f-ad4f-dea7bae518da", "comment": "Malware payload (Mirai)", "value": "c04e3a4ee79b7dd0a3e6003fdfcb608c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781751030, "uuid": "ab40fc0c-0425-42e3-9f9f-6bbc528d099c", "comment": "Malware payload (Mirai)", "value": "bef913fc1e566f3c7d50732026556bfa1f17e53912934121efe2bdc4aab5312d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781751030, "uuid": "60de90bf-30e9-4165-b488-3ce88b77b5eb", "comment": "Malware payload (Mirai)", "value": "f1fcd2b232d885d65f71fc414bdeea1380125711", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781751030, "uuid": "776c0541-f320-4ffd-a3d8-9b046f5e59b6", "comment": "Malware payload (Mirai)", "value": "b786e4fa244f6032e968948d25eab18a58285cb7ee50bdd6749f9f375283c07ebaf72acbbc27c9574176e8cd28f705ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781751030, "uuid": "f390dfec-be6b-4c6e-bcff-bb790a0c9c0c", "value": "T10FF3864A6E229F7EF269877047F38E30A75977D616E1C684E1ACE5401F202CE641FBB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781751030, "uuid": "4143522b-f809-49b0-9a10-e59eb282c234", "value": "3072:+09Ew4VyadJQkHROGNwJaMSr2zexHfbIbKBmI5ob1Jy:R9EwQykJQuRO6KS6KRsuBdG1w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781751030, "uuid": "daebf9bb-f00e-4428-82b1-78bad9173ad8", "value": 161896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781751030, "uuid": "b49e18a0-8888-4f2a-8396-a4de03f64eb0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781751030, "uuid": "879f7519-bcb0-4b77-861c-6cdf183ead16", "value": "data_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33744d11-6b34-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781800737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781800737, "uuid": "a821ea38-67e3-41d4-a06e-43d08367eba9", "comment": "Malware payload (Mirai)", "value": "add150861d4fc4a14cfe0b74a7298247", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781800737, "uuid": "94cb3755-6dbf-41ee-a74b-7f401ade7b96", "comment": "Malware payload (Mirai)", "value": "bf019c26d0cdc1f04f738a6e91ef3275c336f387243d4d6bbf9c05db101d689e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781800737, "uuid": "0dd206ac-fb91-43fa-8bc6-27087ca3aaa3", "comment": "Malware payload (Mirai)", "value": "1562429e294df28e37bfb64cf917e182b14f1497", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781800737, "uuid": "0612ead9-c21f-437f-a61d-629273d62063", "comment": "Malware payload (Mirai)", "value": "e5874a4a0b756b05c2b11a5b9a29c18ea4d51168c4b3bf706286c2a59234320efc365989fd7fecd9765853a1a984d7c4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781800737, "uuid": "909545ab-67e6-404c-9992-544169a001bf", "value": "T13FC3C91E6E21CFBEF65A827407F78E31965877D61AE1C685E16CEA000F502CD241FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781800737, "uuid": "af5f1144-c8ea-4fe4-9fbc-c61851a7d891", "value": "1536:tw4lPfv7d7Y/YLYdAo1OhNWHv7t9i8pPDoM1ISWlKnKevNeThQF:7lPfDdMLdAoKoHv7tppPDoMCsnShQF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781800737, "uuid": "e89fdf32-6ae7-4870-84b7-8f3af1ef8729", "value": 118300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781800737, "uuid": "112808c8-e132-4358-a4a6-bf7772c493ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781800737, "uuid": "8eb8aed3-9f8f-467d-9b43-dc8830bc415a", "value": "manji.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "168ccbcc-6afb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781776207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776207, "uuid": "7019f606-11c7-486e-86b5-63e9773ec74d", "comment": "Malware payload (Mirai)", "value": "159026c0eefa8fe5a36a91acaf320ba8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776207, "uuid": "3c359719-8a11-4c91-ab06-8d738f2b71d1", "comment": "Malware payload (Mirai)", "value": "bf6334983f6fe7d40bef13c9b5735b9bb260c37fa1c69e9dbb8c4ab68a851b90", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776207, "uuid": "64883695-f180-462f-a935-966e86f30cb2", "comment": "Malware payload (Mirai)", "value": "67b2bb80c1caada5d695cd68cc050b572aa68242", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776207, "uuid": "bf597c23-a34b-4073-9347-ca9f9abe433f", "comment": "Malware payload (Mirai)", "value": "016c6f3221b8c7fcc2fa28135af7b71929300bd425adbf734adfa54c86a94a7e5f3a4eaf58856b334346a812d95f533c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781776207, "uuid": "36bf4f91-9530-4055-bcbb-88e431a4b30a", "value": "T1737319742A86F27CEDF190B8E45720D628A20A1C3BACE1E369D7503AEF75B0C7169D45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781776207, "uuid": "d3934b30-687b-4ea8-8bda-a68e996ff384", "value": "1536:TUxVBYwpNjQts8nd7/WGzd6l4QaYjVvm:TUxVBYkjQtsQ7/W7l4QFjV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781776207, "uuid": "b032b834-cd39-4bb9-bf6b-2a96bbc10cc2", "value": 75132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781776207, "uuid": "9861f2d0-1a77-40be-bb18-8668fb7fd33c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781776207, "uuid": "e21b2b61-0248-43fb-83cf-f19e8b9067af", "value": "h0r0zx00x.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "956a43e2-6b28-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781795747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781795747, "uuid": "4f83a5bf-4bad-494f-a0f2-f13a39f24653", "comment": "Malware payload", "value": "e42782d1c04b4f04a7f381f3759f3d4c", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781795747, "uuid": "96f80314-0971-4b7d-9178-e180eacc6162", "comment": "Malware payload", "value": "c087e73a31e10615dfe40d40d77e14202fa220991d3412bff811b5a690249ca1", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781795747, "uuid": "362afc06-e505-4fb3-b138-a081b5d05268", "comment": "Malware payload", "value": "6a779de23591881f5c725bdb788a280126108a70", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781795747, "uuid": "95c13916-262c-4d4d-84c7-f461626fe9f7", "comment": "Malware payload", "value": "209491c5c79ab4e5d8478e0a6c5257acb19f16bfc8b43b0ace1a2d0fb1b9d0de6ecc6ae2593c7e99d146da3e1543576f", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781795747, "uuid": "40a348a3-7d89-4c88-a10b-d55abdf73e85", "value": "T161072227E7861069EC69AA378972F33047376DF0681F4D0985F43459CB361E0EE7AB62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781795747, "uuid": "d3ec817f-4438-41e2-bc75-33b6df2616ae", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781795747, "uuid": "cea72e42-2ec6-4619-966a-368cddb27893", "value": "196608:YYt8/hxWjhmWhVlQj9doKlD0HXYy79/RVcNESdICkSxG+1rwPddM88VjgD30:YYmWt11QJdR0V79pVcNigrwFdM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781795747, "uuid": "18098cdf-23ba-4722-8992-c61271b5015c", "value": 17605133, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781795747, "uuid": "74fe574f-2d41-47e3-a6db-0fa4ca3f8457", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781795747, "uuid": "6ce2b0d8-75a2-4fd0-946c-14af82835a7f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "714c9f2f-6af9-11f1-a769-42010a9c0008", "comment": "Malware payload (SilentNet)", "timestamp": 1781775500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781775500, "uuid": "22daef0c-94f0-4c20-859a-ccff4611bc1f", "comment": "Malware payload (SilentNet)", "value": "7ba60b1e85d7cbff47e2ab3c44d1f128", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781775500, "uuid": "38a6e8b0-3005-4fd5-a43c-2b800aa0c8a7", "comment": "Malware payload (SilentNet)", "value": "c174cb9692611a64cfc1556c8fd1d91d6f8e34b0187034d7293e63e08ae7d177", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781775500, "uuid": "44454185-113d-4bef-9b3e-96e9daea6ce3", "comment": "Malware payload (SilentNet)", "value": "280ef8a6b694b65fa9a935a90075ca1b2f1673fb", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781775500, "uuid": "c6899257-cac3-429a-9fe7-54b10032d513", "comment": "Malware payload (SilentNet)", "value": "418a9492cbc653b5a9e57aae8837c90b75c1d27b5cd13c0c0312e8f70dcdb90b4756921698a639c7294b9b795220dae0", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781775500, "uuid": "ab1539d6-ef5c-4820-8042-edf8c8b25715", "value": "T171E5339142AC1D352DAD6682E70FB2089F142CD8EF4EEF59BF39160702793E75D2A871", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781775500, "uuid": "fcbe16b7-84f2-4629-9257-86b6d557c643", "value": "49152:TUY578yHusf3gV960sAnabZlumSksbhcFHlux1YiSrhe6zpnVoLTFMMhi9moRX:gI78yHwVU0sVLfsbhclux1h+vNozheRX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781775500, "uuid": "e5f1911b-61ff-40e9-9610-163d8ba4bc54", "value": 3224031, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781775500, "uuid": "b5f017f4-0e4b-48c5-b995-043208101ae6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781775500, "uuid": "8f406118-9e70-407c-94e7-7b164fe6147e", "value": "donutsmpDupe.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63d8447e-6b2c-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1781797382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781797382, "uuid": "ca96daf0-2d48-4bc7-8da2-61fec9af249b", "comment": "Malware payload (PhantomStealer)", "value": "48b039c349e726f4f63ccfd141273bbf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781797382, "uuid": "71b1cdb1-99f6-45b8-9f2b-25a0d9cc777f", "comment": "Malware payload (PhantomStealer)", "value": "c263ac4338a05f8a8eac1a2eafb0ea4fac59c5c012a59b927c77dd41fd3536bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781797382, "uuid": "accac5f8-60b1-45c5-a1b3-4f07a758dbd6", "comment": "Malware payload (PhantomStealer)", "value": "1805bcb1e9a621d73511e366ddc5a55bd96ec869", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781797382, "uuid": "efdbdc1c-0229-45ec-b9a6-0c9a21ff6d2b", "comment": "Malware payload (PhantomStealer)", "value": "af6087b3e804804661dbbcb20da4880c638a421b68da6515454212b45ba4267f9d426e02191117ca48fd54c7a23b91f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781797382, "uuid": "e54e0dee-4e49-401e-b69a-e3dd8b02d5c2", "value": "T17D652341662BCC23D362073569E2F17047B46D8AED23D65B1EF526C73B62B8A4EC1393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781797382, "uuid": "4486de4a-3d69-4df6-a349-ebe5d5673809", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781797382, "uuid": "c7626c6f-755a-44ec-9d9c-4ec9c5495f04", "value": "24576:XOgLmEQN248j+kVfWsd7Aft8MceEY9lqh7yJztczZRPprYyutuwE3c5HieMI:XOMIzC+kVM8Y9lQsQPNYyu43c5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781797382, "uuid": "a1624100-9c59-4c6d-a0e2-b1173a32cd5e", "value": 1526272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781797382, "uuid": "99b2b944-126b-42bf-9208-8d6abdf17dce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781797382, "uuid": "f34c83bd-33f7-42df-a1fa-d35fab97b359", "value": "MV TBN discharge used rail 27000mt at Dalian Port information EPDA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01cca9ab-6aed-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781770159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781770159, "uuid": "2becd496-6d9b-435d-8151-12e343943b6f", "comment": "Malware payload (Mirai)", "value": "86abef756e5030bfb4197bdce4b139ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781770159, "uuid": "ad72da8b-bb5e-44dd-aaf8-33b517a2342d", "comment": "Malware payload (Mirai)", "value": "c2a72e71368aab4291da4589c5a3ec37d83efe269abf1a0667d5a1c4f6f0db51", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781770159, "uuid": "0fc6877a-4fb6-4d8b-8ac4-bfd6910000cc", "comment": "Malware payload (Mirai)", "value": "e2caf88c3850408de130774b15a9053c5677335d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781770159, "uuid": "a535773a-734b-47e1-bf1a-54392b7c69a9", "comment": "Malware payload (Mirai)", "value": "9774cd5581246e39c32b6f0b917d0265642ef18e6120eafd09e3a28ba727ccd3d0c2f9dbd3a7c38ec8bf6c2d5f767209", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781770159, "uuid": "25d1e64c-2a5b-4178-bb05-65aa60e920b8", "value": "T12F935C23A4D080FDC8DAD7748FAFA12A9933745E1235B56E23C47F263D59E112F2DA11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781770159, "uuid": "af7a6b16-fb53-49a3-be43-ab2e2462c7f3", "value": "1536:pS4fv1sUJRePQQYE1LHWLxv+rfVK6A+OiEn3AwdsGOQeX+pe933hGWuCT:pB1sUJwBdH2xv+rfy+ONAgsOcaeVEbCT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781770159, "uuid": "935d1f1a-2cf4-471a-b62a-4e19ffd74f1e", "value": 91912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781770159, "uuid": "5c51c85b-6194-462d-ad3b-dca7661c0e07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781770159, "uuid": "d45ef572-e758-4d7a-9e92-20855ad0f676", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db5094f6-6af0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781771812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781771812, "uuid": "c844d6fc-8ef5-402e-a409-5b94d8d9fbc6", "comment": "Malware payload (Mirai)", "value": "fcfb0fc0a5a3ac53cc63337ea36fcc8f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781771812, "uuid": "2456a0e7-b293-4c9e-84e8-6878a3cfd784", "comment": "Malware payload (Mirai)", "value": "c2ad0bfb4c9aa3e2c7d5e3ee36a26571f72b277c58083de01c476f8bf83fc3c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781771812, "uuid": "7a04730a-c27d-4ec8-b146-4c9ff7d32d5c", "comment": "Malware payload (Mirai)", "value": "c8ad94213b5e987cb5c69718538b43b40054076b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781771812, "uuid": "10209f80-2251-49a2-b771-3700effb3983", "comment": "Malware payload (Mirai)", "value": "9b399629f97011a44ee72cee6de1bea6689dc8e2644f73228d0775a2d029c7aaf711d4dbf4862ee1f8d80d4a67b2f9fc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781771812, "uuid": "3f15646f-3f04-4a72-8c42-d965521c97b7", "value": "T1A1241846EA408B17C4C61779BB9F430233339B64E3DB730A9928ABB43F8775E4E66505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781771812, "uuid": "3e9c6c23-9712-4a1a-847b-70ec00104742", "value": "6144:VaPCEPwDKN4WUr+4YsqsahY8kFaqGYnUiqkBaDL/KOJSICmHwkGeW0C:sPHEKN4WUrws/ahY8UaLYnUidU/RCmHk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781771812, "uuid": "30d1d772-bc05-4494-87a6-ad907d0221a9", "value": 216390, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781771812, "uuid": "5cbf0d87-416c-4e1d-beee-8ad925e8eb6f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781771812, "uuid": "c82ce450-c506-401b-8f17-69b41f90be0a", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a35d193a-6afa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781776014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776014, "uuid": "a6c3f899-bf68-4815-b3a6-6bf3465b4853", "comment": "Malware payload (Mirai)", "value": "4df3f32fab3d959d5c8c5bbdee13ee69", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776014, "uuid": "4c043200-9ba4-4101-ab70-53c43d5573f6", "comment": "Malware payload (Mirai)", "value": "c575222e3b750999212cc6257382e7dea0ac96bf020fba35d7a8601d9953d21a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776014, "uuid": "28c4d42e-46de-46e2-a293-2450e859a04a", "comment": "Malware payload (Mirai)", "value": "1074a2556a3c1a64413ecc281581c2f945dda9b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776014, "uuid": "004a9ad5-aa26-45cd-9106-cf88e325c29a", "comment": "Malware payload (Mirai)", "value": "05677787a07c7f5f5045761fb108c60aef55b16e3fcc3c7a3de33d09235242cb9a7928ae1a9bad645429897eaeab5751", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781776014, "uuid": "49b9f415-e221-41b6-ac82-7ee2ffc1600f", "value": "T13053026B5FE02C24C85C1A71F3EBDC4B26FD677C721E4E17646422C192EB3B821D99A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781776014, "uuid": "82e482d4-40f8-4ed9-bf6a-b83857d850bf", "value": "1536:vblzdaDmPd476SHHau+OOdhOxBGZOr9uQlq9EV+9c:vbQ8d476nyBGErQRa2c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781776014, "uuid": "3e52c876-d53e-461b-9ac5-c0d13c39cf38", "value": 61248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781776014, "uuid": "dafacc6f-9b27-4a5e-94ea-4ce2d462949c", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781776014, "uuid": "c1605ae1-c2c3-4d6a-a84a-48207c035e52", "value": "monero.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb945b86-6b31-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781799703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781799703, "uuid": "2f531748-56cd-4102-a725-1436017e5e86", "comment": "Malware payload (Mirai)", "value": "3e3692e3470b6cf16856dd3f99e5c0b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781799703, "uuid": "984e627c-3534-45c8-bba6-844745ca7607", "comment": "Malware payload (Mirai)", "value": "c5f3e544f42309bd31c8f6b2413237fb110bf606e4c3a2d11ccf8af9505170bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781799703, "uuid": "e959def6-2253-4bca-8c9c-68653f74e40f", "comment": "Malware payload (Mirai)", "value": "02ebda77c3828f64248e91371c998e724a4014b9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781799703, "uuid": "9885e1a4-69e2-4b41-8f33-d41c765b6386", "comment": "Malware payload (Mirai)", "value": "c20b5c7adc8b7c61cf39ec28538ec8ea03ba0951768705d076515db1f59c53cb1a886ccfb039cb361ddace0cb0a04901", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781799703, "uuid": "1b81a133-f1f4-4cd9-a819-7c3cb96a6630", "value": "T194935AC5F683D4F5EC5645B19137E3328732F13A602EEB57C3689D26EC91A50DA0A3AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781799703, "uuid": "40b84f1b-9167-4884-a2aa-5e049e88a175", "value": "1536:RlSYM51ovLZ2K28h/PXvvFlLUn1eQLLLvIytfmgwEsGOB6o3AJS6flR:Kl51ozZ2K1X3nIn1eQLvvF/wgO4bA6r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781799703, "uuid": "0a4d528c-5647-4ef4-9fbc-9c89940358f1", "value": 90796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781799703, "uuid": "8dda0e6a-dbc4-4456-a7d4-d68d06e22858", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781799703, "uuid": "1b210428-c92e-473e-b249-44b7313609bf", "value": "main_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77f456d9-6af6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781774223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781774223, "uuid": "ac40ad94-6072-4eb1-ad21-90b1b429cf75", "comment": "Malware payload (Mirai)", "value": "e15eda1dc177f8c598101c70bbe4a6b2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781774223, "uuid": "7f6cbfa5-f273-4525-aadf-4d439b9e6be9", "comment": "Malware payload (Mirai)", "value": "c5faaf688b0f9d55aefc19b90807b7b8a57543d3f2ae1e4a73b3b62cb33d5789", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781774223, "uuid": "fe0f41de-396e-4187-b268-94b6b413fd5b", "comment": "Malware payload (Mirai)", "value": "842e4214f718d4ad27c64f6734d96b627fed02ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781774223, "uuid": "0b8fa3e7-2291-436e-a9ba-2b43b1b53af6", "comment": "Malware payload (Mirai)", "value": "a47e5364d2d019555ff79bfdaafa3bc9334194f1ed1fdf42a52ca15db4020004aae738a1d658a136cdd75484c62a307e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781774223, "uuid": "d4689564-5333-4551-8d5d-3526b88051d9", "value": "T134149E23D8786D98D26598B0B4F48FB81B53E51082471EFE6A97CA7480C7E8DF50D7B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781774223, "uuid": "11cbc0e6-ddb1-4612-84c4-80c6aa906696", "value": "3072:oSEWZwLhlpwX0/mgpA610Q2FMzPeo+mWKljI9hRZyk:dIhck/mrg0Q2a2zKS9hR3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781774223, "uuid": "9ac75147-9789-4a5c-a5b7-f9ca3d47f0e9", "value": 193828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781774223, "uuid": "13be108f-b635-4722-92bf-f600a759aa9b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781774223, "uuid": "23ba2ddc-620d-4316-9cba-d94f7f017f58", "value": "psh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7e972e9-6b62-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781820823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781820823, "uuid": "f7eac2ec-f3d1-44d8-9f2a-a5536d5f44b8", "comment": "Malware payload", "value": "2e563ca514407a40e70d0e051fbdc26c", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781820823, "uuid": "fb64ec21-a93e-4631-8718-d3094c33c898", "comment": "Malware payload", "value": "c613bf6e2b7e0f9a0776a92addc834c9d12db768a9ce338382e5c882233a4887", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781820823, "uuid": "72fceecf-dc41-4d24-b7c7-71f779c426cf", "comment": "Malware payload", "value": "62470a55062deea6c95b011b65bae5b342f7ad00", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781820823, "uuid": "5099d266-4d5b-4095-8255-64ccdfb731eb", "comment": "Malware payload", "value": "2d823f9049b91aafda6d4e7ad44c2ea6f9aa5fb170e3bd795fa9eab4d1a617684cd284bc87a9ea372f6121ed3092d37c", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781820823, "uuid": "544af0db-1a76-4db0-96f6-bb50207e8664", "value": "T1DCF533F8AA7401F5CCCD3FFDEAA954BC42D78461F45764C5CA67C8EF9BA29406A02390", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781820823, "uuid": "c6032b17-514d-4615-aa3b-286bd33e21e1", "value": "98304:SibcQbqfqPj3t3ENw6k8ZaRgwrVLfl/TSSY25Ezf:RBbRb3t3kpwrZxTS325E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781820823, "uuid": "81a0288c-97e2-430b-999b-bc668543e96c", "value": 3620874, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781820823, "uuid": "ea8a503f-55b4-4236-aac3-203238825afc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781820823, "uuid": "3e5390fc-c529-417d-b2a9-fa7513b94bee", "value": "4d5e378a-8de4-4793-816f-552cf41c9368.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "576d0bf3-6b1f-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1781791778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781791778, "uuid": "ac60a2ce-6e6b-4de0-bb32-59de46a2589f", "comment": "Malware payload (LummaStealer)", "value": "6ab9e3c6a1819ae3b3943bc745e33a7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781791778, "uuid": "269a8383-5fac-405e-a2bd-ad49048cd2ce", "comment": "Malware payload (LummaStealer)", "value": "c669a2e29833f02b28d5506a3922f3bcf2b506472f2f6bc43610b30b6f724467", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781791778, "uuid": "853ceea9-9ec8-4b95-ab51-965db9b3712b", "comment": "Malware payload (LummaStealer)", "value": "1100d79cb233b3dcf0c7a9231ae1d341e99aa7c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781791778, "uuid": "4cd0a92e-91e2-4b12-b296-cc9aee3dc5fa", "comment": "Malware payload (LummaStealer)", "value": "a36a1bbe9c10a21568ed4757d64380c94b00e8af903664e9341da2aea3597ee92b63844126e1d2fd006aacc87e2d2634", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781791778, "uuid": "f5d286e6-bc95-460e-a2a3-4029b522bf03", "value": "T199B54811FDD714B6E40216315AA7A2AF23389D051F36DB9BEA943B7EF8772D50832309", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781791778, "uuid": "41a9b788-88ba-42b9-8ba7-122d9a24fa32", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781791778, "uuid": "10409159-cbf0-44c7-975e-a00b86fc1d5a", "value": "24576:tVn2iklSszg/Ls2LXd7WXaD8jYg4ZyMg/TSLNMvxysjp6qwc4whGVVHecqF0SdX9:tMiDt7H3ur1FxFFrKPubQ/dDM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781791778, "uuid": "0c372ea3-d5e8-4aa6-aa0c-f87eaf1118cc", "value": 2482048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781791778, "uuid": "32938633-46d1-4f35-b6ea-2292a1b4294c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781791778, "uuid": "a7c7f8ba-78ba-4b6e-9110-0520eca72b21", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d683302-6b25-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781794257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781794257, "uuid": "e178ef94-ac43-477d-8a95-c4672e21f6b8", "comment": "Malware payload (Mirai)", "value": "0c7111bedaa26467f09b64ea88053a71", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781794257, "uuid": "82c13c0f-f3c8-4956-90b7-6ca9f5589f9a", "comment": "Malware payload (Mirai)", "value": "c750d273944b17f545512a16332a576d2b8f64714f8accc73214aeaaa89f56eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781794257, "uuid": "c2b9242c-c33f-423c-811f-4830e8abbb2e", "comment": "Malware payload (Mirai)", "value": "3d8706334e083bef8b352a5ea7c56a29f8e8e643", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781794257, "uuid": "aa0ba6de-43d6-4e21-b240-33705f317983", "comment": "Malware payload (Mirai)", "value": "2d6f24349b33f9cd8a9627b0a25ba23d650b0954760b1991b2a33de63813e442bfce637d7f4e8a55d3a0cfdc7cce22c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781794257, "uuid": "5e8390cd-2797-4763-bb64-18c0763e6528", "value": "T1CF246C02731C0947D1672DF02A3F27E1D3EF9AA134F4B645755EAB8A9272D321489ECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781794257, "uuid": "e58df96b-7b6c-4808-b964-aa0da5d9c847", "value": "3072:lpG/BNfOFP0o5EoQWtpP+75ujZnMxxm1r8NlYxvnIw7:XnA7U9nMxxm1r87YhX7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781794257, "uuid": "a1a34f60-269e-4240-b8c4-5c61248bc3fe", "value": 213040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781794257, "uuid": "a9ea04dc-5b81-4fe6-b66e-f616b2371267", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781794257, "uuid": "b8321ed1-2b5d-4aea-985f-7cb11627e8f4", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "479e6d8f-6b0f-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1781784879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781784879, "uuid": "093ae443-1828-43e9-b242-c217c0d25f59", "comment": "Malware payload (Vidar)", "value": "f0653f7e58fe0fcf56fef1dfecda8f28", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781784879, "uuid": "98bdb831-ea9a-4ab2-9b80-f60009e7802e", "comment": "Malware payload (Vidar)", "value": "c76703fbd2fb95df4ad66833dac813d53925f9581d683839d8090325f3bc5488", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781784879, "uuid": "b1e60d23-88fb-4354-bbfc-503f95add8a0", "comment": "Malware payload (Vidar)", "value": "a8e78ce6674edc6f2db92c84274fc1ed614e6e89", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781784879, "uuid": "77725f64-bf53-4457-96ff-83176ec45798", "comment": "Malware payload (Vidar)", "value": "48818b4c04bc9180c1530dfe771dca5cdbaf991b40b699277bf17d0853168e8661c602847a337729707d1c4070859e37", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781784879, "uuid": "77f170ef-2ac3-45f9-8e4d-835be9b9c95b", "value": "T1D9E59D03ECA55AE6C4AEA231CAB752517B35BC482B3223D36E50B7B82F776D04D75348", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781784879, "uuid": "502e441d-cef4-41c6-8f1d-0e023afe5d87", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781784879, "uuid": "0d8bebcf-dacd-4e72-97a5-8044b64862aa", "value": "49152:+irbTTLDCHXLH2Fsv/eWnTvM2EuhfB0VR6cWLD8GDQk:+uwWFmnrM27w6tDHUk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781784879, "uuid": "9f824b49-b31f-413c-86a0-04eb1830cc66", "value": 3306496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781784879, "uuid": "b71d7ef1-52f9-4eb8-bad7-72b5a6129d2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781784879, "uuid": "fc09624a-61be-4fd6-bdc9-df996eb9608b", "value": "SetupX64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "402a17aa-6b56-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781815361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781815361, "uuid": "fb019fff-864b-425c-b444-ae81fe8e2cb4", "comment": "Malware payload", "value": "818f3a87fcd4ccd388a7a1ac9282d59f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781815361, "uuid": "bb1e9f76-f38c-41d9-85a7-efeea013d126", "comment": "Malware payload", "value": "c80fae666fb0fb486b7a53becfecb54023b78e891f465a2c755aa91463e88459", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781815361, "uuid": "b12fd81b-ecd9-4236-b582-a7460cb2c41c", "comment": "Malware payload", "value": "df7901265abad3a11c95c83f2dc04e52a1d1ecce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781815361, "uuid": "09b32d92-8ee8-4fab-9673-ef37d62f4dac", "comment": "Malware payload", "value": "43d0382d331ce00002448215d608e9e7a5b15b5a6531abc8a9fcd855a7ae5f528d18a9f99dd887bb88dd26de32a66093", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781815361, "uuid": "667a1e54-ca6c-4efd-9aa9-839b07ea4a51", "value": "T13F14D809AB610FBBDC6FDE3702EA070539CC555722A43B3A3674D528F54A94F4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781815361, "uuid": "cad843ca-2364-4daa-b428-df2ce2a432e2", "value": "3072:395bESIAxUa5UkER+8GfoQGAOj55TkWUaR:395bESYkUkER+8GfLqpkW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781815361, "uuid": "3bbfc847-4230-4798-8d46-6386c747706b", "value": 200064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781815361, "uuid": "3e978fde-abff-476e-abba-6b624e9b56da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781815361, "uuid": "99ca3ee3-b1f7-446d-b887-2dbf9110f7fa", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1c0ec9c-6aff-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781778266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781778266, "uuid": "d511caa8-ae4c-4c0c-a03d-e9cdd913962f", "comment": "Malware payload", "value": "1d0ef0bc46364fc227891a26f524b97e", "object_relation": "md5", "Tag": [ { "name": "MSC", "colour": "#F9E664", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781778266, "uuid": "68c8b022-6ff5-4e52-8c6a-5d85e141b704", "comment": "Malware payload", "value": "c82cce1c0343e619db192a24c525e8e02345a7618a260f22a8f926843cae235b", "object_relation": "sha256", "Tag": [ { "name": "MSC", "colour": "#F9E664", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781778266, "uuid": "5b6644a7-a6a4-413e-b0cc-f2ec237edfa6", "comment": "Malware payload", "value": "b8b2e6077d0a7991b3e6f627126f980d8be2f150", "object_relation": "sha1", "Tag": [ { "name": "MSC", "colour": "#F9E664", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781778266, "uuid": "e4a934f1-ccad-414e-95e8-c9ffddd4b30f", "comment": "Malware payload", "value": "072e94efa1aa7c1d589eab31f8f54cca40815a5eb73f59f89c1083f867390460d525c54c7a42b8b05be6f131e220532d", "object_relation": "sha3-384", "Tag": [ { "name": "MSC", "colour": "#F9E664", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781778266, "uuid": "b2257051-9c0c-4646-838c-6836f928106b", "value": "T150668EFA7400C14F7A3A89FFFA9C1FD554849E1BD5CC9B4481A8D86DABFC10A26184DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781778266, "uuid": "0894d547-628e-4ee6-a7b0-494369e75074", "value": "3072:dNkTBt8jVlIPAtME2dIDBMkeuS1Xdy8dLf/o3tKz3UMASXkCfL8MiofAB/Pbeajm:qG6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781778266, "uuid": "9c26636c-1247-45be-bcd3-a612d1586aae", "value": 7046072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781778266, "uuid": "668fe038-ab68-4b1b-9e0e-6f73dd003544", "value": "text/xml", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781778266, "uuid": "71186df7-1cd4-4412-9c3e-98f729983637", "value": "Teams_x64_1.9.02.20066.msc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "160068d8-6b1b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781789950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781789950, "uuid": "7d359b4c-84ec-42e3-8c4b-42b2e41d6dbc", "comment": "Malware payload", "value": "d0726062beaf2f27323ddb0203a98f6e", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781789950, "uuid": "bc3975c5-3d95-45b0-87bc-61da0092447f", "comment": "Malware payload", "value": "c88da5311950247f46c8348765113b8d103505ceff6b52ad91e4e7547bc4a26e", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781789950, "uuid": "d1e5526f-3040-4060-a4db-b6948efd723e", "comment": "Malware payload", "value": "c3f8b32e945a54703a4e392fa7035a44f058346c", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781789950, "uuid": "d64e5202-03af-4f48-83bc-fdfab5022250", "comment": "Malware payload", "value": "d8ecad00eb08c9108eddab24f92d6f5e05bdd068cfd5bc061fd85a08ec86cac7f893f96efb489ae851613eee0473c1b7", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781789950, "uuid": "d6ec305c-6ae4-4120-8253-fd7468248153", "value": "T1E9E533B29B10E92BFD6614F0ACD24730E8F1ABE7B565910532609B1604F47F2DFA6CE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781789950, "uuid": "5d338992-02fd-4af3-bbcf-df17d6ba24f7", "value": "98304:HgKio46W7AO4AaNdZbJfAvIdS582m9MlXQNy3h:P4/4AaNdrndO89Mlrx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781789950, "uuid": "cff79407-61d5-43d4-9298-2b19001e70e9", "value": 3224456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781789950, "uuid": "b3b012ed-a036-4b29-8b19-f6ffdf3d1d33", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781789950, "uuid": "e54f82b7-87f7-4cf0-8408-d512f532359a", "value": "Aphex_Twin_Ransomware.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38d820b8-6adb-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1781762520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781762520, "uuid": "780a3ef7-f95a-4f34-9f0b-9bd374af92aa", "comment": "Malware payload (AsyncRAT)", "value": "95ca5b8c1bfcd91a4b4a48d22baf16e2", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781762520, "uuid": "97ae4ac7-4e1b-426b-92a9-3ddd9c9097a8", "comment": "Malware payload (AsyncRAT)", "value": "c8c385c10b1586728318f43b9dcafecfd46d8d6000984fe489bb1d219ea8b4f9", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781762520, "uuid": "78deb28e-3c4d-4d31-90c1-240f2c82578a", "comment": "Malware payload (AsyncRAT)", "value": "d22ca7b8b27710b5fc86a9b0e8966cd350e73972", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781762520, "uuid": "f92723d0-5fd3-40f1-aed5-51d8b6152691", "comment": "Malware payload (AsyncRAT)", "value": "794be3a26933c25e9f2ade37e0683e9974b0d10b68560dafefb00d0443468fbeab22f2c3a5b8ec5be495b80e6e00725d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781762520, "uuid": "9f81f9b5-aaf1-43aa-a55a-f7d6652d71fc", "value": "T18AF4220C710DC99BE4624BBD9A60F73913BA6C9CA623E6498FF5BCCF35677240890761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781762520, "uuid": "db1ccea2-1b97-41a3-80be-714a345aafe3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781762520, "uuid": "8ba1911c-3477-4ca0-9ff3-392db28f6c23", "value": "12288:2TIFzrn09ESPhv0OIcsCKuKMtyJdl27KFQYFghrl58TYTqqRqtEEfFrlhvAWJdby:yIFzrn0HJJRKsyBqOgf58TAqc0fFZyyY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781762520, "uuid": "3e835373-f1bf-41b9-9f77-65a860a86674", "value": 730112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781762520, "uuid": "cc83d78d-c844-458b-a269-202590bf962c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781762520, "uuid": "cfc450d4-f4f2-4e0c-8f88-138242a9ac43", "value": "Contract_537_18_06_26.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8fb17b2-6ae4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781766574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766574, "uuid": "0e1db534-5e74-43b1-be49-018e06e8366a", "comment": "Malware payload (Mirai)", "value": "30d992731c9cb8cf3387e17f18e79d3a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766574, "uuid": "e1d0d7aa-4a99-49ce-933f-37d1230d8590", "comment": "Malware payload (Mirai)", "value": "c8e6df2164103822cd33734beb8cf71a89087e08a2e73704495db5bb80249f71", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766574, "uuid": "fd84d093-5499-4f06-8428-630090ac6936", "comment": "Malware payload (Mirai)", "value": "a653f22c385cb6a749aec5a95d7b3e7f30739211", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766574, "uuid": "5af86237-3f95-4e1f-889a-2bd87b8454a9", "comment": "Malware payload (Mirai)", "value": "d42fb87c42458b8c5ea7380f8802396a5d22af666f0b50a7758a36bf8cb7533eea51e5fc2fd0db5418faf9868f953aec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781766574, "uuid": "7db3f866-c721-46dc-bf3c-ce0c8182623d", "value": "T1BA04E856F881CB12D5C112B9FE1D518E332327B8E2DE7212BD246F287B8696F0E3B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781766574, "uuid": "a5dc7110-0340-4b77-bdea-94a5a86832c2", "value": "3072:rcSBIuvInnxsqUJU4fdX/e4b47JaT07Vi7wcYN4eGCY/fm3tl:HInnx9GVdXG4b4FayEnYNEh/u3t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781766574, "uuid": "aa4e78d7-4bc2-4e63-92be-95180c7a99b0", "value": 188316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781766574, "uuid": "b8cb3492-5217-4fec-a2c7-1f9469158b1d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781766574, "uuid": "496907a1-8a27-408e-8011-7761cec2f226", "value": "onie_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "830c361f-6b2b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781797005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781797005, "uuid": "525fba88-e579-49be-a953-fbc4ab551821", "comment": "Malware payload", "value": "2927ccfb7187564241fe1adb1a691280", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781797005, "uuid": "8f4b9df8-3d03-43e2-ba78-20ebcaaab801", "comment": "Malware payload", "value": "c96ede852e613ff8a8d82fca5e0a9d65583effbb40e08cbcb5447141d33f7408", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781797005, "uuid": "363b2c83-e824-4de8-be1e-6a5f9b2b354e", "comment": "Malware payload", "value": "8b052891f29e32706c37c5913d054d5afcb0c9d7", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781797005, "uuid": "090e02ab-3ed9-4a6f-9404-3f6b3e9eefff", "comment": "Malware payload", "value": "6ecad4f7ebddb3c70e2235e2c5d458c3c7910a6abfcd45818806b24355a4d5b2756a0d36815d87ffc19e7da6b02a2031", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781797005, "uuid": "46e2eac0-f7ac-4144-b1ff-2ccf4e81d7b6", "value": "T13531748B1014163A1202CEDDB3A77148750DC9EB2D9BC7A49C4D0FFA82882DDB221FD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781797005, "uuid": "a4b10ba8-e43e-4454-a6c0-74ce353c978d", "value": "12:UE6zsfFxU6+G6JmNH6ltBxDNoB6NoPis+i6+Le9i62HAE36fzLX6Lg5OfWF6ML6O:83vxujKQepn5MWFNhOhXERXXI+V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781797005, "uuid": "8c8a30e2-4ca7-4bbe-912d-f0e12a071eff", "value": 1584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781797005, "uuid": "a4ad51d4-62cc-487d-b55a-86a00351f676", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781797005, "uuid": "7be7f93e-79aa-441d-81da-686f1e80bcb8", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7a4dcd6-6b4d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781811749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781811749, "uuid": "b7ac9e31-e2fc-4208-8c20-84ceae6f177a", "comment": "Malware payload", "value": "e27641e00f583946043f54ffa14127ba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781811749, "uuid": "13d17ed5-8a5e-4cad-8ac3-8191efe936a0", "comment": "Malware payload", "value": "cb250dbc09120966d8163d7fc5f26349becb78c338f2fb7786885ae4f01151b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781811749, "uuid": "903f1dc3-fea9-4a31-9fa7-13c686aadaff", "comment": "Malware payload", "value": "9cc73579c9113812344bfede0adb8c628a8936e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781811749, "uuid": "dc9bbedd-8402-4cb7-bfa6-e7c4eae47b4c", "comment": "Malware payload", "value": "3a070619c1269066e7dd934cef06060215d1b8c50d7b11e7d66e9d21cce1f12ea16973068d43f7da6e56d387821dfebe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781811749, "uuid": "82494127-da1b-4567-bcb7-a95917ee8927", "value": "T1DE57DF77814338E9E9B98DB4D01025416DAC788B5778A3C7BAC871E667EA7E08D3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781811749, "uuid": "a9f8cf12-ed5a-496f-95e4-e75961ef6e6c", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQl:cqYUQuVDt0TZE2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781811749, "uuid": "d36cfd37-2ec5-4af8-9c67-e4e507cf5edb", "value": 27262976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781811749, "uuid": "d9857178-ad59-4a0c-953c-242b75a7a362", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781811749, "uuid": "011be182-fec2-498e-8934-0d2a512197e0", "value": "cb250dbc09120966d8163d7fc5f26349becb78c338f2fb7786885ae4f01151b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b55e4343-6b31-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781799666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781799666, "uuid": "5174ff6b-7946-4cb9-94fa-bcf8ca965557", "comment": "Malware payload (Mirai)", "value": "896e939da5456050206b0605ed34547a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781799666, "uuid": "5637c39e-4679-4632-888d-26e25656f087", "comment": "Malware payload (Mirai)", "value": "cb830bbf83b84fe46b0f1d956c7051b02d10d6ed5a1cb6d953fc1ba3a5da3b71", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781799666, "uuid": "54c47323-2b7d-4530-a833-b7f95f44e613", "comment": "Malware payload (Mirai)", "value": "43b7dc584d39cf37279dee1a9c6d4383f1bce1b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781799666, "uuid": "125a1411-7292-483b-96cd-928b877c8fe0", "comment": "Malware payload (Mirai)", "value": "9a802d59b29bda405877535bcb4aa98a4c3be8ae9b144d59c08dc758b94e9bb9c75b70914ba5bc8f2abfc1dab4bb3fbe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781799666, "uuid": "6daa307a-a6d2-49ff-8044-cc37b5e0b8ba", "value": "T1A0E30A46B8819B12D5D111BAFE1E128E33231B7CE2DE73029D246F657B8A97F0E3B505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781799666, "uuid": "89efefa9-73b0-4b63-9807-a160f2b79a05", "value": "1536:zYno1zWfpmCG3p2Xe+4EaYUlAAEkOoQmXyotFdsRpqfa9hhKZeI2GisuWtjJG5UT:9ifEC/UnE7bmXndcpqfa9yuWtkmrIDk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781799666, "uuid": "b675b30e-88c6-47d4-bceb-1ae507176b31", "value": 143740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781799666, "uuid": "ef752bc9-3711-4185-b2e1-b785bb5fa54a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781799666, "uuid": "22d89ee8-c804-4826-bc1f-b7cc87ba1800", "value": "main_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28ffe51b-6abf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781750468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781750468, "uuid": "7fd6d28f-91a4-474e-aa05-e19328ac6f92", "comment": "Malware payload (Mirai)", "value": "7ff77a6c7ab54a7a5dff8ed044040d12", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781750468, "uuid": "8b00fd53-a399-480e-a408-3cde3cc391f2", "comment": "Malware payload (Mirai)", "value": "cbe11bd9fe97a3108493498945dd31d33f0d6c4f4ba0eb3f382723d950ae35e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781750468, "uuid": "a535db95-f69d-4ce6-be83-b84f006613f9", "comment": "Malware payload (Mirai)", "value": "5c32852dbfc3aeac3325e86aa98abc1b7b4d3c4c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781750468, "uuid": "065ab9c2-f409-4ec0-baf1-482a57613e00", "comment": "Malware payload (Mirai)", "value": "70d9f300caa08a1dd1da6967292eb263a45ab12badb21e7c7fc0764db24b4360eb3bf49e15fb88884544dafbd780b84a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781750468, "uuid": "8f469384-8c3e-41ea-b15d-325c1db487b9", "value": "T1F1144A43EE890EDFC45BCDF086AF836B19E7659B48D2F1F4543C8C08755E28A46E3698", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781750468, "uuid": "c3c4a3e9-f67d-463c-87d3-f5ae8a988b88", "value": "3072:ihE8GOKpnADtebnxnB1f6S9ElRb4W4u8EwnTp2iI72JLafOsnv5PKq5:CEbOK5AWBMlqWG1nTp5e2UNnv5PKq5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781750468, "uuid": "91b91057-cd64-4b13-8184-2bf9ed3e909e", "value": 208960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781750468, "uuid": "ec6e22a8-3ddf-496d-8894-1c6074b3eb4e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781750468, "uuid": "831affe6-b352-42a8-8723-9aba297be094", "value": "data_mipsel-uclibc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a64e6f80-6afa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781776018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776018, "uuid": "dae1325d-4d8e-4249-a556-dc7716ad0191", "comment": "Malware payload (Mirai)", "value": "d27eaa0ed7b56db1479e222ad20efe99", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776018, "uuid": "7adbb94c-74ff-4f0f-a8c8-3066c84ef6f0", "comment": "Malware payload (Mirai)", "value": "cc392a052f7220ef5c57328db0581ce8f73f7a0b04091e99a6fdcb4f41375892", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776018, "uuid": "226479c1-ee04-412e-9047-6581048df59d", "comment": "Malware payload (Mirai)", "value": "cbb8f5d7f51305c8e5f26fd3f08e9ffca2191c5f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781776018, "uuid": "d7e4a612-02f3-4962-88aa-d12bc697f997", "comment": "Malware payload (Mirai)", "value": "6ad2e86c171a1f01279739204e99731441ddc36c094db048d9815053b526f61af834d9f03c8deb9a50a6ffb93a000cbc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781776018, "uuid": "c9d70969-745a-45a0-a7b5-48e0e87ddbfb", "value": "T1355302DC5D3C21A6F3B56D7D6BA7FDEB801388A75AB708A115C04B8C7A883378853843", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781776018, "uuid": "e505f352-b8d5-4b18-ad9e-70b9d1fbc1d2", "value": "1536:0QvrLxXzEEv59SYp56sSdKtPjzUze1o5yim2lJerrfronGjwDoQ:l57hwI5gKSzei82zerHCDoQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781776018, "uuid": "ee495147-81d7-49f3-aaf6-d22ad1eef990", "value": 64524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781776018, "uuid": "93c7aaaa-773d-4488-8713-889ca7d02526", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781776018, "uuid": "a67ba9fe-8a19-44d6-b186-ffc4720decd0", "value": "monero.arm8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc991ee2-6af8-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781775197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781775197, "uuid": "21289683-98d2-404f-8d1d-80c718e8bc41", "comment": "Malware payload (ConnectWise)", "value": "e565a6fd699f1bfc4e2f24e8a6c9ae7d", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781775197, "uuid": "c9d68584-3bbc-4542-b308-7eaa6c5a3b74", "comment": "Malware payload (ConnectWise)", "value": "cc64671b2d5b7e95d6aeb759923f580eb6f8d5b45cd9f2b07c12cec362373aa7", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781775197, "uuid": "81da9039-40e7-4442-99eb-aa033dbfa6df", "comment": "Malware payload (ConnectWise)", "value": "764f3b205f43ff2b558c9a1bea6413f47753086d", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781775197, "uuid": "27188508-3525-4d10-8eb3-24d6a76efe68", "comment": "Malware payload (ConnectWise)", "value": "25d34110a03909fae6631bbbf38acfcf1d7dfef7cea7f8e305638764e54895582a0166504bc5498daf47486a43660496", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781775197, "uuid": "b21e34bf-6a09-4211-99ef-8d2a2b216c78", "value": "T150646D11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781775197, "uuid": "e56838b5-4e84-494a-a777-0c745e9d4c38", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781775197, "uuid": "ac94757c-b2a8-419e-8691-efc544539276", "value": "6144:ymlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9P:R1iw7gryNkSV1hy1Z1u2JLu9P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781775197, "uuid": "3819ebcb-3cae-4b4f-928a-21538f97506b", "value": 312544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781775197, "uuid": "700f8649-0751-499a-8760-629f7f3dae5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781775197, "uuid": "688b8b42-4a73-44dd-a5b5-ba2894353b05", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76095f6c-6aed-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781770354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781770354, "uuid": "1f67a40a-3a80-416e-aba2-6fb1de5af98e", "comment": "Malware payload (Mirai)", "value": "8c32d6dd3c1cd1eea25c425b9e0c6e41", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781770354, "uuid": "fad7e05d-5564-440c-9989-7d2c163b7c37", "comment": "Malware payload (Mirai)", "value": "cc6586fe289d4551526e45f547502c69f374bd74d0af0449ca363ea5edf62d4e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781770354, "uuid": "f4913ff7-55d0-4313-9203-954c40eb27f2", "comment": "Malware payload (Mirai)", "value": "2a9698dcd79783d4905797aaa0aa0af23229e73a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781770354, "uuid": "4f69d9e4-39df-4516-8de0-cd1b04bbc6b4", "comment": "Malware payload (Mirai)", "value": "6d032a979e04e44efe37fb0c5d38f411fc5a591a36b70f3ffa3ae4f8a61e6ff11ffb92c839dfd4b0c74a92f4f88f9452", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781770354, "uuid": "54d15b17-c727-4e69-a961-291f598fe5fe", "value": "T10154F80AAB610FFBE8AFCE3752E90B05258C545712A87F3A7174D918F54B68F06D3878", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781770354, "uuid": "056c724b-8bd5-45ec-aa38-b5c78612b9ad", "value": "3072:XvNRsR3XvCZbddgG07xJkrqtvJxa77U6BkEFfksEIwWFbauvoA:lWZardgz7xDtvu4+kEFZiYbahA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781770354, "uuid": "4cded080-0483-4fa8-b4e3-f8fd10909657", "value": 282432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781770354, "uuid": "802f929b-1740-4d9e-a5ac-8c62dc15c569", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781770354, "uuid": "6464c3fd-4bbf-439a-b8e3-ef4fa84dce34", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32c30cea-6ae5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781766805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766805, "uuid": "d0ac3248-2c2c-407e-a55d-a7d630dcd198", "comment": "Malware payload (Mirai)", "value": "46f43f86cd51540d03bf7818b471fa6d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766805, "uuid": "72f4510f-6a78-46f8-b21e-2878bd3f0789", "comment": "Malware payload (Mirai)", "value": "cc896d507fcd91e4e186b076efad0ded48f66d455ee03d35df0ab2ef53835303", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766805, "uuid": "e63e1b78-d00a-4690-bfd3-8a07792d9c22", "comment": "Malware payload (Mirai)", "value": "5cac93b755f0084c30502648eb7752fd41a9b43a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781766805, "uuid": "1a593b36-437b-4438-a488-897a44748b0b", "comment": "Malware payload (Mirai)", "value": "4d6ecb585b357950a12c03d82c65d62b4a1b322b14f4c9cc4ddd7826b8d238be66664eff03bc127de393e56c74e6e9be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781766805, "uuid": "a5b624d4-28e7-49cf-b31a-e91c5a4d5b62", "value": "T14C73024690AA7C1ADD3BDC2C69942369E724BDF8BC6CE2973EC71A29356143D17908D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781766805, "uuid": "4ee4017f-14da-4aad-a2d7-65b0afeaeaa8", "value": "1536:a/LLFR8YpTYn/XK1neVnpiS7jd2EZ/55e8SueOdVOzEIiFwvAqJbhtdOfEuXVElp:yXIYxCKYp97x555debJ97t4fEuFElp4q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781766805, "uuid": "bca011fd-990c-4b4c-83da-3a450b404154", "value": 78100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781766805, "uuid": "05d9108a-13a1-430b-8aed-29c6c2203800", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781766805, "uuid": "acf7b644-f1b9-42ce-a454-2bdef05aca28", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80226a86-6b07-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1781781538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781781538, "uuid": "ab6f6f14-a39e-40c3-b33c-3ccb678ca77f", "comment": "Malware payload (ACRStealer)", "value": "a5422441047edb1d9a0f3b3efad725a9", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781781538, "uuid": "dac3d1e9-92b6-4dcb-bde1-bcb3f5eb1da7", "comment": "Malware payload (ACRStealer)", "value": "cd7d8c91fde82da2353cb3fc0525c83b7648ad72db2c31fe067551debc0aeb47", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781781538, "uuid": "8b7dae1a-36c0-45c3-bd47-48ca64e46601", "comment": "Malware payload (ACRStealer)", "value": "0a6f700dd910cff8d8d8379c3a65248777115818", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781781538, "uuid": "a3bae560-5c64-47b4-9c4f-7b369a675b8f", "comment": "Malware payload (ACRStealer)", "value": "0ce862f2178d051ac1c88978239747e0aaa7489d6ecc58d369682d040b4b482042e90ed1ea23d4db42203999d5c92cc9", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781781538, "uuid": "76878485-3585-4679-8fe6-34eb2fec9e08", "value": "T10A643B03BB40E405C9266A758975CBF86331FC4C9E65975B31C6FE2BBEEA6C25D022C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781781538, "uuid": "77220a87-df27-443e-926b-7407ca770a51", "value": "c4cc951c5c18c96cb578ff9ba395f774", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781781538, "uuid": "3de19a15-a0ac-40b5-84bc-35ee36dba2de", "value": "1536:NkwvoAtRoah8dDQao7TkKl4ql7oyJONkgUEz+yVBOS2NBWlu90O5byAU4ie8QQsv:zvFp86tTecW844f+kPxE3O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781781538, "uuid": "ed1b96eb-9ffd-4ef7-b008-dbf93107c5ad", "value": 320344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781781538, "uuid": "f713b64d-adcb-4f1f-923e-3b79c48e22be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781781538, "uuid": "0d2e98a4-95fa-4e1e-8857-fa4e3a61067f", "value": "Voltix.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02545b7f-6ac6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781753410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781753410, "uuid": "6e418eac-b3ae-484b-b0de-025cdb53e701", "comment": "Malware payload (Mirai)", "value": "430d688ac40b5d2ae93114e83421460e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781753410, "uuid": "11651101-dca8-468b-8ba4-bcaf8ba02e89", "comment": "Malware payload (Mirai)", "value": "ce60455ea0b6df39ae07f162abb0eb43fce9d953d694bb3b8b21f66fd86663df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781753410, "uuid": "03f82c4e-dc8f-446e-8f11-3fd9d901b4ea", "comment": "Malware payload (Mirai)", "value": "880dcbbfd3e1862265ef19b191437230e4ab03a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781753410, "uuid": "da737ce3-476e-4fac-b073-4d3b40727767", "comment": "Malware payload (Mirai)", "value": "53a9f1ef375d7d57e8dd77f8c38fc9a8339a276b611f6b40758c7f02fdb0d36d93af69866090510ece08c18a9dcfdb68", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781753410, "uuid": "e242ce2e-d9a8-4784-91bb-4e222c736187", "value": "T158E30946B9519F12D5C321FAFB9F818933136FB8E3E97102DD206F50278A99F0E76612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781753410, "uuid": "48dfc3bd-e3cc-4b84-af9f-05e4783be4d4", "value": "3072:TzH1Sjy3lHidswtw84kxZu93SZ4ahdYwyuJVv1wHlm+zOYv+ggey:TBSilHidsmw8o9A4ahdYwyuJVdwHlHOF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781753410, "uuid": "12b56dd7-c648-436c-9efc-5d41b6e85d12", "value": 145692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781753410, "uuid": "f515bf25-8c76-4861-a64c-b6629002e54f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781753410, "uuid": "e52e7e31-e3c2-4b3a-8fb9-447545320ce7", "value": "data_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5307d697-6aff-11f1-a769-42010a9c0008", "comment": "Malware payload (AdaptixC2)", "timestamp": 1781778026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781778026, "uuid": "5b0367cf-3307-42e1-834f-df5063233832", "comment": "Malware payload (AdaptixC2)", "value": "c4d3f34d5f258eba4ce9937474d7416b", "object_relation": "md5", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781778026, "uuid": "7663cb08-3b87-41d8-b0dc-246a4624970e", "comment": "Malware payload (AdaptixC2)", "value": "d01af3cb30106d2003c96787fa3172d6f2f1ddf9a25376ec7a3dc48d77c1dcdb", "object_relation": "sha256", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781778026, "uuid": "9a5e9369-0530-4226-b5ee-b4501599d4e7", "comment": "Malware payload (AdaptixC2)", "value": "c72f3470d90c1472614efc295107f3fe24813c4e", "object_relation": "sha1", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781778026, "uuid": "abfa21bf-45b5-436c-a5cb-ead5b2250a26", "comment": "Malware payload (AdaptixC2)", "value": "6fc00ce08751d47a231dfcb5bdbb2f3543e1bbcf6ad9b48b9278acd1dcea595cc9a0cf170f2964d80388681ab13e17b2", "object_relation": "sha3-384", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781778026, "uuid": "22971204-8824-41e1-bfb9-9212fb17d413", "value": "T106645C76055B7DE9269C1E96F405BE190E2DA70B051A814ABFCC60FD1FF86F48E04E3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781778026, "uuid": "f221d61f-ea60-4943-ba5d-16810c3968f0", "value": "6144:KlWoe6cTAHEWByBdclm2I3w+SHoBDBlmHICws/:MBaTAHE7dcMI5IhXXK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781778026, "uuid": "90af60d4-ac64-451b-a0cb-d263cd006d52", "value": 324632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781778026, "uuid": "e11287f2-abd9-414e-b25b-0f145f096b26", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781778026, "uuid": "37ad4898-241d-432a-ad14-1b26c48a4fa8", "value": "Formulario Revisao RH Movitel.pdf.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78ece819-6ac4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781752750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781752750, "uuid": "55d0bca6-4531-4846-bc22-dd0a716c6a10", "comment": "Malware payload (Mirai)", "value": "26b0f93135286a804fd838a0147941b2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781752750, "uuid": "fa95edbd-80c0-480d-b046-c730e537d2fd", "comment": "Malware payload (Mirai)", "value": "d147d287d118f2441940f157e19b5e57fbfe949865748b2db7fd05b5550cfe48", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781752750, "uuid": "71fff85e-9b84-460c-8884-bf5685fe929d", "comment": "Malware payload (Mirai)", "value": "1c29c8fbea576bd4b1024e103fed8c04a7b29d1f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781752750, "uuid": "b40b2632-6569-4491-8a8b-dd9c54d97b7e", "comment": "Malware payload (Mirai)", "value": "326b5a19820a15a76eadf57ccc53209203c4d5ae9f886b94f09b2f7cced94b729480410a60bdd1d136d6376e050a65f2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781752750, "uuid": "c0e22d55-993c-4280-89e5-268f5fc499ae", "value": "T16CC32802B70D0F43D1232CF02B7B1BE1879ABEA518F5E584651DBECA5274DF62182ED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781752750, "uuid": "4b441e87-6738-4aae-8d4d-74b52d10d0d7", "value": "1536:p9SCyWtoJMKM8h6mUHi/uBviJdCCC2Z3Ujd+rla1ihfJkZZX4LI+INtF8i/tFhoP:iChCJf/uBmCB2ThsZ3J8ItutTMo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781752750, "uuid": "38851097-5e2c-4dd2-a5d1-ca6df06caf35", "value": 125032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781752750, "uuid": "991ade2b-294e-4561-83e7-98f632c239b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781752750, "uuid": "71d4e455-35a5-49c5-8854-715a07d16dfe", "value": "data_powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2de6606-6aff-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781778241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781778241, "uuid": "379158f1-a2ca-4d87-856d-77042f7760f5", "comment": "Malware payload", "value": "49cbefbda9cdd97a6a03b92f46084902", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781778241, "uuid": "97aa93f2-4992-4643-9ade-3627cd09a26e", "comment": "Malware payload", "value": "d1bee54b9b5cf59ea78284ef18d8f5e4eb8c6d60d2957d40bf199721619aaf82", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781778241, "uuid": "5306fa23-b87a-46f2-9b36-ac4715b51df6", "comment": "Malware payload", "value": "7208e70999502ccad068efdbab931a97e96f0f1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781778241, "uuid": "7cd752c2-d38d-4ec3-8100-f0d2142e027e", "comment": "Malware payload", "value": "caff2ea9128a4fa8989f05d39b57048c0426da222179c04e0e823ccc2fd695c2ef17a390f2b44c2a9f31a8238e755c33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781778241, "uuid": "fc7b7c1b-1ce9-4815-8c33-05157ea9fcb9", "value": "T1EC773301102715ABC1C1BC77EE3FD6B4AF76B729616E3198903EE23B7F941D12E68462", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781778241, "uuid": "3ae50622-e0ca-4c54-b312-ea0760a8ea1d", "value": "d54f4ce7166adf987d04345af91ff939", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781778241, "uuid": "cbabcf83-790a-475d-b211-85a428438fcf", "value": "786432:NIk+ErDw9o1hXEXOWDebtoBSBfhXDthOAbpiSg3X/LF0lA9iyT3Zx+zeS:L+0DwOXuOWqbeBgDP3ihLuA9BZtS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781778241, "uuid": "3dddef0d-ff71-40b6-a0d2-a5ff29095d1b", "value": 34412674, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781778241, "uuid": "f6c9bc90-9e85-470f-b578-b8a34de1e75a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781778241, "uuid": "181f0a0c-b203-4366-bbef-4c4dbafdb4bb", "value": "Solara.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51755ed7-6b3a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781803364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781803364, "uuid": "a193b917-f483-412f-a937-81f3961e1c28", "comment": "Malware payload (Mirai)", "value": "5ea58e7bab428add2cbed903168d3837", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781803364, "uuid": "cb501e62-5597-48b8-93da-705cb2b6eb3e", "comment": "Malware payload (Mirai)", "value": "d3ddb82e055831f0106bb5ca4e54b632c4332bd0b749d89f1124b333af93d608", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781803364, "uuid": "bde51449-034a-4040-bf75-49eb84afff53", "comment": "Malware payload (Mirai)", "value": "92442b3cf36ee4eea93b0cfba0fe10890a3fffb8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781803364, "uuid": "b7b0be1c-6688-456b-9d33-b7ee418919cb", "comment": "Malware payload (Mirai)", "value": "0c1b59a5c32cbbcf45ed2d62763fa5b0d3cdf5eda1c90cdcf35e59518858f0c05fc520b8c76d5bbb559392603993867b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781803364, "uuid": "ecea4237-2cdb-406e-9b7d-ef69b67dcbc3", "value": "T1BC93084AF9819B11D4C913BBFE1E018D33536BA8E3ED7112DD206F21A7CAA5B0B7B451", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781803364, "uuid": "87a69c0e-9867-4e5a-a328-6aa884d3b7fe", "value": "1536:C5nC3zgeZsMMN7ZZN9rHq9YQwIi8Sv+eAa+G+yMfDhlD9ln6iJ/PXaSY7r0wbZnY:FjgeZsMgDPrKet8jeAa5+yMfD/V/PXam", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781803364, "uuid": "684714fc-407f-45cb-971a-4ba0ea01c924", "value": 93704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781803364, "uuid": "c5685673-204a-428e-8595-d78272fce95a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781803364, "uuid": "2b64a227-69b0-4493-8ec9-911b8d1ba341", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "411a5211-6ae2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781765541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781765541, "uuid": "407881d9-2031-4caa-b5ec-0bcad0b9f727", "comment": "Malware payload", "value": "f5bf12d55e54c228cb58f3fb21419613", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781765541, "uuid": "89115bc5-0119-495e-a3ba-c3055ff8262a", "comment": "Malware payload", "value": "d43495cb6ebea33f74f65baa3330dc94eb7669c293933d618c4d3e08f81c525f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781765541, "uuid": "ad1bb9ca-2dff-4803-9eae-f2f344bdaeb2", "comment": "Malware payload", "value": "3c768dd66e5acd1a23d19d92b226aeeccc040a60", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781765541, "uuid": "1530f4a1-1694-42de-97e9-db1c6be81632", "comment": "Malware payload", "value": "1e77b217e8e2b82f3edf34889a787380ae5e7277700be8a781ee4c5f714f4493d2f7cdccc83029b55ed0c5daefb091e4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781765541, "uuid": "1d7732c9-b720-41a4-bc95-833c97db08f7", "value": "T12EF31A45BD418F13C5D721F7FB9E429C371A6B6DD6EB3102E9257FA0278A8D60E3A201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781765541, "uuid": "86951af8-df0d-4801-a09b-bc0ec35d49ad", "value": "3072:ixPwRUfq5xlpCnvuGU7nZ4LScZ5o1dlfhoYY/dITD:+wRrODonZ4L/Z5od5oYYlITD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781765541, "uuid": "eb18f3cd-5e79-4259-8ed5-f3014a870987", "value": 158816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781765541, "uuid": "58203637-21aa-49bd-b9f7-5ee3c6dfb1b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781765541, "uuid": "f03381b9-afdb-46a9-96b5-adb5ef787976", "value": "nova.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12ad6843-6ad9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781761597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781761597, "uuid": "c49b9d9f-e258-40f2-9d83-d7204164ffa7", "comment": "Malware payload", "value": "427c372caea355e9909f66d466d98e97", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781761597, "uuid": "375584c1-aaec-4a0b-b3d7-8eb38f6e4a69", "comment": "Malware payload", "value": "d47f924db4419333233cd215eaaea037983b7ab00d63274c5f4125227f80e920", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781761597, "uuid": "4da8d0e0-18a5-41b9-86dd-4e1bfc1f2b47", "comment": "Malware payload", "value": "daa33bbb7804191b8b532f55ddce16463178c676", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781761597, "uuid": "973bde5f-ad4c-46a0-9764-b2ede3bca1c7", "comment": "Malware payload", "value": "3ea880d2c18960e70dd31b0af6ee55b94bfb924556ca7df6e206eba2f46fad3b2e91ad27ce93289fdc78901147efadc7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781761597, "uuid": "6c3a37e9-6e0a-443c-977c-0088201b13ad", "value": "T16005E93CD9A4432EF072D618C46A480FF8A63987523CED1B11C2275F6E63946B7E672D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781761597, "uuid": "76bf39bd-de65-4050-99ee-c66e40b3371c", "value": "3072:cWE3Hrdc/biHQJcTmb40LISWZ7Y5/3QCveEq6DxdBMVsNlk0S3wnbiTG0I/NjGaQ:jjd87ZMBA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781761597, "uuid": "37d6011a-7602-4065-91e7-b8918c3f2348", "value": 858666, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781761597, "uuid": "1fbcddf6-eb07-4acb-b568-7046ad7d8e90", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781761597, "uuid": "6b89c67d-38f0-47a4-af71-3c262de5ef5d", "value": "SUNNY 5916081940.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba180af6-6af9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781775622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781775622, "uuid": "fc518643-8ec5-43a9-8bd1-7ecd263b5a0b", "comment": "Malware payload", "value": "e6adfaba2705432fe0f5a4fdf1a92211", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781775622, "uuid": "e1487d9e-0970-4f3e-bf49-643030fa713d", "comment": "Malware payload", "value": "d4ad21a0ab039ad4c03234e902134a1b17adf2969e11032811c01d758e5915c0", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781775622, "uuid": "df5a30d3-4f8f-4db4-a3d7-4b8a071a0686", "comment": "Malware payload", "value": "7bbc0b1bdc2df8decd0d5c54805e6cd5b40bd07c", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781775622, "uuid": "383fd656-3114-41da-a6b7-d57e51660bd2", "comment": "Malware payload", "value": "88b85920af26eb320d0285ebf58101ec8e20965008befefb03d251e30663c581b66baf01ae8123891660216352046beb", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781775622, "uuid": "5bc92288-2788-4214-8455-acdcdd615f54", "value": "T190D56B07ECA549EAD0A9A33189B756867B35BC081F3227D33E50B3782E77AD09D35724", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781775622, "uuid": "cc76f6c6-d666-4e6d-aa67-ff19d3717c47", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781775622, "uuid": "3da20886-4681-463d-8ff6-0e74bbaa0ab4", "value": "24576:XWSn04R1kiAmo0igExQU74IePVjU5REQtFc4TXfJlvpFWSAYQho7PTTsKvAoBels:XWS0C1jXif574xB4OQ7TvDihog1HK7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781775622, "uuid": "d60c99a2-6450-40e1-9d2c-ca82d685035d", "value": 2846088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781775622, "uuid": "77b621e8-bc98-42f2-8cb1-26b858fb7c57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781775622, "uuid": "bc40e2bb-0822-4e82-b145-7fe288b8418e", "value": "hjbk.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d157d78c-6b3c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781804437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781804437, "uuid": "222a5192-db14-4e12-92ec-1d9faae25afe", "comment": "Malware payload", "value": "e3ee577e7f51aad3044310c906b0b2bf", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781804437, "uuid": "29d65149-7613-4a44-aa50-fe1375f176a4", "comment": "Malware payload", "value": "d59530f2c86e6bb8dc84e934bbb28b2412f007014fed1ac528317356af2918ee", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781804437, "uuid": "8f8a9942-5d5b-4c14-9630-035ab312e0b0", "comment": "Malware payload", "value": "c5aec51039e518db063e48332d607352ccf62ac3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781804437, "uuid": "483549a1-0afe-4905-aeee-1f995bc9457c", "comment": "Malware payload", "value": "4b99ad500a8dfd4ce66a326e16eb2ed21df5b6cde3c05df23723d5247a53aa915c5e2bb03c214ccde0f566c191d574d0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781804437, "uuid": "47ca423e-39fb-4604-8d1d-b9c74da887a3", "value": "T1CDD08C22594F2011C073283117358E88B326B195810EABC6A68C3A010C12DCD3F96BC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781804437, "uuid": "95a12202-f016-4161-855b-1eee10da4dd1", "value": "3:vhj9ltd9R1v+qOYQx7Ppvo1etVLZ6+z1zX19/zllVxxNYyFzll/fzl+lilltn:5j/v1vVOz7m0LZlz1dxxWyJLl+li1n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781804437, "uuid": "6dafa314-c514-4746-9595-1c02a514849b", "value": 206, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781804437, "uuid": "40442da2-baf0-4888-bbd0-428b099589e0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781804437, "uuid": "5ad60ca1-fc20-4c21-8da6-334a5be23bbd", "value": "34.246.160.82_1781802066929359_wp-admin_admin-ajax.php_hfaBf.zip.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6477197-6b31-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781799694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781799694, "uuid": "4248086e-b870-49bb-87ae-92694cebced8", "comment": "Malware payload (Mirai)", "value": "c74922416023e248305552cf3e2289e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781799694, "uuid": "bf36ced6-22c8-48eb-89df-58fd117c0ffe", "comment": "Malware payload (Mirai)", "value": "d59d3071fda21c0423488fd4f93c72edceca12e5b7cc0a841808573e5bc7ad57", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781799694, "uuid": "55a3da86-6247-4880-99df-b463b0fa6cab", "comment": "Malware payload (Mirai)", "value": "d6f81f267b0d0e5d63072b01b72c393989461754", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781799694, "uuid": "f53a6b98-ebf1-4cc9-8cea-c9e933d48405", "comment": "Malware payload (Mirai)", "value": "89028e2c5b43fadaa93d52b2ff3b0d497277092fe0c405ed7c11819ee6cbe934158404da1c0ddd51978ffbcc2dd33755", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781799694, "uuid": "a8c2920a-a571-4ee8-a3da-ec51109ee74c", "value": "T193D33A06730C0947D2632EF43A3F27E193EF9A8121E4F644355FAB8A9671E361586ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781799694, "uuid": "80552ce2-aec7-471c-853c-2b8814613eeb", "value": "1536:6WCPE5Uoe37FgV8I2YAcxfjI5EPVfffXVY7gKr4vTubvArjIEW+NXNkqIn5gx:61p3/YAcxSE9m7vr4vTXrdx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781799694, "uuid": "75e21e23-5656-4a60-8898-d2aa4c918fb1", "value": 134036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781799694, "uuid": "2ae30d4b-93ec-44f3-857a-0a87e01e4245", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781799694, "uuid": "f74227ff-f0f5-43a8-a75b-0b8c7e838da0", "value": "main_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2359058-6ae8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781768308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768308, "uuid": "f28fc72b-63b4-47c9-a5d2-7e0eb2eb9487", "comment": "Malware payload (Mirai)", "value": "1747a5ca5af7f767326bc88650dc3d78", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768308, "uuid": "88c09954-2d2e-4ff3-a644-851f2b4ee857", "comment": "Malware payload (Mirai)", "value": "d6d0ed2035e003e163aa3a0d2abb7d2b69d05f4bf2d8849660690ec21094c3d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768308, "uuid": "7e5d6461-8bf0-4072-a47a-8669ef8df8d0", "comment": "Malware payload (Mirai)", "value": "928910abeb761e5fcdc25fc6bd0e8bd1fc56e5bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768308, "uuid": "6f946d09-19ae-41a0-8c36-b9a012d91e5d", "comment": "Malware payload (Mirai)", "value": "73fb35940ebe4b526026d83aca703fd80ff612366cd9c21cd9a47f14dadf87d5edee749b6b2746f555bbba80ac621e01", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781768308, "uuid": "6c8f7f2d-1b2e-41a5-895d-de86e186c464", "value": "T190442298F68E5C2979BE2BDDE812C6DD5585AEE24B07CC81C1C01FD8DBBEC5688B0417", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781768308, "uuid": "d032f872-3149-4573-af75-01f086e96ac8", "value": "6144:mKSzm+5OpxRCkA/+xVdbj/ho/7Rkrm1i8jW6BVwgiAdOM:zdA+Vd3S13HSZPM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781768308, "uuid": "9c3b4e88-5961-4951-a7f7-31858ee2b15c", "value": 265496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781768308, "uuid": "600dfd42-e0de-4159-9be0-624374cb48a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781768308, "uuid": "90a2d989-19fc-4fd6-9973-b8af3be2cf11", "value": "kaizen.arm_srv", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "749d0855-6ae6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781767345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767345, "uuid": "c185456d-7f2b-4f03-a78c-fc6b28963f19", "comment": "Malware payload (Mirai)", "value": "d9eba7dcee72e81783c81095110f40cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767345, "uuid": "a001da58-8bdc-41a3-a1e5-325acbaabeef", "comment": "Malware payload (Mirai)", "value": "d6de66c5774d834c0b246df4c8f74f40f0f932a3faa4f4eb1f73daf542ace51d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767345, "uuid": "e9d8a088-c70f-4d7c-9968-ae7b558940a0", "comment": "Malware payload (Mirai)", "value": "10830d4ff148b94f2d52a748239f5f5db56a8130", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767345, "uuid": "9937bc7b-43bf-44af-ae67-bbd48ff4e981", "comment": "Malware payload (Mirai)", "value": "46c07e4ee91128fcdbe05d1d8e296a7b318dd1e2a57cf74fa6bf1c18e51b12fef1b433100e4781c463201b9ffeec762e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767345, "uuid": "7155a712-73ed-427b-88ce-22c69ad20712", "value": "T147E2F1DF3D5B56CBF2426336A11EB36677808420E127E35BFA0A5D1C86364B56B31EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767345, "uuid": "4adbd448-7662-4c6d-95e1-2ca581fea628", "value": "768:qAHplmmfg6+amp6lXGwS7lMs5/gB/Ez7PUuqo2W:qAHtfgVb6l07nO6bAo2W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781767345, "uuid": "996d5623-bf9d-4fce-864e-e7be481dd1be", "value": 33020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781767345, "uuid": "9723b4c2-25da-466f-b411-68c7baad5e63", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767345, "uuid": "0b40f3f4-5288-40bb-9005-a7aa8427083d", "value": "h0r0zx00x.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7b5b599-6b5e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781819078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781819078, "uuid": "d247059f-008e-483a-b8cb-28a5a29b9058", "comment": "Malware payload", "value": "55d4de0b876b02c38cf18eb9e7ec282a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781819078, "uuid": "28a11072-923d-415f-b38b-7fd9a02bdc1c", "comment": "Malware payload", "value": "d6f37ef270e950ce17d63a28777ab87b1b8378585e22a4a14f1a738e1a3ff2bd", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781819078, "uuid": "54ba278c-6b07-412a-abb2-6d0fd71d875f", "comment": "Malware payload", "value": "9e53f02d5d1624d5d1392e3291c9ab2e2601b535", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781819078, "uuid": "d46ebbf9-e96f-43da-817e-fca8f0180c06", "comment": "Malware payload", "value": "371ac2c0f164c66aa94360567bd73b161f223bba774e9e0fae274486f3b99fe21adfe0ef24e44cb490b527f17d0de37a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781819078, "uuid": "3421fc1e-b8b9-4a77-8661-79dcfd712558", "value": "T1A60182C68950AD00402EDA5D66A796A0B450D3CF454F4FB47FDC5D3DFB9C918B026F54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781819078, "uuid": "25114ec4-3a2b-4552-bcf9-63ea47c256ba", "value": "24:kXCKysE2hi0ziQvZohakLEIHM09N83BIWY3BA7:e9Qp+MskLEIsm83Bi3BA7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781819078, "uuid": "f5757c7a-99e4-4727-b021-8dbfead2488c", "value": 839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781819078, "uuid": "c2d0a7c1-7501-4aae-8f20-c9e38f8c4295", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781819078, "uuid": "a65530c2-e20d-45e3-9b37-bd13e197cad7", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c34378c-6b33-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781800295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781800295, "uuid": "f8d95588-1f36-41b3-ac8a-0cdb85de282b", "comment": "Malware payload", "value": "e8c82368f5f863c3a4a3d633dc3147d6", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781800295, "uuid": "b2508a75-0381-40ac-9612-190568a3ad8a", "comment": "Malware payload", "value": "d73f7908d9d064dac2b49af403cba027d28f681775051ab387f0b49d094c75b2", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781800295, "uuid": "9a379848-4cc3-4b48-a360-c546cb162cfd", "comment": "Malware payload", "value": "efadde6261418d72ee874bdb044f9cf381c2c5ab", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781800295, "uuid": "8261ca7f-7926-4509-b648-33be25ab858f", "comment": "Malware payload", "value": "9cc8b8fc57d02618d95f04bcd85d905afe2d907197377bbd16b90be471e4a317360888c27845f7ff4fc49cc31a6d19ce", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781800295, "uuid": "9da2fb10-e372-462b-a476-40e02a787be6", "value": "T13547233B624AB93AE02A2B305973C5A0503B7D69ED134D1B96E43C5CDF319A03E3B756", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781800295, "uuid": "3422b4c8-705c-4b45-8413-bf0a65e3fec1", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781800295, "uuid": "1a0ee6b1-8815-4270-90d2-8d36c5474ec9", "value": "393216:2fvTekpbMuUCJro/+NCSCnrDvDCf45AvJiEXMk31duMHV:2TJMQk/+12DvD6iCMk31VHV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781800295, "uuid": "1378a354-9e2f-40d1-9472-d2cfbe9e6a98", "value": 24664298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781800295, "uuid": "91639b28-7afc-44c1-ac94-890f1c9b5faf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781800295, "uuid": "e4ea675f-e991-4d2f-955c-235987012902", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a6363f6-6ad9-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1781761718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781761718, "uuid": "a16ed09e-cb2f-4448-b104-ea6fea83ce18", "comment": "Malware payload (GuLoader)", "value": "cd1850e4af9151d23923ba7f5079b509", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "purmed-ro", "colour": "#29855E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781761718, "uuid": "24c54ecf-b85e-4435-b0f4-94d484cabe41", "comment": "Malware payload (GuLoader)", "value": "d7577f2b26fdcf537bf6551bf5b7e3e0020bb7b4a538ba9c444a49ad09355034", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "purmed-ro", "colour": "#29855E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781761718, "uuid": "4454f574-5995-4c25-986f-c032747a2d8d", "comment": "Malware payload (GuLoader)", "value": "bacd4c84c11c375d6f47c575a1c97ea000935622", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "purmed-ro", "colour": "#29855E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781761718, "uuid": "a6797e88-c8f1-4b24-a9bd-55d3163eacec", "comment": "Malware payload (GuLoader)", "value": "d646602dd758bf25b93772f20eb6d1951e4ff95de6f8768203a99bb414006c6a255c5131d57ae1818a77bd19457504ad", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "purmed-ro", "colour": "#29855E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781761718, "uuid": "a64b668b-b5a1-483a-bcb9-870f3ee45297", "value": "T12C5163B1830E1FBED6CD0884D3823247D0FA3C4876D29D467B35A9521D6F2E456A08D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781761718, "uuid": "9e620f97-e4df-471c-8bd5-5ab745e3764f", "value": "48:YoTy7ytU7WZuWKxUM2WeYkE54ihLcn0SRRB8kURosLN/YNg3Ul:YO74Wc7pN5x2/qkU2hN8Ul", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781761718, "uuid": "bd565450-983b-4f3a-962d-6758bb5c58d4", "value": 2715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781761718, "uuid": "036da9ac-0e8e-4920-a713-b96820422f68", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781761718, "uuid": "390eeefa-0a3c-4815-85b3-9e83ede407c4", "value": "DBS_confirmation_of_funds_transfer_06_17_202600000000df.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ebb79b4-6af6-11f1-a769-42010a9c0008", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1781774127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781774127, "uuid": "933abcc2-4b9e-4dd0-b48d-de3750c85185", "comment": "Malware payload (PureLogsStealer)", "value": "4b3b0e8676bdb830dfde06e79b594515", "object_relation": "md5", "Tag": [ { "name": "ascii", "colour": "#26C43A", "exportable": true, "hide_tag": false }, { "name": "CHE", "colour": "#910C17", "exportable": true, "hide_tag": false }, { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781774127, "uuid": "af1c4984-5a8c-4e5e-8191-41ec4339f342", "comment": "Malware payload (PureLogsStealer)", "value": "d78bc974947dca5f86fc0b5503e157b1537dbac4bcfe4bfb1779213342a5bb19", "object_relation": "sha256", "Tag": [ { "name": "ascii", "colour": "#26C43A", "exportable": true, "hide_tag": false }, { "name": "CHE", "colour": "#910C17", "exportable": true, "hide_tag": false }, { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781774127, "uuid": "50ea0e81-87e5-4a42-94c3-bd1b973428ba", "comment": "Malware payload (PureLogsStealer)", "value": "7509a6de1681965034e5a529beffc5a61ee9f67e", "object_relation": "sha1", "Tag": [ { "name": "ascii", "colour": "#26C43A", "exportable": true, "hide_tag": false }, { "name": "CHE", "colour": "#910C17", "exportable": true, "hide_tag": false }, { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781774127, "uuid": "afeb9bde-7227-4b3a-a750-158d9e4aca09", "comment": "Malware payload (PureLogsStealer)", "value": "ed26123fae2f4c67f1890263882ad7d30ea6a330e8c9f32404611fab56c1236603f97b7780da97b0f34535b4d86132dd", "object_relation": "sha3-384", "Tag": [ { "name": "ascii", "colour": "#26C43A", "exportable": true, "hide_tag": false }, { "name": "CHE", "colour": "#910C17", "exportable": true, "hide_tag": false }, { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781774127, "uuid": "06fc5048-90e4-4dd9-a774-32d729aaf37e", "value": "T1DA96A18682ECA305EFFF3F12F47901444862BD955C7842ACA65C0819AEF9ED8CC75E76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781774127, "uuid": "295182a8-e5a0-4330-82dd-c9ed68b9413d", "value": "768:1bItI1dXYam8zEOKpcZTyd2wqyut7y+THKT1JUFjwWTADRh5c6fXfasxHAWeAtTJ:8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781774127, "uuid": "0930b4ef-3519-47b3-9c4d-80d2f0a2f091", "value": 8947944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781774127, "uuid": "28be024b-e169-4817-bf6a-4ebc0b81cf3d", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781774127, "uuid": "77e067a4-6159-4481-8df2-f39d2c021df0", "value": "DE-00390200 Rechnung R-0000329.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07cb0f76-6b25-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781794221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781794221, "uuid": "c3a6b2e5-838d-477b-bd2e-7a9f3d7da669", "comment": "Malware payload (Mirai)", "value": "d7559f4c8574dcb4c051095e19238c73", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781794221, "uuid": "8141ae9c-b5cc-4f31-bc90-78b7ad6a05d2", "comment": "Malware payload (Mirai)", "value": "d9e55ef8ffdce4b31f302640e7d6cdddf67a6b631c3009d6bbe85d9b5412853e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781794221, "uuid": "1f3496be-f879-4ab0-bbe9-61e457626a01", "comment": "Malware payload (Mirai)", "value": "f4f69926f4876b60d45be34b16be86dadb2b2453", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781794221, "uuid": "25af0144-2e89-452d-baa2-fc3c6885ab1c", "comment": "Malware payload (Mirai)", "value": "0a94f1730093010070653bec1ab96c1aae6719c8a9729277c1e016d8e317e796c6dbfc0b4588d99bb47ad3c168756341", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781794221, "uuid": "1991a71a-0c50-4e34-97d2-e3726deebb8a", "value": "T1B4730265E21C39F3DBFA1B6D2FB5BDC817796DC022FA9498F107DA190F184A043A5A70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781794221, "uuid": "be82360b-97e1-4e50-a4a8-b91e9718e138", "value": "1536:QkpBP2EnWEuC+AnHhgk0bKo9MVdAbWHY77SC4UToioyhTrX+yx4u+qgw09q:ljPvWEu3AnB8Gd1Ir4UTfdrHx4u+qgwD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781794221, "uuid": "4dee4e2b-a2c5-49b9-8ff3-8eecddfaf11b", "value": 80396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781794221, "uuid": "089850b9-7c0f-4108-a09d-86a0b2b8da7b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781794221, "uuid": "fcee0bc7-ec80-429b-9d8a-6f61056e9997", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f260df3b-6b1c-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1781790749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781790749, "uuid": "5cd4f1bf-a936-4fd6-aa19-5f0998cf27cd", "comment": "Malware payload (LummaStealer)", "value": "08f7bd68b412087ec63f76150088d813", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781790749, "uuid": "2e9178dc-0293-4c80-99ef-d5c9123002c1", "comment": "Malware payload (LummaStealer)", "value": "da7acbc71a87dcd173d1dfc3a82f40ab784d5896756938afbc1dee2cc5dc7dbe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781790749, "uuid": "93d47ba3-7d1b-411a-8205-7e7d1c9d2328", "comment": "Malware payload (LummaStealer)", "value": "c322b2d4dab977d16b8bb8241a9f186d75dc5e63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781790749, "uuid": "6ddb3d48-2385-44c4-ad7a-ab94f4dbb162", "comment": "Malware payload (LummaStealer)", "value": "50628d46361f5a068511d0557d365201d6aa6e91590dcb2475dbc0c7b45edcbc74f9d69e56d4f7881c682910b8b94541", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781790749, "uuid": "c2e7d1f3-6716-46cb-843e-836130176364", "value": "T1BCB54901FD8744F6E602163144E762AF3B39AD051B369B9BEA543B7AFD776E10832309", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781790749, "uuid": "3fda11cf-83c1-4d28-9ecc-d46991547692", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781790749, "uuid": "c196b97a-9250-4643-947e-3f5f81df9cb2", "value": "24576:YiNrV7nP9mEcg/LKinFRAsFOKVLY2ykHAuZSJ2EBwdO6xxfdju8ZefRGjZphrVMc:YKhfnMOO2/XVmjzwXbm5bs/FxCbqR9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781790749, "uuid": "7f7b3cae-f30c-43cc-bcda-31ae5af89238", "value": 2460024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781790749, "uuid": "f6679fd8-0eda-482b-96d5-75a6ba073635", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781790749, "uuid": "62a3c328-6848-47c5-808b-d245fbf682ab", "value": "ws-Setup-Complete.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58f44dbf-6b08-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1781781902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781781902, "uuid": "73451878-242a-4562-be1d-46eff2c78695", "comment": "Malware payload (Vidar)", "value": "334c4a121bf561da900e6b80a5f9a9ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781781902, "uuid": "0b8aac1c-e55c-4e77-9296-1d670aaacb7c", "comment": "Malware payload (Vidar)", "value": "db72a8e1b8dde1130633bee725f093225117e30026aa008f595d374c967da8fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781781902, "uuid": "c592063d-c957-44cf-b151-3fa2f1f3c814", "comment": "Malware payload (Vidar)", "value": "9ca7213b6e7707d226d62f564d7be70a95061f49", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781781902, "uuid": "72a9979c-2200-469f-8708-7ef0ed160cf8", "comment": "Malware payload (Vidar)", "value": "4ae780503009ee92de79055699cbe18e04bf837124100591ce52794a4d03259d7df141d320669807f1ff439c4098ec71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781781902, "uuid": "4be44332-d70b-40a7-b15d-6df623ad0a09", "value": "T10E068C07EC9148B9C169A3318CBB5262377DBC061B3223D72E54B67A2FB77E0593A354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781781902, "uuid": "8b42bacc-ed75-4649-b468-576d24e42d29", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781781902, "uuid": "2b37387a-c38f-4955-b470-dd712be8ec50", "value": "49152:NxjZUM9l57+wgnZ94yiSaJhmeI7yFW6qUmrSTCUQ/JdlSX:NXBTWZ97aLmeIeFWrDGTCbtSX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781781902, "uuid": "6a2d959b-53fc-4b1d-8708-b66da87a5026", "value": 3860592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781781902, "uuid": "dc60bb7a-4a2f-4265-9bdd-727defde7213", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781781902, "uuid": "c313e1f6-19e0-4952-922e-b32fe2d53976", "value": "mpclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1518eb08-6af6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781774057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781774057, "uuid": "c7a42642-621c-4c6d-a4ff-d5f82a47cc7a", "comment": "Malware payload", "value": "45208c60b7b5a45b5bc8e7d37314db88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781774057, "uuid": "5724c9d5-41d5-45ba-b8b7-99c166e8bec8", "comment": "Malware payload", "value": "db7332e33f68a49c205d087eab3a39d2738ef94926cb742697fbca059a4784e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781774057, "uuid": "146e8eb0-201b-4558-8a71-26a0354164e4", "comment": "Malware payload", "value": "006dce8b2429a70b7a9fe9bf68010fac66f93732", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781774057, "uuid": "86c47eb4-a36f-4177-955a-41a1bf460b4e", "comment": "Malware payload", "value": "db8136a586b4b54c3c5783971910748c4026adba6cd3e5f4c43cdcb88f707876fee5f8a9d55c65943bcfa1d1180f6510", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781774057, "uuid": "706ff668-5ded-4455-bf05-f44f5e1a87ff", "value": "T1BD964A47FCE108EAC4A9A27189B65292BB75BC481F3227D32E60B7382F767D05C75724", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781774057, "uuid": "aab9a23c-302e-4c6e-a6e6-c98701b14e8e", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781774057, "uuid": "5ccde774-32fd-43d2-b398-5cabfba71316", "value": "24576:0+/G0fQ7v7kJCC9I4xaBflFkvp5ZbdQXwQPiqMOB7x7x7xvAoBele5I92KbNcpDK:0+/7fMv8CCeGazGBfbeRxwHdZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781774057, "uuid": "513719ca-d3b3-418b-9676-ef4d706883ee", "value": 8896896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781774057, "uuid": "bd9266ef-3216-48ba-be22-2f78ce4d14ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781774057, "uuid": "f9b15fd1-9269-43e4-a8cc-a335fe08be4a", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f380398e-6af6-11f1-a769-42010a9c0008", "comment": "Malware payload (DDoSAgent)", "timestamp": 1781774430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781774430, "uuid": "5ca52322-d646-4540-8a7f-c413125ed02a", "comment": "Malware payload (DDoSAgent)", "value": "a05a3c94ae4692315c1ee41a90cc6d08", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781774430, "uuid": "074605e3-68de-4a45-9bf1-093624d032ec", "comment": "Malware payload (DDoSAgent)", "value": "dc2cd9ce27734ec6560bde969b2af295c58da3e9f58adb8dc97b00cf3bd1ab70", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781774430, "uuid": "5d898f32-f940-44ff-8eae-216b45ef8257", "comment": "Malware payload (DDoSAgent)", "value": "79e4309178a192be3f6a517bb73a90765ade725d", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781774430, "uuid": "54bd1d4e-db70-4d55-90a9-e2a68d4e29d2", "comment": "Malware payload (DDoSAgent)", "value": "c9d388d5734f36061df1c7725d07ff5d70fcb05338c32ad8c3ce102c238217c9f5d4cd4a11c41896ef658cd3a8ea0fd5", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781774430, "uuid": "f7b9e3cf-e449-4d90-b406-b1bb444b4641", "value": "T118767C91F748A136DA4A0A3288B30B30B3915D82C1F5C96B9709F72F59B26F7594FED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781774430, "uuid": "65d4dd1d-ed6c-403e-867d-de102a3b3e21", "value": "49152:ZUzJmkNgunuU8qN72YYE+oBMa2jkyyUp5TwNiFYo8PwyESHMEwOqHHUt5Eiy:C9gEbN7OBoB/twk28PsSsEwOqnUjE/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781774430, "uuid": "5239650b-c17b-4fd5-865a-0d26a2ba0b94", "value": 7340216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781774430, "uuid": "24c3889c-5ec1-4c21-b92c-72344766f950", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781774430, "uuid": "3686784c-37f7-4459-b127-b45d8b09a64d", "value": "ppc64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "863ac65a-6af2-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1781772529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781772529, "uuid": "0036ef2f-d992-4c0d-acf7-27dfe134ef4f", "comment": "Malware payload (QuasarRAT)", "value": "4158d5d309214e1471180bb81e6a6b52", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781772529, "uuid": "afd4e49a-3726-4888-8471-5ce7ad5f21f0", "comment": "Malware payload (QuasarRAT)", "value": "dc45393f2263979d91ac737f54d14a518e0f8b7fbb62e37de390553762219ea3", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781772529, "uuid": "122182d6-209a-4196-a8ba-c1388500d9d2", "comment": "Malware payload (QuasarRAT)", "value": "46c28f933a65dfc5ddd5ae365fef19e9e943d565", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781772529, "uuid": "e658437e-2fb5-4147-b638-5d4a34b6ac2d", "comment": "Malware payload (QuasarRAT)", "value": "099399c3311e391f3917b886818ec89d1a19f4db3bc55e7d4d90a1af8b37b8678e49287f69162f074fa05503188f5330", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781772529, "uuid": "98143de6-af32-46b2-b08c-93559486d21b", "value": "T173F533408929AEFD0B6CB62D814F5F4F3EDC0EC04408B5FF16916AD316EB7860E5B969", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781772529, "uuid": "289c35a8-7bda-461e-a055-1687a036cb07", "value": "49152:aTpsb5EgCil2xuJ3m0mD+8qQUes10nlwODpSpnJOPVqBjep:a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781772529, "uuid": "feeec409-6e39-4933-9b3b-14e153ce1a91", "value": 3519756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781772529, "uuid": "2e85159f-c37b-45e5-a0e9-c780f99bdffe", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781772529, "uuid": "712fe514-ce20-4212-b1d6-3e04289a1d19", "value": "FF TCP GUILD BOT WORKING 2026.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc76b77e-6aeb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781769640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781769640, "uuid": "fb708618-69ce-4f27-b738-6e9fc8f5b4fc", "comment": "Malware payload (Mirai)", "value": "12e866d37a5f796dcc2b127f10182d9c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781769640, "uuid": "2bc735a2-6c75-4b05-bc4d-ed2ef9ae7919", "comment": "Malware payload (Mirai)", "value": "de962ea283f59362f8731e5f90fad76631920caaf0d669fab72ee1f8ff0ab9ee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781769640, "uuid": "fb54bfdd-f6e9-49a0-b6c8-fc8816f7b109", "comment": "Malware payload (Mirai)", "value": "520bcbf715e3b6f5829a75cfeb9c9e2a941acfbf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781769640, "uuid": "9e1293a5-3ac8-43b1-8e78-98b815172965", "comment": "Malware payload (Mirai)", "value": "a0e5e963554b8584257f150816cea889acd762a38fe5ecf7d9b6d77c017c8541c19c4368580bac4ead5aa8deb6009795", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781769640, "uuid": "10d7a37f-e23f-4f99-bcf0-2e4696594c61", "value": "T124B32C657B7A0A1BC5D4A47971F34232F2B2C78910BCC6173EA10E4DAFA968032577F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781769640, "uuid": "c24a1e0e-60d5-4b00-911d-1d897462895e", "value": "1536:3nWGHKN5heduof4w7ML4FeP8pCP/3yy2Ry1souQGPh5AQt+te/Kc8CNXN:dU5MuKuuQGj1XpXN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781769640, "uuid": "4f38f0db-b553-4a48-9673-291c3828ec63", "value": 110168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781769640, "uuid": "b984691c-5349-4248-b385-0c5221fffe5c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781769640, "uuid": "4c17692f-cf35-4915-b070-5bf60a3debba", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecc60141-6b1e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781791599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781791599, "uuid": "a2cfe694-8e8e-407a-8dfa-c15680ca0b9d", "comment": "Malware payload", "value": "d98a1def5426819f5a4c8256e5d19533", "object_relation": "md5", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781791599, "uuid": "b9e199f7-fc98-422b-bc1e-f64012b508fc", "comment": "Malware payload", "value": "dfef36469751fbd84b2009a869a05ea71f1b4c3f808ace18d405a15c8d17ae00", "object_relation": "sha256", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781791599, "uuid": "21e436b3-eef2-4394-bbcf-f2028f1fcb86", "comment": "Malware payload", "value": "dc2ad87102f5c8ffc82eac4db98a9e8c3c04fd8d", "object_relation": "sha1", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781791599, "uuid": "03d780de-5217-47b8-8878-9603f43565b9", "comment": "Malware payload", "value": "8725c0c17eaa80fe5f379f82d1325cb09110f890136247a0bc5ad4d8e0bf677fe1d352d4eac2088599d431da14489748", "object_relation": "sha3-384", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781791599, "uuid": "e5025ebd-7f63-4cfc-b72d-2c775608cbb7", "value": "T11803A9979509C6853BA062EB2BDBE5C73A04CC6D00E6CF86B57F8C3A731580D7268B5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781791599, "uuid": "90795798-d0f8-470f-a479-c8acb7355193", "value": "768:Htay8gX+XHA9Y/zENIrkohRw2Rx+Jgmx0hQN6SFEFjUjIxQC5/lwqC8tPCb6aduj:qrXw2Rx+Jgmx0hc5FL3Hi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781791599, "uuid": "33bf25d7-f535-4287-80e1-3cc4c72b7183", "value": 40134, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781791599, "uuid": "1e0637c9-0b65-4dca-8ac1-117bad143dcb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781791599, "uuid": "c28b4c8a-491e-483d-9089-d4661d7d05a4", "value": "ynteok4g.idw.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2398b803-6b2d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781797704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781797704, "uuid": "26cdf4b9-0078-47a7-8768-7de512502a6a", "comment": "Malware payload (Mirai)", "value": "38bc5e58be5b8686c05aa02deab7e252", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781797704, "uuid": "382976f9-2fc2-43d7-a56e-aab70cadad5d", "comment": "Malware payload (Mirai)", "value": "e13b8f85e0cef9889fb25edf9de8f947b27823c86b65ba456b1651b5e630cead", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781797704, "uuid": "0056cc0b-c39e-4fbc-8589-71dd84ce2b5a", "comment": "Malware payload (Mirai)", "value": "df0f9821d53ef89861a3414160bbdd5ee8216d57", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781797704, "uuid": "03064c0d-0931-4bc0-9122-f61655411c67", "comment": "Malware payload (Mirai)", "value": "92c451f955512c5b6675f88c2f924e2d2a26933e8b62554dca50385818350387c135cbbf1cf1a0d3e9d9114109c67853", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781797704, "uuid": "bf78adbc-9af8-46c1-bed2-60f0cc6eb3bd", "value": "T16753F131C6C37C96D05BBF721A09A56CCB82A6B39A7913D540C4036227BFE534D3839B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781797704, "uuid": "ab3fb21f-980d-44e0-bcd9-7b29f7f319a2", "value": "1536:3j63/3zONTYPdxmAw2lFgqtUi7zIPZqm+I:z63/3zOIdU2lFTUi3Yd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781797704, "uuid": "2d0b1c11-1808-4dd1-ad63-f7264ad8d620", "value": 62752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781797704, "uuid": "c5572835-0d10-4154-ac16-4240db1f3e0d", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781797704, "uuid": "cbee4fc0-f128-4b32-8622-4470219b32bc", "value": "monero.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe61ce03-6afd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781777455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781777455, "uuid": "fe53c148-b5a8-40d4-9b45-54213251fc53", "comment": "Malware payload", "value": "b4bf508eb6c826fcdcc380b556649bc9", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781777455, "uuid": "95dc2f32-7a10-4721-8c8a-0d878dc634c3", "comment": "Malware payload", "value": "e21045d833b70f985f3f01daf5fadaaef1a960db0e3a55341bb9c13fca505047", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781777455, "uuid": "dd9994ad-4e3b-4b40-8e8d-73349d6c55f8", "comment": "Malware payload", "value": "cd12ede299be1b380495610e07447f9f06849e42", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781777455, "uuid": "b0ae30aa-79af-402c-a678-10e15fc9b7fe", "comment": "Malware payload", "value": "13b606f70f5ecde456dbb0c8f53ba2e257d75751b3375773444a03b902ee44b6f4ce3ad5d2dbd2fd536ffc0c45545107", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781777455, "uuid": "c3597eaa-8417-413a-8521-ad6d94d81d3b", "value": "T10B016FC68150AA1090AEA84E73DBB190B421D3C706471F5CBEDC552DEBD9514B115F98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781777455, "uuid": "01616ab2-b67d-4512-945d-341bf65a9175", "value": "24:kXCKysE2hi0ziQvZoha7RFpSpeJjpOpD4XpN957:e9Qp+Ms7jpSpEjpOpEXpN957", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781777455, "uuid": "470ef33e-8269-4ade-8bdf-32a9e1c6450e", "value": 838, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781777455, "uuid": "e9dddc77-1ef5-47a8-8299-a947d59ee328", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781777455, "uuid": "41071391-f419-42c2-bced-417f6a1decb2", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcdc1eda-6af8-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781775197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781775197, "uuid": "df5f7692-052b-4184-8abb-1fba1a241653", "comment": "Malware payload (ConnectWise)", "value": "f77527259a699d2ee5ebbc63eb0468a3", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781775197, "uuid": "6a02b152-1393-4799-b204-19995dcb3fb9", "comment": "Malware payload (ConnectWise)", "value": "e2c41c71d7291a3a7ccdc354913d34807ca6b96a44fea0907fbc25cd1c0150f3", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781775197, "uuid": "639cf7fb-e55f-4f4a-aa66-2ee33e02646b", "comment": "Malware payload (ConnectWise)", "value": "658f2c8245ece54ba1f744d5015b670a614da5ce", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781775197, "uuid": "9914493a-787a-4cde-8d75-31aa761129ba", "comment": "Malware payload (ConnectWise)", "value": "e44c572d1d353ab15133ecbb50c9c9880c8ea9286d629ff6336dc792377d2cb1d0edcbc04fa08e35b7b4b77e6b99eb54", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781775197, "uuid": "d8e2b029-9882-46ac-97ac-d033fc64f496", "value": "T10856F101B3D695B6D1BF0638D87A46656774BC049312CBAF5394BD392E32BC08E323B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781775197, "uuid": "38574a38-8eca-44f4-8afc-bb595eee22a2", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781775197, "uuid": "9c45bcce-b6ef-4046-9e0f-c37e71e78052", "value": "98304:izIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zlyFeFCb:ihfefPtHxcp9ym3nltDUJVBo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781775197, "uuid": "5e74c22a-b6d1-432c-bc21-0163333394cc", "value": 6057936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781775197, "uuid": "5918f099-d848-41ac-b4dc-82851c4d7fa4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781775197, "uuid": "296ad983-7b31-4f43-be41-d855cf896cff", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d484648-6ae2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781765534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781765534, "uuid": "a8567433-6f7c-48f7-bf8b-e976f6535c79", "comment": "Malware payload (Mirai)", "value": "31ef498d304a64a93cf210c0efd46f75", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781765534, "uuid": "78ffe773-8234-4192-9ec7-a82507a73fec", "comment": "Malware payload (Mirai)", "value": "e332de9f304647bc937fa92ed6a009eecd66ab57d0f203c5750e9bbfca340116", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781765534, "uuid": "1243d8aa-5eac-4e91-a58d-e127e360c5bd", "comment": "Malware payload (Mirai)", "value": "387404871fa568372aa5bab36f7ced943b0097f0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781765534, "uuid": "670a540f-2062-445a-a5ac-f29251662474", "comment": "Malware payload (Mirai)", "value": "40e72f4245db2d40d170668549d583b0a9314fbadfb487f1976eb9434eeb118594440db4c1458ee9701d7409f165ae96", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781765534, "uuid": "eb3b9eb7-44f3-4c13-824a-e5d0bb6191f8", "value": "T14AC31982BB43DAB3E85315F111F7AB369A31BC3F0836D986E3647CE199217C1961636C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781765534, "uuid": "6a5afae5-55af-49d8-97dc-944952db1a69", "value": "1536:XmVJUCzIOF3DgvBjgUXUh1lDIbfPMqag3x2lIRdrDhIEk/T5rCD3vByL2Ln/WKSG:XTzWIbfPCIR5d8bAyyL/WDOIgNPCOj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781765534, "uuid": "5d551e4f-060f-42a7-803e-2900a702706d", "value": 125668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781765534, "uuid": "92c8cba2-c9dc-474c-a1bb-807f699167ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781765534, "uuid": "6e8cfb33-6615-48c9-9d38-6dccec35697c", "value": "nova.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b86ea369-6ae6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781767459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767459, "uuid": "200705a0-9685-4244-baa0-b6c7a3e6c790", "comment": "Malware payload (Mirai)", "value": "10c490a5bb5db195e052a0b0f28ae0b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767459, "uuid": "c7e52d25-783c-4c59-a427-60fa6c045c54", "comment": "Malware payload (Mirai)", "value": "e5ebbe523d1caac934b8c40e99cbed632294aa60c14ac3177af08f14a7600295", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767459, "uuid": "68b1b35a-c1c3-4dd8-b276-8a50af2f30cb", "comment": "Malware payload (Mirai)", "value": "56ad029ae2943eefc3b7a4ce8bdd4adeb30340b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767459, "uuid": "8a941e85-118a-4acf-965b-9c795f4b9c27", "comment": "Malware payload (Mirai)", "value": "6706a3697608d750f29224fe8ca395f80a87559fe39a45bcd83ed08120f6fe21483dd9599f18ee3ae3f811362c2e26f7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767459, "uuid": "1a554a24-63aa-4c5f-8dd2-172a8fe03c19", "value": "T195B3195ABD819B12C5C5567AFF0E538D33131BBCD3DE72139A246B24278B96B0E3B406", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767459, "uuid": "4a779582-80ba-4862-b668-aeac4ccdd9dd", "value": "3072:9h0oPjV1zB2mAuTsVkK7vz4cOp9PpzXaQIwljMAPV:9h0obV1tIuYkK7vz4cO/PpTahwlNV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781767459, "uuid": "1c4e87cf-0ad7-4989-b8fa-225bc6440008", "value": 111864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781767459, "uuid": "3f955dcd-1332-4b09-89af-66c80178c77d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767459, "uuid": "f91903e6-a09d-4862-99db-ca2841ba8aab", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06b04883-6b1d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781790783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781790783, "uuid": "e4053c0e-1efa-4683-9262-66a3695e3596", "comment": "Malware payload", "value": "bf4fceeaf98e0ce165d45f5ed3ebb8bb", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781790783, "uuid": "5da0928b-2600-493e-abd2-0d86cdfe1686", "comment": "Malware payload", "value": "e6b67da17002e90684e61100f3e81eb770d24a6bd8142d17c8de7f9a0f16ec83", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781790783, "uuid": "517eb0f9-a7ed-4632-89b5-ef5d11c43003", "comment": "Malware payload", "value": "779ae6df40aa5475196212fe026b9c82a0faa14a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781790783, "uuid": "1b49d519-a2e2-459f-92bd-0b2328e84fdc", "comment": "Malware payload", "value": "97cf9bb568a5e06e02b42534e5938bbb15de7b83c99b3770410a8bcb061037b9f9a0c17e7083879554ae51a6ec578351", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781790783, "uuid": "678b1cea-40dd-4892-b3d9-40c05ef4d284", "value": "T17F21D3E4FCF1D532F08C9E28B01851D458D72DAF62A83DA8E4867C22949DA48B19F739", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781790783, "uuid": "7670cc79-b366-426a-9cef-8154d581ae53", "value": "12:U+0rQmQt8KKlwfYfEZ2fE5F6k7fEMfZfE6JfELORfELOZi+ifEL4vfELYKdgfEWF:UVQmQt8Kz0DWrjXXGLDxbEe7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781790783, "uuid": "2df1cf24-c3d5-4202-aa31-657c9083b29c", "value": 1268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781790783, "uuid": "22b814fa-8193-4892-aa18-5c54d1579719", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781790783, "uuid": "2dc8830b-2508-4648-a5e5-3fc5f84efe73", "value": "telnet.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8849608f-6b13-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781786706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781786706, "uuid": "7f1ee4cc-1def-4599-99d9-1550f005f52f", "comment": "Malware payload", "value": "b4996e7febf052ed7ca780efa5adfc49", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781786706, "uuid": "adab2217-9b21-442a-b8e2-310434bca802", "comment": "Malware payload", "value": "e88055f104f600e8b088c91ef9404662a9e8e6f27a5a8de813d95c078d951d11", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781786706, "uuid": "779f1ce1-9c29-4c1b-962c-12fe581c31bb", "comment": "Malware payload", "value": "4e1845393e46e4ebf8d57d26685f7f3180835629", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781786706, "uuid": "cb0be996-3f00-4c61-bfbd-a407c80639ea", "comment": "Malware payload", "value": "df7d425c365bc991a297633e1300a506dd4f445e613e98f5d6c2ca21c2224d0a9fe30d6b55288f8718578f7a80aa27f5", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781786706, "uuid": "489720d2-9720-4963-bf3c-7aa1a48117c0", "value": "T1D53153A292B8F428CD177032916D7F0B8987F1ADB9E0BA57E9C831DD156FC802DD3420", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781786706, "uuid": "23c27393-e1ec-497e-ad25-f8c1326ce15f", "value": "24:9jnmxuT9bY/GQ/ZJx9flG0IRzQWszAe///EYrp659tPDL9cqqmnt:9jmxujCZJXfQ029y//Eup65Rcq1nt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781786706, "uuid": "1288f8bc-397d-417e-b902-a35a52318dd3", "value": 1558, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781786706, "uuid": "b4cbdb19-c295-48a6-9efb-74fdffebb79d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781786706, "uuid": "039dc31e-81c1-4a2c-b63c-21af99fd64a8", "value": "mix2.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d569815b-6afd-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1781777386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781777386, "uuid": "ed31d21b-09c7-4440-a2bc-6be7ecf1af57", "comment": "Malware payload (CoinMiner)", "value": "fa6f824d2112c38a4e00704e2b5bcf82", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781777386, "uuid": "ba8e5197-13ed-4b3d-9612-a87783d8097a", "comment": "Malware payload (CoinMiner)", "value": "e9f7f20f31b527e841944772341dd615e0dca338371e842e10f74a9325c17962", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781777386, "uuid": "0fbd35cb-1bba-4102-98b2-e6ba71442c8e", "comment": "Malware payload (CoinMiner)", "value": "1f9c742400bcac32b7668433087b6f4ce4ab2e41", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781777386, "uuid": "e2b84939-dba4-4105-874b-76aa7dc3b91e", "comment": "Malware payload (CoinMiner)", "value": "24e35fcf968923f5d8748c5eac25efb3fb661f1094b8050d010d9994f0a1eb9839aed0c912c8ec63164bce75aca38b70", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781777386, "uuid": "22b49077-9af0-40a3-973b-94e024c04aca", "value": "T12122192F7E450231E3A049B81176964F553D4673A787B3EBF373D5990BDA2448440EAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781777386, "uuid": "7fefb528-60a2-4d81-bca1-a9256d1f1653", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781777386, "uuid": "2d501800-f47b-4afc-ab37-bf0a31a9cef6", "value": "192:hK5oJEWwKB6x+eWlgTPFJxTEZmFhSorcw32:I5oJ4ZwdyTPFwZK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781777386, "uuid": "930f64f5-4539-4c3b-9848-8bf0265ff8c4", "value": 10752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781777386, "uuid": "43380a93-34ac-4e83-8f95-a3539ca6714f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781777386, "uuid": "f90adb73-c4cb-4d3d-9dfa-7f77a6f32641", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43af4eaa-6b34-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781800764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781800764, "uuid": "ed55fbf8-e993-4eb2-ae96-765a868f2c7c", "comment": "Malware payload (Mirai)", "value": "ec3c3180f247a290fcf822bf069a5927", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781800764, "uuid": "0a59a697-5380-4b1c-81ab-d63964257492", "comment": "Malware payload (Mirai)", "value": "ea0f79291182312820992572946a933dc6dd586d67215607d8692bf04dda35a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781800764, "uuid": "08735989-9222-4b4d-9efe-a7b2236f1ab8", "comment": "Malware payload (Mirai)", "value": "3f239c31f658ea4c62cac3eb1271d36607c32f63", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781800764, "uuid": "38505d31-3ca5-474e-bc91-438de6863422", "comment": "Malware payload (Mirai)", "value": "f728fbbe0fc0292a8256315030eaa3f525fcb3eb07a8c2a7003aa3daa40818594da4741cf191afe4d65f542b80bba6b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781800764, "uuid": "efb88eb0-9d1c-46cc-8e0b-05603c61bbe6", "value": "T1619329227E760F27C4C2A8F652F30B30B5B2AB5B28B8854A7D715DC96F246C032577B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781800764, "uuid": "8076d58b-47f6-4720-bac8-56054e809b68", "value": "1536:5S8MSzlPyzhCJuWsZIJfQlSYJRDRtDogENWq52YMAdhctOr:5S0A2jWSodpxENlymr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781800764, "uuid": "d23fdb46-b103-4d48-845e-8934819ce200", "value": 95540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781800764, "uuid": "f41b8188-6e82-4f3b-983b-439cbda558c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781800764, "uuid": "d22fb134-ae57-40ce-8654-c8ce2061a739", "value": "manji.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "244f3ce6-6af9-11f1-a769-42010a9c0008", "comment": "Malware payload (SilentNet)", "timestamp": 1781775371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781775371, "uuid": "5f2afc41-0845-462b-a85d-4e6b3ef6159b", "comment": "Malware payload (SilentNet)", "value": "9c57bb894be8db543ca38d0b7511d378", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781775371, "uuid": "3ad6316e-4fa1-482d-ab97-a4a4aab18d48", "comment": "Malware payload (SilentNet)", "value": "eae1636aaa0d0db168ede7a32fed23e64b0eb17a29d9e326b1d1315d1acc7fee", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781775371, "uuid": "1ff3b2e6-c67f-43d0-a6bc-dd0da7eeda4e", "comment": "Malware payload (SilentNet)", "value": "e4fddcf28f50251ee77dcaab933dc0e4342ec1b6", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781775371, "uuid": "d6c41da9-28df-473d-9f29-f0356bec534a", "comment": "Malware payload (SilentNet)", "value": "9f8fe7038f7a18686b7035256d3aa9c8394e3b26ed41b9b26dd293db7d21fb74bc088785f5a15decd288e4854572762d", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781775371, "uuid": "fc4a1da2-2e37-4c64-a1d8-a74da0a6d60a", "value": "T1FA5423B298C1AD7AEF1379BAAF87F56F935223A5C356500304F80FD2ED90B55D092CA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781775371, "uuid": "352544d4-cedc-4eab-99c2-0329b9088d1d", "value": "6144:CKOJAMEFiiFUt4Q1+VG8ubsRlsiO6Z/9lC4O+xLCAmm:JiiWnoMgRiYCB+xqm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781775371, "uuid": "562c01a1-9a5a-42bc-a0aa-83f385df69af", "value": 282977, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781775371, "uuid": "7a007a72-d96e-4d70-aa70-21767d2a2682", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781775371, "uuid": "6f9c7681-f0da-4225-aaec-48936e78701c", "value": "dupemod.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65b1ddf2-6afa-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1781775910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781775910, "uuid": "1570f36e-51a3-4f44-97a7-00392070dfa7", "comment": "Malware payload (RemusStealer)", "value": "4da79465a5ace2138f70933033aa5bd9", "object_relation": "md5", "Tag": [ { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781775910, "uuid": "5dacfe5e-39bd-4215-9844-15c11c29b573", "comment": "Malware payload (RemusStealer)", "value": "ed3a90d8c8872b2eef99c9b76d941ebef4f47a36bb15f2f8b08bcaa3a432c43d", "object_relation": "sha256", "Tag": [ { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781775910, "uuid": "4405c07a-2917-4274-b1af-6bb32858702d", "comment": "Malware payload (RemusStealer)", "value": "8046ca816abf80200395af7a3c482b4ca44ad7b5", "object_relation": "sha1", "Tag": [ { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781775910, "uuid": "b1aec06a-d393-433c-a609-fed3db89c693", "comment": "Malware payload (RemusStealer)", "value": "f86be9e5306cd1478cb41308ae221e585a64ec229358f8319c5460be857c159f24235f5afa6cfcece759e135b17c57f2", "object_relation": "sha3-384", "Tag": [ { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781775910, "uuid": "f9cc43b1-5659-4236-9713-46875f54f285", "value": "T104C53A07FCA108EAC0A9623189B69696BB75BC491F3227D32E90B3392F77BD05C35754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781775910, "uuid": "fb4acda0-eb2e-49dc-89c6-95b696c4f50d", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781775910, "uuid": "8f50ebe8-22c1-47b3-bd62-218bf90cf9e8", "value": "24576:k8tDet3tKqODG8q83ZpUprg1Ywp/RGRlGrDuIzPmtrFrvAoBele5I92KbNcrDGud:k8tyJtcDG1oZi0eqRMYTDfHGd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781775910, "uuid": "ced3fe52-9d3c-478a-b14d-a39d820a5de2", "value": 2510192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781775910, "uuid": "873fdb67-df18-4f55-b77e-bce9b80db353", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781775910, "uuid": "a58a6a92-5883-489a-bd4e-fbde8cd558ab", "value": "crz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deb962e5-6ae6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781767523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767523, "uuid": "231baad4-9c9c-4649-8fb8-73ac6981b9bb", "comment": "Malware payload (Mirai)", "value": "f171e01da0aae0a6ba59a9eca92eef19", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767523, "uuid": "79638569-fc70-4be8-8d78-0ee0254d882f", "comment": "Malware payload (Mirai)", "value": "eecf634a7fa817d6842a1ea6bd7cd3a9dbc8fa74e23eb605fe67c3caade27ec8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767523, "uuid": "9701ba9f-d57d-4c82-8133-82bde2b8ba15", "comment": "Malware payload (Mirai)", "value": "b179e8a39cdc510158d7b1986797ac0d66039356", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781767523, "uuid": "4fe328ee-090f-42f1-aaa3-2606c85131e1", "comment": "Malware payload (Mirai)", "value": "fb53c9ab98ab66e17942c88bbd8eed997a1633e1c5a790db6e6138e6422cd11375ada368a20d1f1d7838700f56ab2026", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767523, "uuid": "8f260912-0d61-4cf8-bb20-f57dcd5ebc3b", "value": "T193831846BC918F11C9D422BAFA2E118E331263B8E2DF72139D105F6477CA92F0E7B955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767523, "uuid": "78c07390-cd8a-4739-b996-b0681a2ba029", "value": "1536:ENnoSfU+GtyjJAjTqb4b5IOfNweCJ3bY+rayN4XcZIjiL5aybZ4f4m:oUncJ2GbQJfNCLXraO5aybZ4f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781767523, "uuid": "ab92020e-9fd4-4bd1-af0e-e60186504e08", "value": 83248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781767523, "uuid": "a6602284-380e-48b6-be5b-6246bb71777e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781767523, "uuid": "61cb04c4-0280-4709-af78-9ab12865439d", "value": "h0r0zx00x.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33efb5a5-6b20-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1781792147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781792147, "uuid": "da1a682d-7db6-4300-8e5b-28ea05aec9dc", "comment": "Malware payload (WannaCry)", "value": "ba5cfe07a33b3a75955756fe7fc10b96", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781792147, "uuid": "71bdacf2-c905-48e4-9dcb-664fa9b4a6d3", "comment": "Malware payload (WannaCry)", "value": "f35b27b5ef86f0d4ade3752224fe55641ad7c59976dc085cc5109a4008b7ec1b", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781792147, "uuid": "82a49ae5-f2e7-4b53-bc57-a1b02d28726e", "comment": "Malware payload (WannaCry)", "value": "4a866e41b9459a77e0217f9eca877650d553ed9f", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781792147, "uuid": "767c8f51-80a6-45c0-a3cf-d4f23d583ee0", "comment": "Malware payload (WannaCry)", "value": "94bae8f6dee9f8235b8df7042c13bfe3fed83913a0d64a4385d1a87f30d37caeaa6fefb4cb8d41940eac38885a7e5bc7", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781792147, "uuid": "d0306613-751e-46d1-9455-9d2b55243584", "value": "T134363394726C91BCF0450AB444B38D2AF7B37C5567BE5B0F878086AB0E43B9BAF90751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781792147, "uuid": "4e39c14c-9463-4b93-b3bf-3a67d4291595", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781792147, "uuid": "f0f72b83-4848-40b0-a80b-f57ed238ae57", "value": "98304:DXDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2:DXDqPe1Cxcxk3ZAEUadzR8yc4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781792147, "uuid": "4b2bf238-c681-4d01-bb7e-3e4d09ab6450", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781792147, "uuid": "9dcb06e4-5a25-4071-8a18-8d8265414774", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781792147, "uuid": "db1432f9-b4c4-4849-9326-e5349dce18d8", "value": "f35b27b5ef86f0d4ade3752224fe55641ad7c59976dc085cc5109a4008b7ec1b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32a99241-6b26-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781794722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781794722, "uuid": "2b0c9052-5522-4b9d-9b2a-52209d593132", "comment": "Malware payload (Mirai)", "value": "7339a218b9002c83f481265d201d985e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781794722, "uuid": "194df7d9-cd91-49aa-8985-e111d589809f", "comment": "Malware payload (Mirai)", "value": "f4969ace85c931b4fbeec7d6a39ca94f4d1c4b788c5c20cc0c4fcc117990244c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781794722, "uuid": "9e83dd4d-76c7-44a2-81d0-edead510843b", "comment": "Malware payload (Mirai)", "value": "2afadc16589a18ef43eaaa8aa6e24e75416fd1a4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781794722, "uuid": "16fdbda3-7a92-4cc8-8d06-4358e301e0b8", "comment": "Malware payload (Mirai)", "value": "92f2de722c653f5352ece81e1c344a30ae1f6b9d15b12821731f6f3d28ad2013bb54edebc042ffe40d7abbed1326ec25", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781794722, "uuid": "18caf71a-8beb-43ed-be04-86059e0e826c", "value": "T137A31215DDF31589C730A230DA5DCAC4B42D3E49E93A3B63252AA985FF7508573F7A02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781794722, "uuid": "71c85832-6bec-45fd-b392-0a9f6b330fdc", "value": "1536:+cX/jAZR/L+0lxqZuJfonSJcDY93XDLUENACXevYzwN9qUXkqW:TXsvDpnDpDLECXe9NAKkqW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781794722, "uuid": "3c65d98a-0376-4640-ae1a-5b64b5c9d9da", "value": 104652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781794722, "uuid": "73d76b3f-0710-4a0d-ba6e-acb5ad4d042e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781794722, "uuid": "c86bd1c0-87e7-4e4c-ade0-65e052aa8f61", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7171577c-6ae8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781768199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768199, "uuid": "cf2f4e56-391e-4c8d-b6dd-122bc8729df2", "comment": "Malware payload (Mirai)", "value": "cca9b97fa8adcf428f0f7f14ee369bbb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768199, "uuid": "c49f89d9-082c-4cff-92da-109921553110", "comment": "Malware payload (Mirai)", "value": "f5aa2238923becb1a58dbb28219c4c3dc27b088980db41df6b65fa30770fbfd2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768199, "uuid": "d392e942-c73f-49be-8637-b61aa060e4bf", "comment": "Malware payload (Mirai)", "value": "0014be5569ef4376bcc769239008fde0407099cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781768199, "uuid": "45690eab-9cdb-4189-87bd-13e36bc07f18", "comment": "Malware payload (Mirai)", "value": "3c5c7244faac9310055e9ad0ef6e84e3b131ad35b5ff49729de736f260f1678b1326a48ee1eaac05ccf9d67b54330374", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781768199, "uuid": "9e3c199a-6e93-4b83-ac70-14755ae9583a", "value": "T107044C97EE091FA9E5AECF74845B50AF456E05E637A2C023E35C1D35329F38B079488E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781768199, "uuid": "20635173-5e33-4c68-a294-d2c8a9377ea2", "value": "3072:172OpTTPQ6ocBCJxDF5jL/9SP9LhY3/Am:/u8P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781768199, "uuid": "09c8d3e8-16e0-48b8-866b-64a40adae352", "value": 181384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781768199, "uuid": "0f00e144-391c-484d-84bb-745779a41b05", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781768199, "uuid": "f0b448e4-e64e-4e15-9edb-f442df31c55a", "value": "kaizen.mips64_srv", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43312f26-6b33-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781800333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781800333, "uuid": "ff3903ba-d3c9-4355-9e9a-eaf5717b3e22", "comment": "Malware payload (Mirai)", "value": "158cab24767322931951c92c02e7d6fc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781800333, "uuid": "ca14ff1f-bcc5-4731-882b-8a1f7ee6985a", "comment": "Malware payload (Mirai)", "value": "f6026d4fbddd367b62b7e33fc534a136f22365df340c63106eae135a640b7568", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781800333, "uuid": "a3f37504-5dd3-4c30-b073-b3bcc9747a5e", "comment": "Malware payload (Mirai)", "value": "0d981547455287beb63b7741a533aa8b98445848", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781800333, "uuid": "25faced0-a7d1-44b0-b0b1-6c2d17327209", "comment": "Malware payload (Mirai)", "value": "342899d7d68b7a957deeced7636cff8d1b9fb7caac88eb40946f5f5faaae6b0dca8a5a96b1459ce59e4e548fb38a292e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781800333, "uuid": "ca72d847-7c5d-46aa-8f7b-c746f22e2d38", "value": "T1BB930C46B9528E12C5C212BEFAAF415D33136F78D3EE7212DD20AFA063865DB0D77612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781800333, "uuid": "5cf21592-f60a-473f-87a4-39b345546d23", "value": "1536:gknJxjhCMsBMl3EVGpOFnbRfGqtCMrI53yHesYIsOvVaxyXM8aBQ2iS4Rfe5lzcA:TtC5MqVGpOFn1fGqtCF5CHeseOvVaxrh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781800333, "uuid": "cf71b51b-101f-4fe9-8f2e-e6409d91788a", "value": 96864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781800333, "uuid": "97e5a02c-c4b9-4c63-b6ef-08c25e9cb107", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781800333, "uuid": "cb012660-2a3c-4e45-b141-f4e2f4135b21", "value": "manji.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94cb0464-6b53-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781814214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781814214, "uuid": "0f4d4bf6-8342-43ac-9c06-af643282f491", "comment": "Malware payload (Mirai)", "value": "30abfb744554032f79c814ac6ea7cbf5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781814214, "uuid": "9c66ffbc-c4c7-4c3b-bab0-6706e14eb5c1", "comment": "Malware payload (Mirai)", "value": "f65c799cfe04e9a1cee6057a320a207499ebd2287c2145720570ea50b46e063f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781814214, "uuid": "111d6e7d-e621-47af-bb97-3906d5af9504", "comment": "Malware payload (Mirai)", "value": "ce5230359bae5e2b17cf6ef23b7a296d5cf4318a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781814214, "uuid": "9868f537-a0d0-4a4e-85ec-1875e5be8521", "comment": "Malware payload (Mirai)", "value": "49dd9f12c1fe2673d4c533a88027523058284430a0137b8c8ae483ef78fd9b574e6aeeca0105b66e974e40a7879dd904", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781814214, "uuid": "ff947186-08f7-44a5-b764-ed229b490fb7", "value": "T18E244B06731C0947D1632DF02A3F27E1D3EFAAA124F4B645755FAB8A9272D321485ECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781814214, "uuid": "97882225-8a9d-4cb0-8769-4eb169dde7b6", "value": "3072:fY34zzEo6tnLYyoHbPlWrn35OTNiQmjxd/lrANvW3WnKbN:AlaeORbmjxd/lrApWmmN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781814214, "uuid": "3efdd1df-3303-45d7-aac6-bf29426dcde0", "value": 213584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781814214, "uuid": "35ef8f7e-e4bc-4d55-849f-025b654ea1c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781814214, "uuid": "3c320f16-9b55-4c13-bb96-cf93abc470a8", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28b6d1cf-6b13-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781786545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781786545, "uuid": "aef2c15b-85ae-44ce-9a3e-63f78da65dd8", "comment": "Malware payload", "value": "2c8f3d6941fde3e296315292b4c9366b", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781786545, "uuid": "04c0ee4a-db36-4e87-b04e-ce2cca7c498e", "comment": "Malware payload", "value": "f703cc7a7fd6fade50913e5959a9232c91c5a20509e5683a5b9d7d43869a7ee0", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781786545, "uuid": "f036a45a-91a5-4388-93ea-0ee77610302f", "comment": "Malware payload", "value": "225ba271bc88e41a3d9f60a71bec4b937d62b9af", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781786545, "uuid": "f29d23d5-2d55-4a7f-b9a5-c232aeffa69a", "comment": "Malware payload", "value": "19b3f341be4667359b106b8463ff966e9977fcf25fed34b183f2231e28d64b8ebafcad52383e895c08da555bf1f9ddcf", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781786545, "uuid": "aafcebcc-8164-47cf-840a-cd70cbe3a93e", "value": "T167519B107EFA5335F3B69EB998B9531098777896EE318B4D00A2068D1423E41AD62F6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781786545, "uuid": "18b65d36-e485-4ec8-8af0-3f24c032d0d7", "value": "48:8NxowFMWoOu3MzfjoSH94VzYoRCrmcd2qdUkZm:8NxJFMb3MzrdAzjCrjds", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781786545, "uuid": "d037e1fc-fc79-4b10-b810-0b83703f263b", "value": 2948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781786545, "uuid": "5cd33cab-b3e7-4068-b9a4-3b69e5a4bca8", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781786545, "uuid": "5843e46e-4736-467e-829d-96b11cec6933", "value": "NoxWealth_CRM_API_Documentation.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4054a4e3-6ae2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781765539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781765539, "uuid": "3f93bd91-40f0-430d-a2b4-2011482533a1", "comment": "Malware payload (Mirai)", "value": "4855c91a00cf0c30d1e2b37d5d647310", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781765539, "uuid": "2979d0c6-93c8-4194-9fc5-2910bdb344de", "comment": "Malware payload (Mirai)", "value": "f754f24e46368f328c9f7263bb09106c9aab5de06000b26e313b64a6f1087d2a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781765539, "uuid": "6c92ec4b-40a7-4669-b4bd-f59e1b3be436", "comment": "Malware payload (Mirai)", "value": "ead8d14919668dd172974b8d428f1eed718fb626", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781765539, "uuid": "8d7f110f-e607-4fed-a616-34a5143822ba", "comment": "Malware payload (Mirai)", "value": "673dcd194a15b41e3fddeb4496de08289c9f2c78c1c471d3416f559faa2d5c7be4489d0797fe8b95d553844f0891a77f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781765539, "uuid": "6eb43d50-f1f9-4f18-8b58-8e9e2f1b88dc", "value": "T145F31B06F9819F12D1D211B9FF5E414D37136F78D3EE32129D24AFB0678A8EB0A3A615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781765539, "uuid": "d71e417b-5a67-460d-9c11-1136753750dd", "value": "3072:LfFRCnft3AErUc0iY7XhIcaJH8wlOFHuMKIRtDCZYprAAzUQ1Zr:L9RCnftjrnY7X6caJHrlOFOMKLZMAAQ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781765539, "uuid": "354b7506-3e3c-4a27-9217-e41efeb0d47b", "value": 167108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781765539, "uuid": "f1b1bb16-7f86-45b8-b6b7-4a6c13cc6287", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781765539, "uuid": "7fa57cb4-4939-421a-8a83-b84f43fe6d32", "value": "nova.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4261c322-6b08-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1781781864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781781864, "uuid": "4c9da2db-1df1-4547-9fd5-09bb866b8109", "comment": "Malware payload (Vidar)", "value": "dd11176d696af9c570441d749984ec8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781781864, "uuid": "cccead1f-9c24-4361-9686-11b8c5077854", "comment": "Malware payload (Vidar)", "value": "fa235e07fffc31425cb2d77f6efd414e5dd239ee2ffef87ed9696892182167a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781781864, "uuid": "da4ae2db-dd94-4054-b908-4bf570647f74", "comment": "Malware payload (Vidar)", "value": "6b6fc8cb37a83bfdca6155b8e6f4aeefe5122778", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781781864, "uuid": "35e9ae2b-d070-40b8-b197-f1554a489e8a", "comment": "Malware payload (Vidar)", "value": "e39275c052b2691150f55674971d85ac68b1ab8ee6468d47c55d2f857fa84b77590b247b961dcd759c2ca6c00999c960", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781781864, "uuid": "fa896137-a4bc-4861-9200-492ba1025461", "value": "T1A1067C0BAC9149B6C195A3324DBBA5427B7DBC061B3373C72E50B67A2EB77E05939700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781781864, "uuid": "329e4151-8e59-4034-90b4-c6b8fa28a498", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781781864, "uuid": "9182684e-2575-4392-b2d9-4ee6cffb6ca2", "value": "49152:qIyeEtHM5oW7mfmNsVNZZslMvhm5Q6Z+JBAYDQq28sCOkS1cE/O1n4t:qa6haLc7PpsRkS1cE84t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781781864, "uuid": "5e142c31-4746-474b-948e-81a2328fe68e", "value": 3868144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781781864, "uuid": "542df5aa-d098-4fc2-a293-766e48076947", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781781864, "uuid": "5f63da6f-4f74-4f5a-a9f1-efc6fa93d51c", "value": "mpclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc15a23f-6af9-11f1-a769-42010a9c0008", "comment": "Malware payload (GhostPulse)", "timestamp": 1781775626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781775626, "uuid": "1a8c8af6-a56a-4531-96f9-0e1ce51b4a88", "comment": "Malware payload (GhostPulse)", "value": "1547ece531048c43158517daec04a0f8", "object_relation": "md5", "Tag": [ { "name": "GhostPulse", "colour": "#5689DD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781775626, "uuid": "736077ae-c6da-476c-becb-7e47fc9197da", "comment": "Malware payload (GhostPulse)", "value": "faafc408fb5b3f6907b1033f89bc6b8569d602c7e80532801e99af4dca1110f6", "object_relation": "sha256", "Tag": [ { "name": "GhostPulse", "colour": "#5689DD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781775626, "uuid": "40926179-f360-47bb-8cf4-0efa08bb4241", "comment": "Malware payload (GhostPulse)", "value": "ff6d03be9c128d8739ddde6ac744e37fbfef6a04", "object_relation": "sha1", "Tag": [ { "name": "GhostPulse", "colour": "#5689DD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781775626, "uuid": "1f7aaae2-f64f-4af7-8b97-1045d304a7e0", "comment": "Malware payload (GhostPulse)", "value": "f6dc615258a3e01d5dca7ec119428579b1eaeafb0056820f517bad5656e4291da0dda7410b52184a2cb332803f58b81f", "object_relation": "sha3-384", "Tag": [ { "name": "GhostPulse", "colour": "#5689DD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781775626, "uuid": "29cd874a-298a-407e-ad94-ed3fc99a2c84", "value": "T140A6331273A011FBE511C6F1AF5DEF225633F34012142B17AAE9EE167E2782B460B6DD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781775626, "uuid": "84dd6714-7f89-4017-a47d-25b55f13cd80", "value": "b5a014d7eeb4c2042897567e1288a095", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781775626, "uuid": "9fb3baa7-6d8c-45d2-a6c3-e0aff5bb4af5", "value": "196608:+p1lOqylhm+91VFNRS4Zrw5DEGGS2FRybV7aB/zw01FoiXYg0D:+pGlYAV3RSc4DESWB7oBgQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781775626, "uuid": "9a22f1e5-204f-41ce-9df2-486faf850744", "value": 10380926, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781775626, "uuid": "0d20ee79-1fd7-4f18-9b6a-f2be8c14a3a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781775626, "uuid": "eb71044b-dc46-431b-a384-a7fe8da0ebea", "value": "kythy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eef53805-6b0e-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1781784730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781784730, "uuid": "bb2aa282-449c-4801-b9c1-e57663bc593c", "comment": "Malware payload (Formbook)", "value": "03564de0414ad6a7dbfc295cb877907b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781784730, "uuid": "0ec8035d-5997-425f-bf73-4c53a9424fa6", "comment": "Malware payload (Formbook)", "value": "fac3bf7ac5e4fd0a0840486d42180a84350c8fa3799e1f7568d0326e9827cac9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781784730, "uuid": "3681b2d2-dd19-4912-9aff-6c3b49db72a6", "comment": "Malware payload (Formbook)", "value": "7390f5d438d867c98ae908d2ddeb18f70817fed6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781784730, "uuid": "6c4142f1-c730-48c0-ade9-17571be6e374", "comment": "Malware payload (Formbook)", "value": "25ec110a3ba9637be6785591bb364492d226e7e21f5d82527aa77ce193188f961507598b33213cea6eb6cf0b9593aa91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781784730, "uuid": "c1ee1921-ee40-40d6-a9cd-edcae744fa78", "value": "T178A58FC2C5060A13BBD3049DB590FF914DF3993AB9432DE7ABA7868141470E84FF9B66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781784730, "uuid": "936e6843-1445-474e-828f-d5fdc626bae5", "value": "384:bbFnyZ5nQCxTIrtnzivGvbV+4PGRH120wteU/Qrn74Ow9IehKlToUQ1w/HTF74k0:u2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781784730, "uuid": "95609f7c-886e-454f-bc84-96c8943857d7", "value": 2146883, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781784730, "uuid": "9f5d3a1c-6373-483f-b694-944899e82e63", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781784730, "uuid": "7b940b41-d1dc-4c8e-a321-790630bc82b8", "value": "Proforma Invoice 5628-1.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b27c3dd0-6b31-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781799661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781799661, "uuid": "b25d5c90-40d5-4c9b-8701-b738e6151a28", "comment": "Malware payload (Mirai)", "value": "671a3e30aa1e2a93f8c6a373d344f796", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781799661, "uuid": "5d0956af-944a-444b-a479-0c2804250cac", "comment": "Malware payload (Mirai)", "value": "fb06030e6a0369b0a1af677d23d9f9a3b34606c42648098956eecbae38bc0784", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781799661, "uuid": "89fe5ff5-5ec7-4b4a-81c5-830a0a7a44a9", "comment": "Malware payload (Mirai)", "value": "c9b4b0a2c6da5ec9ca83e9c9798967aaa6b656ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781799661, "uuid": "2fd3528a-993e-4583-8b6f-9df1cd061f32", "comment": "Malware payload (Mirai)", "value": "850f76e9d744ea40ef5b193a867c21976f591cc782cf0fe4e5bdf934e842882d53d565a93d477f251935360749c11238", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781799661, "uuid": "3ed6819d-6ce5-46cc-b4bf-6ad662b54437", "value": "T194C32C45FC404B23CAD612BBFB5E428D772A17A9D3EE720399256F25378785B0E37602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781799661, "uuid": "25b39788-5b32-4ed2-b59a-b30adafe59ed", "value": "1536:paPOsPG51alMEu9DOJXWnA8q44VX1uTJmnN3Fs6VAOnFI9ffxWdIFczlHrwywyYY:QPOdhrVOFWnd4nuFSN3FhnAZWGFfWPt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781799661, "uuid": "037fbc5f-ec68-4b7d-895c-2d776b6fcc76", "value": 129824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781799661, "uuid": "143c0178-327c-42a2-be24-e6651b9a2c7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781799661, "uuid": "81c1aaca-ca1a-4074-a268-dda1929bf19f", "value": "main_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cac8bc7-6af7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781774472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781774472, "uuid": "5256306a-57e4-484a-a410-e4425b84725c", "comment": "Malware payload (Mirai)", "value": "3ef9a5e1cf2fe5f05e264dd12d998777", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781774472, "uuid": "60a2df55-e993-4eb1-af52-9322552409a7", "comment": "Malware payload (Mirai)", "value": "fb7e412e39e8922635fe5fce837ec6932862c6e93d61cbb8d21eec0c54f7b56d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781774472, "uuid": "95f568b6-cf75-412c-9110-a34ba616c463", "comment": "Malware payload (Mirai)", "value": "730d444d30d96d2452f5cf48d45d31b98d33ac44", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781774472, "uuid": "5d95c39a-97b1-4392-b5b3-18e5551de2eb", "comment": "Malware payload (Mirai)", "value": "60d2065b90b4879efe86d10e83a31c434c145ce036afebaf2133fe91e0d5f9cf13385636bf58420f84d4c994927bc47b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781774472, "uuid": "dba95b15-095d-4d16-b55d-667a62406ac9", "value": "T19D8302F4360D472DDDE0D0B95EB7CB109AB84721AC9DE88AD88BD39A46DB031F4C25E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781774472, "uuid": "23fe4b36-8295-4cf2-acdc-96918cb51cbe", "value": "1536:oeCZpme54DiDqmxDwnjnI0/mjvBBDHIH86/U+5OqEl5PRUKWb78ZWgVJuJ:dxGDB9wnbIuAB1IccX5DErRU3EUgVQJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781774472, "uuid": "830f2260-97bb-48af-9bac-05d2618c2655", "value": 87784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781774472, "uuid": "1995b059-482d-4158-b486-6f75ddffbfc9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781774472, "uuid": "8d60fa12-a065-44de-a938-d26affd6a28e", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa6138fa-6adb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781762711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781762711, "uuid": "4dad367d-7239-4514-9a30-8ce365b856e7", "comment": "Malware payload", "value": "c80dac4694ac29f9029f56b5b2ae8d2d", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "purmed-ro", "colour": "#29855E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781762711, "uuid": "91b99dc2-aa46-49b1-be33-2279c250ee99", "comment": "Malware payload", "value": "fb9de7c6a2bd7e964f2a2caa0f0d06556ba3283b550841a2f02528643fc5a1c9", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "purmed-ro", "colour": "#29855E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781762711, "uuid": "5d5b3757-e90e-467d-b6ef-e589e44f5af1", "comment": "Malware payload", "value": "6a4c1ad774338781d5fe8bff9267d3e19aa8ab2d", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "purmed-ro", "colour": "#29855E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781762711, "uuid": "571629d0-de06-4b48-aca6-32c61b2c9d52", "comment": "Malware payload", "value": "ff70cd7750f7bc0739b2a45c225353c83b31960d08380908d93719056e0a84f07a6d1c6f729ae767da5b0eabd61e5679", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "purmed-ro", "colour": "#29855E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781762711, "uuid": "f2b5cc17-92dd-4c33-b33d-5f5649ff91ac", "value": "T1945163B1830E1FBED5CD0884D3823247D0FA3C4876D29D467B35A9521D6F2E456E08D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781762711, "uuid": "46fc02b0-265f-463b-b7c9-f4c0d3c03fb9", "value": "48:0oTy7ytT7WZuWLxUM2WeYkE54ihLcn0SRRB8kURosLN/YNg3Ul:0O7fWJ7pN5x2/qkU2hN8Ul", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781762711, "uuid": "db2d3d79-356a-4041-8d6e-55c06ae7dee2", "value": 2714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781762711, "uuid": "bcad7892-1e7b-4ea4-8408-65301432fb02", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781762711, "uuid": "cf14d2e7-ab72-471c-94fa-6075e8cb6871", "value": "2ps1.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fe13621-6b24-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781794020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781794020, "uuid": "90143d09-8b2e-405f-8218-31f105110f2e", "comment": "Malware payload (Mirai)", "value": "7740e3da8c5b73fa4b0eace4119c8518", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781794020, "uuid": "09bee829-98ef-476b-b3d0-3a9c80e315e9", "comment": "Malware payload (Mirai)", "value": "fd7543a8e055c371885debbf0654d69f55f5ff24036c77b3665333f25d6ebee9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781794020, "uuid": "be063e40-9ff0-42eb-bb61-2823bebc71ac", "comment": "Malware payload (Mirai)", "value": "06c59dc4f5dd45f3b0659d97bcc35465a692710f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781794020, "uuid": "1c0de224-c87f-469c-b14c-528e14f0453c", "comment": "Malware payload (Mirai)", "value": "880e4c34aad9c4c665fac84193e967733b67065053416d537e365700e163bbd2fa463fa88d0eab8bc31e1f38d88d06f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781794020, "uuid": "c02a2f42-b8a1-4e42-97ff-a8482d0805c5", "value": "T12BA302DDF0168EAD0364866BC7BD0DC067966338EC767EA22720470CB1A24462BFEDD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781794020, "uuid": "7c3a1114-5e7b-42b6-911f-6c0be91a427e", "value": "1536:umuWhmM3NdIeo8F0DHbVgQFhyh6BtVTP/XUX8240YztedLQmUkiM9xIQgipH:ZuW0uNvyGWyhqTPMa0uedLnUkimIspH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781794020, "uuid": "dcd6ecde-2875-423a-846c-cf1f21d60a0c", "value": 105184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781794020, "uuid": "93de7220-71ff-4413-b0fa-72e4ee389c52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781794020, "uuid": "4021f3c1-d76b-4262-80df-0612ee833cea", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31e8cadd-6b14-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781786990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781786990, "uuid": "f1b62ec0-137a-491d-8f50-f570cdd3e52c", "comment": "Malware payload", "value": "0874078db0419bd72ec00c03c11bb857", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781786990, "uuid": "6b9fc878-621a-4b45-8d84-747d393ea42c", "comment": "Malware payload", "value": "fea90bb194ec6f6399dd7e88a47c67760935faf6e737b2ac6715b43e9cb94f66", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781786990, "uuid": "79d22703-91fa-4042-add5-a0a4651d7cc7", "comment": "Malware payload", "value": "5119074c06d292e018688f2b5c4b092b3d591fc5", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781786990, "uuid": "ca564c94-c3e2-4111-9543-ccee761b35a3", "comment": "Malware payload", "value": "44dd4e31fada5a8b4b149c92f0c53ea31373430ed960c68fc87433183eb3d67ab849c155a172e49278115c7023eb7a13", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781786990, "uuid": "f41b75e0-fba6-4211-893e-1d72b27d3a10", "value": "T1E0F02301C7752E92C256C0304C7AB1E46603960A7833B20DC2BC874B0DCAE2C6E470C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781786990, "uuid": "0aacfb77-052d-4aac-bf2a-6c5883854393", "value": "12:5jzUKoE+j9D3wOEsUVifzDgwUKrgd32z+yQ2JaG:9IEOLEsUof/yd3ry9h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781786990, "uuid": "b51b7233-28b7-42be-ab13-031d00c1b3e4", "value": 451, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781786990, "uuid": "67d32726-512d-4ba8-8a51-1277bf32eef5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781786990, "uuid": "9d0b62dd-23ba-4980-8a34-b232bca499c9", "value": "artes.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fbb906e-6b35-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781801348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781801348, "uuid": "20ac12a0-a568-4b62-9261-e6feab9282e2", "comment": "Malware payload", "value": "d3ef9ab5b21649fe28290735242e7e12", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781801348, "uuid": "26e98c16-1392-4a7c-b827-939d5e88cd9e", "comment": "Malware payload", "value": "feb46ecf8212f3d6d43afff5ff37558a97486ebea72059ea03b29b53f42ed23c", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781801348, "uuid": "809faa85-6553-4fc6-adf3-cb48ad8a681a", "comment": "Malware payload", "value": "ad3486e5761a5b07df93b358025547f69ff11bb3", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781801348, "uuid": "9cdd6509-0a9e-4a3f-be2a-1c99a21087ed", "comment": "Malware payload", "value": "db8473cdd48fed105ab81a70f66eab1cb2e3d147c302f58c39f9bc6e46e35393d2beb9f2b40e9dceb01f97668d28b75a", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781801348, "uuid": "9935b5fc-cd94-4d99-bea3-ddca0b1a6bda", "value": "T14C43C0C72148BF45A39CC19433ED878B537879B7CD643A830888EC971ADD617A72F456", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781801348, "uuid": "9410352c-c12c-427d-b836-7a4e734e2d2b", "value": "1536:VmKkfRjqWKGjMc/AyiYv7Xhlc0HxO33Po:HUYsjMcHJ7Xc0HGo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781801348, "uuid": "ff23f432-8587-4f09-a09e-8f4f3a8990d5", "value": 56382, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781801348, "uuid": "f7d06a06-a58a-4168-8f31-6059adf5239e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781801348, "uuid": "8b1ff0d8-b60e-42fb-9d63-ef98eb33f6f1", "value": "exe84611.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef7afb93-6af6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781774423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781774423, "uuid": "9c6dfb75-f452-4b7e-9977-d3e364266377", "comment": "Malware payload", "value": "3b7f6b5e3cf626157f4b9999f8c886f9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781774423, "uuid": "f3fff7c3-143e-4fd9-b6d0-99ba047b4fe1", "comment": "Malware payload", "value": "fee64036b9b9231325f5aa676fd77626eaec6cc6e52506211d24cedd6ea27c19", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781774423, "uuid": "1fec2c75-328f-49b0-8038-b13d697839d1", "comment": "Malware payload", "value": "3abe8ea78417268a75f5a097958e3bb8237ff509", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781774423, "uuid": "9b733115-0897-4d75-a8df-889dfa7081b4", "comment": "Malware payload", "value": "d119eab4ffdfe6d991b04936cb3aade1d7675e7a22a22a8a71e179454f793144e9172c8bb8da0ea738972e7a7d53dbfb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781774423, "uuid": "9d300796-6fb0-45b9-9020-5119c7affca3", "value": "T140762A57B8924952C4E43A37B8BE81C433630EBA8BD7565B6D04EE383EBE1D90E35744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781774423, "uuid": "36f4df51-8d75-447d-b9c3-cb82f331e3d1", "value": "49152:tYl1FpCfQ4eY7CNgwlFVoGvcxYkmgyA7cokU3H5cO78g0UBq5EC:mvW8OIgwlFVoGvcdcO78xUiEC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781774423, "uuid": "45cc9ae1-2b11-4c21-8445-0b9cba96fe48", "value": 7405752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781774423, "uuid": "154a3f74-af9c-40df-b63c-e87952f0ccde", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781774423, "uuid": "5cb96e4c-5685-4fe4-8459-78e5b1d498d9", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fea85518-6b29-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781796353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781796353, "uuid": "7e88179e-6982-4eec-bde2-4dbd6ef0ca1f", "comment": "Malware payload (Mirai)", "value": "0328c41404ed4ccfb37712254b5ba40b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781796353, "uuid": "8a576255-c474-48be-b6c7-ee90c0b607cb", "comment": "Malware payload (Mirai)", "value": "ffea7626c96145ef4f6e824e7ad2395bf6a3925eb0080927796f058f1ddb113c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781796353, "uuid": "599dd05c-85f0-4e7e-86b9-8667df03b7f0", "comment": "Malware payload (Mirai)", "value": "30461b72c9a1d62727ca0c8d6790ff45ba889ff5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781796353, "uuid": "ba9f39c5-26c5-40f9-a2dc-67fe303119a5", "comment": "Malware payload (Mirai)", "value": "b02de1a2baa35a5530585b379ac5e817ff63d8458ccbf6d32b6390b7b5b3dcd7cc26749843eb725fafa7e0627b8e0546", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781796353, "uuid": "20d03e84-7f48-418e-95fb-89fbb10e8e30", "value": "T1EB242B46B8819F15C6D016BEFE1D128E332717B8E1DE7212DD205F657B8A86F0E3BA11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781796353, "uuid": "ab73f0fa-58fe-4d69-b7a3-893580f8aaa8", "value": "3072:o2cIEm1w+xoivrB3H4my8C+W0LjcLTUoEnkhLXZfgqFarpOz4WSqKvwbq8lw1F:tjHwRijBXFPGnRLX9gCaghSq1bq8lc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781796353, "uuid": "954c26bf-eed4-4f3d-9758-6444ba4f587c", "value": 224380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781796353, "uuid": "6018fb5d-efc5-4310-b9fb-8f5d9df6b664", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781796353, "uuid": "5bdc6dc5-3d73-4ece-a658-3843b9c95a1e", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }